api-testing-observability-api-mock
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to build and manage mock API servers that ingest and process untrusted data from external HTTP requests.
- Ingestion points: The
MockAPIServer(inresources/implementation-playbook.md) processes request methods, paths, and headers. TheDynamicStubclass processes query parameters and JSON bodies. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the processed mock request data.
- Capability inventory: The skill provides logic for server creation, data generation using
Faker, and schema validation usingyamlandjsonschema(via thevalidatefunction). - Sanitization: The
track_requestsmiddleware includes logic to exclude sensitive headers likeauthorization,cookie, andx-api-keyfrom logging and tracking. - [DYNAMIC_EXECUTION]: The skill uses a pattern where several methods (e.g.,
create_dynamic_stub,generate_relational_data,execute_scenario_sequence) return hardcoded strings containing Python or JavaScript source code. - This represents script generation intended for the agent to provide to the user, but the dynamic assembly of executable logic increases complexity and potential for misuse if executed in an unsafe environment.
- [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known services.
- The
MockDocumentationGeneratorinresources/implementation-playbook.mdgenerates HTML that fetchesswagger-ui-bundle.jsandswagger-ui.cssfromhttps://unpkg.com, which is a well-known CDN for NPM packages.
Audit Metadata