mock-server
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the @scalar/mock-server, @scalar/cli, and @hono/node-server packages from the npm registry. It also fetches OpenAPI specification files from remote URLs when configured.
- [COMMAND_EXECUTION]: Provides examples for running mock servers using npx and Docker, specifically using the scalarapi/mock-server image.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external OpenAPI documents which serves as a vulnerability surface for indirect prompt injection through specification extensions. 1. Ingestion points: OpenAPI documents provided via file paths or URLs. 2. Boundary markers: None identified in the skill instructions. 3. Capability inventory: File system reading, network fetching, and dynamic logic execution via extensions. 4. Sanitization: Relies on the underlying library implementation.
- [DYNAMIC_EXECUTION]: Supports custom request logic and data seeding through x-handler and x-seed extensions, which involve runtime evaluation of logic defined within the OpenAPI specification.
Audit Metadata