api-contract-tester
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and evaluate external project-level instructions, architecture, and requirements documents to identify testing targets and risks. This ingestion of untrusted external content represents a surface for indirect prompt injection.
- Ingestion points:
SKILL.md(Mandatory testing contract, step 1) requires the agent to read external project documentation. - Boundary markers: The skill does not provide specific delimiters or instructions to prevent the agent from obeying embedded commands within the ingested documentation.
- Capability inventory: The skill assumes the agent will use shell or file system tools to run non-destructive checks and record execution logs (Steps 5 and 6).
- Sanitization: No sanitization or input validation steps for the project documentation are defined.
- [NO_CODE]: All files in the skill package are Markdown documents or CSV headers intended for use as templates and process guides. There is no active code, script, or binary included in the skill.
Audit Metadata