The API tester skill is vulnerable to
Claims to do
APITester Agent-Driven API Testing: Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.
Actually does
This skill processes YAML-defined API tests, executing HTTP requests (GET, POST) to specified URLs (e.g., `https://api.example.com/users`). It evaluates responses against defined expectations (status codes, body content) and generates formatted test results, potentially including reports in HTML, JSON, or Markdown. It processes and stores data locally and does not transmit data externally unless configured by the user.
openclaw skills install theshadowrose/openclaw-api-testerDeBERTa classifier detected prompt injection (confidence: 0.99)
The skill claims tests can be defined in 'plain English', but the provided usage examples show a structured YAML format, which is not 'plain English'.
Stated purpose: 'Define tests in plain English'. Usage section shows 'YAML test definitions'.
[](https://mondoo.com/ai-agent-security/skills/clawhub/theshadowrose/openclaw-api-tester)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/theshadowrose/openclaw-api-tester"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/theshadowrose/openclaw-api-tester.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/theshadowrose/openclaw-api-tester.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.