API Contract Tester

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent API contract-testing helper, with one dependency-installation caution but no evidence of hidden or malicious behavior.

Install is reasonable for API contract testing. Before running the verify workflow, review any generated tests and use a controlled environment for dependency installation and live API calls, especially if provider URLs point at shared or production systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82

Finding

Unpinned Third-Party Package Installation and Immediate Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-88
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

bash

For OpenAPI specs, validate response schemas:
```bash
# Use openapi-spec-validator if available
pip install openapi-spec-validator 2>/dev/null
python3 -c "
from openapi_spec_validator import validate
validate({'openapi': '3.0.0', ...})  # parsed spec
print('Spec is valid')
"

Technical Analysis

The verification workflow installs openapi-spec-validator from the package index without pinning an exact version, checking package hashes, using a reviewed lock file, or requiring explicit user approval. It then immediately imports and executes code from the installed package.

Consequently, the code executed by the workflow can change after the skill has been reviewed. Package installation hooks, transitive dependencies, and module initialization code may execute with the privileges and environmental access of the invoking agent. Redirecting standard error to /dev/null also conceals installation warnings and diagnostic information that could indicate a compromised, incompatible, or unexpectedly sourced dependency.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. A user invokes the skill's verify workflow on an OpenAPI contract.
2. The required validator is not already available in the environment.
3. Following SKILL.md, the agent runs the unpinned pip install openapi-spec-validator command.
4. The package manager resolves the current package release and its transitive dependencies from its configured index.
5. If an upstream release, dependency, or configured package index is compromised, attacker-controlled installation hooks or package code executes.
6. The subsequent Python command imports the installed module, providing another code-execution point.
7. Malicious code runs with the same OS per ...[truncated 689 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency and all transitive dependencies to reviewed versions through a lock file or constraints file.
2. Require cryptographic hash verification, such as pip install --require-hashes -r requirements.txt.
3. Install packages in a dedicated virtual environment or disposable sandbox rather than the agent's global environment.
4. Require explicit user approval before performing network-backed package installation.
5. Prefer pre-provisioned, trusted dependencies in a controlled execution image.
6. Configure an approved internal package index and disable fallback to untrusted indexes where practical.
7. Remove 2>/dev/null; preserve and inspect installation errors and security warnings.
8. Separate installation from execution so the package artifact and resolved dependency tree can be reviewed before import.
9. Run validation with minimum filesystem, credential, and network permissions.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

# API Breaking Change Report

## Breaking Changes (3 found)
1. `DELETE /api/users/{id}` — endpoint removed
   Impact: Any consumer calling this endpoint will get 404
   Migration: Use `PATCH /api/users/{id}` with `{active: false}` instead

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

Endpoint | consumer-web | consumer-mobile | consumer-worker GET /api/users | ✓ | ✓ | POST /api/orders | ✓ | ✓ | ✓ DELETE /api/users | | |

text

Flag endpoints with zero consumers as deprecation candidates.