{"uid":"cap_Ecm7ToR6tyYa4ygZ9Cbe7","slug":"openapi-contract-audit-safe-pytest-scaffold-02736b32","name":"OpenAPI Contract Audit + Safe Pytest Scaffold","description":"Audit one public OpenAPI 3.x JSON or YAML document and receive prioritized contract findings, a quality score, a Markdown handoff, and a safe read-only pytest scaffold.","url":"https://codex-rapid-patch-evidence.vercel.app/api/skill-security-audit","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"files":{"oneOf":[{"type":"array","items":{"oneOf":[{"type":"string"},{"type":"object","required":["content"],"properties":{"name":{"type":"string","maxLength":300},"path":{"type":"string","maxLength":300},"content":{"type":"string","maxLength":100000}},"additionalProperties":false}]},"maxItems":20},{"type":"object","additionalProperties":{"type":"string","maxLength":100000}}],"description":"Optional bounded supporting files as an array of {path, content} or an object keyed by path."},"skill":{"type":"string","maxLength":100000,"description":"AI skill Markdown or source text to audit statically."},"content":{"type":"string","maxLength":100000,"description":"Alias for skill."},"skill_markdown":{"type":"string","maxLength":100000,"description":"Alias for skill."}}},"responseSchema":{"type":"json","example":{"ok":true,"counts":{"low":0,"high":1,"medium":0,"critical":0},"safety":{"codeExecuted":false,"inputRetained":false,"networkRequests":0,"staticAnalysisOnly":true},"product":"AI Agent Skill Security Audit","verdict":"REVIEW","coverage":{"bytes":1200,"lines":38,"rulesEvaluated":10},"findings":[{"code":"DYNAMIC_CODE_EXECUTION","line":8,"message":"Uses dynamic code execution or an unrestricted shell boundary.","category":"execution","evidence":"exec(userInput)","severity":"high","recommendation":"Use a fixed command allowlist and structured arguments; do not evaluate generated text as code."}],"riskScore":20,"generatedAt":"2026-01-01T00:00:00.000Z","skillSha256":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","capabilities":["dynamic execution"],"destinations":[],"reportMarkdown":"# AI Agent Skill Security Audit\n\nVerdict: **REVIEW**"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.12","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.12/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_OQKAyn981NiW4RrQpWe6n","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.12","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits an OpenAPI 3.x specification document for contract issues and generates prioritized security findings, a quality score, a Markdown report, and a read-only pytest scaffold.","exampleAgentPrompt":"Can you audit this OpenAPI spec for contract issues and generate a pytest scaffold? Here's the YAML content: [paste OpenAPI YAML here]. I want to see prioritized findings, a risk score, and a Markdown report.","exampleUseCases":[{"title":"API contract review before deployment","prompt":"Before I ship this new REST API, can you audit this OpenAPI 3.x JSON spec for contract issues and tell me what's high or critical severity? Give me a risk score and a Markdown report I can hand off to my team."},{"title":"AI skill security screening","prompt":"I've written an AI agent skill in Markdown and I want to make sure it doesn't have any dangerous patterns like dynamic code execution or unexpected network calls. Can you run a security audit on it and tell me the verdict?"},{"title":"Generate safe pytest scaffold from spec","prompt":"I have an OpenAPI 3.x YAML document for my payments API and I need a read-only pytest scaffold generated from it so my QA team can start testing without any side effects. Can you produce that along with the coverage metrics?"}],"resultDescription":"Returns a JSON object containing: a pass/review/fail verdict, prioritized findings list (each with severity, category, evidence, line number, and recommendation), overall risk score (0-100), counts by severity (low/medium/high/critical), coverage metrics (bytes, lines, rules evaluated), a SHA-256 hash of the audited content, a list of detected capabilities and external destinations, a Markdown report, and safety metadata confirming no code was executed during analysis.","failureModes":["Malformed or invalid OpenAPI JSON/YAML causes parsing errors and no findings returned","Input exceeds 100,000 character limit per field, resulting in truncation or rejection","Non-OpenAPI 3.x documents (e.g. Swagger 2.x) may produce incomplete or inaccurate findings","Missing required content fields result in empty audit with zero findings","Network timeout if document processing takes too long","Payment failure (402) if USDC balance is insufficient"],"whenToPreferThis":"Choose this endpoint when you need static analysis of an OpenAPI 3.x contract specifically — it combines contract quality scoring, security finding prioritization, and pytest scaffold generation in a single call. Prefer it over generic linters when you need a handoff-ready Markdown report and a SHA-256 audit trail, or when auditing AI agent skill definitions for execution safety. Not suited for runtime API monitoring, Swagger 2.x documents, or dynamic penetration testing.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-16T00:35:33.701Z","isFirstParty":false}