mocking-apis

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and utilizes well-known, reputable tools and libraries for API mocking, including Prism (Stoplight), Mock Service Worker (MSW), and Faker.js. It includes examples of using npx to run @stoplight/prism-cli directly from the NPM registry, which is a standard development practice for this category of tool.
  • [COMMAND_EXECUTION]: The skill utilizes a scoped shell environment Bash(api:mock-*) to facilitate project scaffolding and the execution of mock server runtimes. This command execution is restricted to the skill's primary purpose of generating and running development mock servers.
  • [PROMPT_INJECTION]: The skill processes external, untrusted data in the form of OpenAPI specification files to generate code and data fixtures. This represents a potential surface for indirect prompt injection where instructions could be hidden in schema descriptions. However, the skill implements a standard development workflow and the risk is considered low and associated with its primary intended purpose.
  • Ingestion points: OpenAPI 3.0+ specification files (SKILL.md, implementation.md).
  • Boundary markers: Not explicitly defined for the interpolation of schema data into generated templates.
  • Capability inventory: File writing (Write) and scoped shell execution (Bash(api:mock-*)) for server management.
  • Sanitization: Standard parsing of OpenAPI schemas for data generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 04:34 PM