api-smoke-testing
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses curl commands and shell execution to start a development server and verify API status codes. These operations are restricted to the local environment (localhost) as part of the intended testing workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project files to discover API routes, which creates a surface where instructions embedded in the codebase could theoretically influence the agent's behavior.
- Ingestion points: Codebase files containing route definitions (e.g., app/api/**/route.ts, urls.py, routes.rb).
- Boundary markers: None identified; the skill does not explicitly instruct the agent to ignore instructions found within the code being analyzed.
- Capability inventory: Shell command execution for starting servers and executing curl requests.
- Sanitization: No specific sanitization or validation logic is defined for the route paths extracted from the source code.
Audit Metadata