api-tester
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as an instructional guide for API testing. All command examples (curl, jq, httpie) are standard tools used for the skill's primary purpose and do not perform unauthorized network operations.
- [CREDENTIALS_SAFE]: The instructions explicitly warn against hardcoding API keys or tokens and recommend using environment variables or secret managers, adhering to security best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow that involves ingesting untrusted data from external API responses, which is an inherent surface for indirect prompt injection.
- Ingestion points: API response bodies and headers retrieved via curl (SKILL.md).
- Boundary markers: None defined within the instructional text.
- Capability inventory: Network requests (curl), file output (-o response.json), and JSON parsing (jq).
- Sanitization: The skill focuses on testing methodology and does not define specific sanitization logic for the data received from external endpoints.
Audit Metadata