Skylv Api Tester

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.1

Overview

This is an instruction-only API testing skill whose risky parts are expected for API testing, but users should handle credentials and destructive requests carefully.

Install this only if you want the agent to send HTTP requests to APIs you are authorized to test. Prefer staging or mock endpoints, redact Authorization headers/API keys/cookies in prompts and reports, and be explicit before running POST, PUT, DELETE, or high-volume performance tests against production systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill explicitly demonstrates authenticated API requests and includes an Authorization header in example output, but provides no warning against using real tokens, production systems, or sensitive payloads. In an agent context, this can normalize sending secrets to arbitrary user-supplied endpoints and can lead to credential leakage or unintended disclosure of sensitive data.

VirusTotal

65/65 vendors flagged this skill as clean.