api-test-reporter

• Outcome: Review
• Latest audit: May 29, 2026 at 9:32 PM UTC
• Version:
  1.0.0

Overview

This API testing skill is coherent, but it needs review because it can query databases, send live API traffic, and save full request and response data without clear safeguards.

Install only if you will review every generated config before execution. Use authorized staging APIs, read-only test database accounts, sanitized or synthetic records where possible, replace all sample hosts and credentials, inspect SQL queries, and keep generated reports out of shared folders or source control unless sensitive fields are redacted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to activate the skill for generic requests like API testing or report generation, which can cause the agent to select a skill that performs network calls, database access, and file generation outside the user's narrowly intended task. In this skill's context, overbroad routing is more dangerous because the skill is explicitly designed to execute automated tests and query databases, so accidental invocation can lead to unintended external actions and data exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to connect to databases, execute automated HTTP tests, and generate local output files without any user-facing warning or confirmation step. This is dangerous because it can cause undisclosed access to sensitive systems, transmission of real data to external endpoints, and creation of artifacts containing credentials, request payloads, or response data; the included example even contains hardcoded database credentials, which heightens the risk in this context.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document includes a concrete `db_fixture` pattern with database host, user, password, and live SQL queries against real business data, but provides no warning about handling secrets, least-privilege access, masking, or use of production data. In a testing workflow skill, this omission can lead users to place real credentials in config files and query sensitive records during test execution, increasing the risk of credential exposure and unauthorized data access.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The workflow describes executing API test cases, sending requests, and generating reports, but does not warn that test runs may transmit real data to external services or trigger state changes, rate limits, or other effects on target systems. In this context, users are also encouraged to pull real values from a database fixture, which makes accidental data leakage or unintended impact on non-test environments more likely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The tool writes full test results to disk, including request bodies and response bodies, which may contain secrets, personal data, tokens, or internal business data returned by the tested API. Because the output is generated automatically and without redaction, sensitive information can persist on disk and be exposed through shared folders, backups, logs, or source repositories.

VirusTotal

65/65 vendors flagged this skill as clean.