schemathesis

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install the schemathesis package from PyPI and provides examples for using the official schemathesis/action in GitHub Actions and the schemathesis/schemathesis Docker image.\n- [COMMAND_EXECUTION]: The skill utilizes the st run (alias for schemathesis run) command to perform API testing, which involves making network requests to user-specified endpoints.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted API schemas (OpenAPI and GraphQL), creating a surface for indirect prompt injection where a malicious schema could attempt to influence the agent's behavior during the fuzzing process.\n
  • Ingestion points: External OpenAPI/GraphQL schema URLs and local schema files.\n
  • Boundary markers: Not explicitly specified in instructions; the skill relies on the tool's built-in schema parsing and validation logic.\n
  • Capability inventory: The skill is capable of performing network requests to target APIs and writing report files (JUnit, HAR, etc.) to the local file system.\n
  • Sanitization: Implicitly handled by the standard schema parsing engine of the Schemathesis tool.\n- [DYNAMIC_EXECUTION]: The skill supports the use of custom Python check modules through the SCHEMATHESIS_HOOKS environment variable, which allows the tool to load and execute user-defined Python code during the testing lifecycle.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 08:28 AM