microcks-openapi-mocking
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides instructions to use
curlfor communicating with a local Microcks REST API atlocalhost:8080. It also references the execution of a local management script./mocking/import-openapi.sh. - [DYNAMIC_EXECUTION]: The skill instructs on the creation and deployment of Groovy scripts for use in 'Script Dispatchers'. These scripts provide dynamic response logic and are executed within the Microcks server environment, either via API payloads or local file loading from the
mocking/dispatchers/directory. - [INDIRECT_PROMPT_INJECTION]: The skill operates on OpenAPI specifications, which introduces a surface for indirect prompt injection. Malicious instructions could potentially be embedded in external specifications provided for processing. The analysis identified ingestion points in YAML/JSON specifications and a capability inventory including local shell commands, with no specified sanitization or boundary markers.
Audit Metadata