testing-api
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes processes for interacting with external API endpoints, which inherently creates an attack surface for indirect prompt injection if those endpoints provide malicious or manipulated payloads.
- Ingestion points: API response bodies, headers, and status codes retrieved through tools such as curl, newman, and httpie (SKILL.md).
- Boundary markers: Absent; the documentation provides tool usage examples but does not define explicit delimiters to help an agent distinguish between testing metadata and potentially malicious data within the responses.
- Capability inventory: The skill includes a basic shell script (scripts/example.sh) and instructions for running various network-active CLI tools (SKILL.md).
- Sanitization: The skill provides guidance on validation (e.g., using ajv for schema checks) but does not include specific sanitization instructions for the agent context.
Audit Metadata