api-testing-observability-api-mock

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to build and manage mock API servers that ingest and process untrusted data from external HTTP requests.
  • Ingestion points: The MockAPIServer (in resources/implementation-playbook.md) processes request methods, paths, and headers. The DynamicStub class processes query parameters and JSON bodies.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the processed mock request data.
  • Capability inventory: The skill provides logic for server creation, data generation using Faker, and schema validation using yaml and jsonschema (via the validate function).
  • Sanitization: The track_requests middleware includes logic to exclude sensitive headers like authorization, cookie, and x-api-key from logging and tracking.
  • [DYNAMIC_EXECUTION]: The skill uses a pattern where several methods (e.g., create_dynamic_stub, generate_relational_data, execute_scenario_sequence) return hardcoded strings containing Python or JavaScript source code.
  • This represents script generation intended for the agent to provide to the user, but the dynamic assembly of executable logic increases complexity and potential for misuse if executed in an unsafe environment.
  • [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known services.
  • The MockDocumentationGenerator in resources/implementation-playbook.md generates HTML that fetches swagger-ui-bundle.js and swagger-ui.css from https://unpkg.com, which is a well-known CDN for NPM packages.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:17 PM