contract-testing

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data files, including OpenAPI specifications and Pact consumer contracts, to generate tests and perform validation.
  • Ingestion points: SKILL.md and references/agent-commands.md define workflows that read .yaml and .json files representing API contracts.
  • Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions that might be embedded within the processed contract data.
  • Capability inventory: The skill utilizes specialized agents (e.g., qe-api-contract-validator) that can be influenced by the structure and content of the ingested files.
  • Sanitization: No specific sanitization or filtering logic is described for the content of the API specifications before they are processed by the agents.
  • [COMMAND_EXECUTION]: The skill documentation provides command-line examples for using the aqe CLI, npx, and curl to manage contracts and trigger CI/CD webhooks.
  • [EXTERNAL_DOWNLOADS]: The skill depends on standard, well-known libraries and tools including @pact-foundation/pact, jq, and npx for contract verification and metadata processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 06:15 PM
Security Audit — agent-trust-hub — contract-testing