schemathesis
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
schemathesispackage from PyPI and provides examples for using the officialschemathesis/actionin GitHub Actions and theschemathesis/schemathesisDocker image.\n- [COMMAND_EXECUTION]: The skill utilizes thest run(alias forschemathesis run) command to perform API testing, which involves making network requests to user-specified endpoints.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted API schemas (OpenAPI and GraphQL), creating a surface for indirect prompt injection where a malicious schema could attempt to influence the agent's behavior during the fuzzing process.\n - Ingestion points: External OpenAPI/GraphQL schema URLs and local schema files.\n
- Boundary markers: Not explicitly specified in instructions; the skill relies on the tool's built-in schema parsing and validation logic.\n
- Capability inventory: The skill is capable of performing network requests to target APIs and writing report files (JUnit, HAR, etc.) to the local file system.\n
- Sanitization: Implicitly handled by the standard schema parsing engine of the Schemathesis tool.\n- [DYNAMIC_EXECUTION]: The skill supports the use of custom Python check modules through the
SCHEMATHESIS_HOOKSenvironment variable, which allows the tool to load and execute user-defined Python code during the testing lifecycle.
Audit Metadata