Skills happyflow-generator
📦
happyflow-generator
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Generate API Happy Path Tests
API teams need fast proof that documented endpoints work together before deeper testing. This skill parses specifications, builds ordered flows, and generates Python scripts that exercise expected successful paths.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "happyflow-generator" from https://skillstore.io/skills/chaim12345-happyflow-generator.md and its manifest at https://skillstore.io/api/skills/chaim12345-happyflow-generator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "happyflow-generator". An OpenAPI URL for a simple customer API without authentication.
Expected outcome:
- A dependency-ordered endpoint plan for create, read, update, and delete operations.
- A generated Python test script description with retry handling and response checks.
- A run summary showing total steps, successful requests, failures, and elapsed time.
Using "happyflow-generator". A local specification plus a bearer token for a staging API.
Expected outcome:
- A target review showing the detected base URL and planned authenticated requests.
- A generated happy path flow that uses the provided authorization header.
- A recommendation to redact secrets before sharing the generated script.
Using "happyflow-generator". A failed generated flow with a validation error on a required field.
Expected outcome:
- A concise explanation of the failing step and response status.
- A suggested request data adjustment based on the specification schema.
- A retry summary after applying the smallest safe change.
Security Audit
High Riskv9 • 7/5/2026 Open versioned report
The audit confirms real risks from generated Python execution, full environment inheritance, API credential handling, and outbound requests to user or specification controlled targets. Most Markdown fence detections and endpoint identifier findings are false positives. No prompt injection text was found, but publication should require sandboxing, target confirmation, and secret redaction.
1
Files scanned
1,040
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Automatic Execution Of Generated Python
The skill fetches or reads API specifications, interpolates spec-derived paths into Python source, writes the result to a temp file, and executes it. A malicious or malformed specification can influence generated code and network behavior.
The workflow directly connects untrusted specifications to generated source and subprocess execution. The cited lines show parsing, path interpolation, file writing, and execution.
High
Credential Exposure Through Generated Script Output
User credentials are converted into authorization headers, embedded into generated Python source, and the final script is printed. Secrets can be exposed in transcripts, logs, or copied scripts.
The code builds headers from tokens, API keys, passwords, and OAuth secrets, serializes AUTH_HEADERS into generated source, then prints the final script.
High
Spec-Controlled Network Target Receives Credentials
The base URL is taken from the OpenAPI specification and the generated executor applies authentication headers to its session. A hostile specification can direct authenticated requests to attacker-controlled infrastructure.
The lines show base_url coming from the specification and auth headers applied to every session request. This is a concrete credential misuse path if a spec is untrusted.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(
The skill writes generated Python to a temp file and executes it with subprocess.run. The script is derived from API specifications and inherits environment variables, so this is real code execution risk.
High
Python environment access
env = os.environ.copy()
The executor copies the full process environment and passes it into the generated script subprocess. That can expose unrelated secrets to generated code.
High
Generic API/secret keys
elif auth_type == "api_key":
The branch enables API key credential handling. It is intended functionality, but it means the skill processes sensitive secrets for outbound requests.
High
Generic API/secret keys
return {header_name: credentials['api_key']}
The API key is placed directly into an outbound header dictionary. This is legitimate for API testing but can expose the secret if the request target is wrong or untrusted.
Medium
HTTP client library
lines.append(' response = self.session.request(method, url, **kwargs)')
The generated executor directly calls self.session.request with generated URLs and authentication headers. This can send credentials and test data to external API targets.
Medium
HTTP client library
lines.append(' response = self._make_request("%s", url, data=payload, files=files)' % met
The generated multipart request path sends payloads and files to the target API. This is legitimate testing behavior but still creates outbound network and data exposure risk.
Medium
HTTP client library
lines.append(' response = self._make_request("%s", url, json=payload)' % method.lower())
The generated JSON request path sends payloads to the target API. This is a real network operation controlled by parsed specification data.
Medium
HTTP client library
lines.append(' response = self._make_request("%s", url)' % method.lower())
The generated no-body request path still performs outbound HTTP requests to specification-derived URLs. The capability is intended but security-sensitive.
Medium
Python HTTP libraries
response = requests.post(token_url, data=data)
The OAuth2 flow posts client credentials to a token URL supplied in credentials. This is legitimate authentication handling, but a wrong token URL can expose secrets.
Medium
Python HTTP libraries
response = requests.get(spec_source, headers=headers or {})
The parser fetches specifications from arbitrary HTTP URLs and may include caller-supplied headers. This is expected for URL specs but creates external request and header exposure risk.
Low
HTTP client library
lines.append(' def _make_request(self, method, url, **kwargs):')
The generated script defines a helper that performs HTTP requests during API flow execution. This is expected behavior, but it can contact external targets from the specification.
Low
Python HTTP libraries
lines.append(' self.session = requests.Session()')
The generated script creates a requests.Session and later applies auth headers to it. This is part of a real outbound request workflow.
Low
Temp file creation
with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
The skill writes generated Python source to a temporary file before execution. This file operation is expected but security-sensitive because the content is generated from parsed API data.
Risk Factors
⚙️ External commands (19)
SKILL.md:863 SKILL.md:35-75 SKILL.md:75-83 SKILL.md:83-278 SKILL.md:278-286 SKILL.md:286-422 SKILL.md:422-430 SKILL.md:430-833 SKILL.md:833-841 SKILL.md:841-925 SKILL.md:925-933 SKILL.md:933-970 SKILL.md:970-988 SKILL.md:988-996 SKILL.md:996-998 SKILL.md:998-1001 SKILL.md:1001-1002 SKILL.md:1002-1007 SKILL.md:1007-1010
🌐 Network access (11)
📁 Filesystem access (3)
🔑 Env variables (4)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/chaim12345-happyflow-generator?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/chaim12345-happyflow-generator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/chaim12345-happyflow-generator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/chaim12345-happyflow-generator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Chaim12345. (2026). happyflow-generator security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9BibTeX citation
@techreport{chaim12345-chaim12345-happyflow-generator-2026,
author = {Chaim12345},
title = {happyflow-generator security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "happyflow-generator security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "Chaim12345"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9"
identifiers:
- type: other
value: "skillstore:chaim12345-happyflow-generator:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
70
Spec Compliance
What You Can Build
Validate a New API Contract
Generate a quick happy path script from an OpenAPI document before sharing the API with other teams.
Prepare Regression Smoke Tests
Create ordered endpoint checks that confirm core API flows still return successful responses after changes.
Check Deployment Readiness
Run a specification-based flow against a staging environment before promoting a release.
Try These Prompts
Generate a Basic Flow
Use happyflow-generator with this OpenAPI URL. Generate a sequential happy path test script and summarize the endpoint order before execution.
Use Authentication Safely
Use this local OpenAPI file and bearer token. Show the base URL and endpoints first. Wait for confirmation before running requests.
Debug Failed Happy Path Steps
Review the failed happy path output. Explain the failing step, likely request data issue, and the smallest change needed to retry.
Harden Generated Tests
Generate the happy path script, then refactor it to avoid embedded secrets, use environment variables, and add clear target confirmation steps.
Best Practices
- Review the detected base URL, token URL, and endpoint list before allowing any request execution.
- Use staging credentials with limited permissions and redact secrets from generated scripts before sharing.
- Run generated scripts in a sandboxed environment with a minimal environment and strict network allowlist.
Avoid
- Do not run generated scripts against production systems without explicit approval and rate limits.
- Do not paste long-lived API keys into prompts or generated source files.
- Do not trust specifications from unknown URLs without reviewing server targets and examples first.
Frequently Asked Questions
What specification formats does this skill support?
It supports OpenAPI specifications and a simplified GraphQL path. OpenAPI support is more complete.
Can it execute requests automatically?
Yes. The skill includes execution logic, so users should confirm targets and credentials before running it.
Does it handle authentication?
Yes. It can prepare bearer, API key, Basic, and OAuth2 client credentials headers.
Will every generated request pass?
No. Some APIs require business-specific data that cannot be inferred from the specification alone.
Is it suitable for production testing?
Use it first in development or staging. Production use needs approval, limits, monitoring, and scoped credentials.
Can Claude, Codex, and Claude Code use this skill?
The report lists compatibility with Claude, Codex, and Claude Code for specification-based API workflow generation.
Developer Details
Author
Chaim12345License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
02f077c174c5335e2f5d02ca15e77b70d9543e58
Maintenance freshness
7/18/2026
Usage
5 downloads · 218 views
File structure
📄 SKILL.md