技能 happyflow-generator
📦

happyflow-generator

內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

產生 API 成功路徑測試

API 團隊需要快速證明文件化端點能在深入測試前協同運作。此技能會解析規格、建立有序流程，並產生 Python 腳本來執行預期的成功路徑。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "happyflow-generator" from https://skillstore.io/skills/chaim12345-happyflow-generator.md and its manifest at https://skillstore.io/api/skills/chaim12345-happyflow-generator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/chaim12345-happyflow-generator.md 已簽名 manifest GET /api/skills/chaim12345-happyflow-generator/manifest 已簽名 lockfile GET /api/skills/chaim12345-happyflow-generator/lockfile

測試它

正在使用「happyflow-generator」。 不需驗證的簡單客戶 API 的 OpenAPI URL。

預期結果:

  • 針對建立、讀取、更新和刪除操作的相依性排序端點計畫。
  • 產生的 Python 測試腳本描述，包含重試處理和回應檢查。
  • 顯示總步驟數、成功請求、失敗和經過時間的執行摘要。

正在使用「happyflow-generator」。 本機規格加上預備 API 的 bearer token。

預期結果:

  • 顯示偵測到的基底 URL 和規劃中已驗證請求的目標審查。
  • 使用所提供 authorization header 的產生式成功路徑流程。
  • 在分享產生的腳本前移除或遮蔽機密的建議。

正在使用「happyflow-generator」。 在必要欄位上發生驗證錯誤的失敗產生流程。

預期結果:

  • 對失敗步驟和回應狀態的簡潔說明。
  • 根據規格結構描述提出的請求資料調整建議。
  • 套用最小安全變更後的重試摘要。

安全審計

高風險
v9 • 2026/7/5 開啟版本化報告

The audit confirms real risks from generated Python execution, full environment inheritance, API credential handling, and outbound requests to user or specification controlled targets. Most Markdown fence detections and endpoint identifier findings are false positives. No prompt injection text was found, but publication should require sandboxing, target confirmation, and secret redaction.

1
已掃描檔案
1,040
分析行數
13
複核項目
0
已忽略的誤報

已確認的安全問題 (3)

高
SKILL.md:126-144SKILL.md:610-640SKILL.md:853-868
Automatic Execution Of Generated Python
The skill fetches or reads API specifications, interpolates spec-derived paths into Python source, writes the result to a temp file, and executes it. A malicious or malformed specification can influence generated code and network behavior.
The workflow directly connects untrusted specifications to generated source and subprocess execution. The cited lines show parsing, path interpolation, file writing, and execution.
高
SKILL.md:40-65SKILL.md:814-815SKILL.md:964-966
Credential Exposure Through Generated Script Output
User credentials are converted into authorization headers, embedded into generated Python source, and the final script is printed. Secrets can be exposed in transcripts, logs, or copied scripts.
The code builds headers from tokens, API keys, passwords, and OAuth secrets, serializes AUTH_HEADERS into generated source, then prints the final script.
高
SKILL.md:150-155SKILL.md:510-512SKILL.md:526
Spec-Controlled Network Target Receives Credentials
The base URL is taken from the OpenAPI specification and the generated executor applies authentication headers to its session. A hostile specification can direct authenticated requests to attacker-controlled infrastructure.
The lines show base_url coming from the specification and auth headers applied to every session request. This is a concrete credential misuse path if a spec is untrusted.
能力複核項目 (13)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高
SKILL.md:863
Python subprocess.run
result = subprocess.run(
The skill writes generated Python to a temp file and executes it with subprocess.run. The script is derived from API specifications and inherits environment variables, so this is real code execution risk.
高
SKILL.md:859
Python environment access
env = os.environ.copy()
The executor copies the full process environment and passes it into the generated script subprocess. That can expose unrelated secrets to generated code.
高
SKILL.md:46
Generic API/secret keys
elif auth_type == "api_key":
The branch enables API key credential handling. It is intended functionality, but it means the skill processes sensitive secrets for outbound requests.
高
SKILL.md:48
Generic API/secret keys
return {header_name: credentials['api_key']}
The API key is placed directly into an outbound header dictionary. This is legitimate for API testing but can expose the secret if the request target is wrong or untrusted.
中
SKILL.md:526
HTTP client library
lines.append(' response = self.session.request(method, url, **kwargs)')
The generated executor directly calls self.session.request with generated URLs and authentication headers. This can send credentials and test data to external API targets.
中
SKILL.md:661
HTTP client library
lines.append(' response = self._make_request("%s", url, data=payload, files=files)' % met
The generated multipart request path sends payloads and files to the target API. This is legitimate testing behavior but still creates outbound network and data exposure risk.
中
SKILL.md:665
HTTP client library
lines.append(' response = self._make_request("%s", url, json=payload)' % method.lower())
The generated JSON request path sends payloads to the target API. This is a real network operation controlled by parsed specification data.
中
SKILL.md:668
HTTP client library
lines.append(' response = self._make_request("%s", url)' % method.lower())
The generated no-body request path still performs outbound HTTP requests to specification-derived URLs. The capability is intended but security-sensitive.
中
SKILL.md:65
Python HTTP libraries
response = requests.post(token_url, data=data)
The OAuth2 flow posts client credentials to a token URL supplied in credentials. This is legitimate authentication handling, but a wrong token URL can expose secrets.
中
SKILL.md:131
Python HTTP libraries
response = requests.get(spec_source, headers=headers or {})
The parser fetches specifications from arbitrary HTTP URLs and may include caller-supplied headers. This is expected for URL specs but creates external request and header exposure risk.
低
SKILL.md:521
HTTP client library
lines.append(' def _make_request(self, method, url, **kwargs):')
The generated script defines a helper that performs HTTP requests during API flow execution. This is expected behavior, but it can contact external targets from the specification.
低
SKILL.md:511
Python HTTP libraries
lines.append(' self.session = requests.Session()')
The generated script creates a requests.Session and later applies auth headers to it. This is part of a real outbound request workflow.
低
SKILL.md:853
Temp file creation
with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
The skill writes generated Python source to a temporary file before execution. This file operation is expected but security-sensitive because the content is generated from parsed API data.

風險因素

⚙️ 外部命令 (19)
SKILL.md:863 SKILL.md:35-75 SKILL.md:75-83 SKILL.md:83-278 SKILL.md:278-286 SKILL.md:286-422 SKILL.md:422-430 SKILL.md:430-833 SKILL.md:833-841 SKILL.md:841-925 SKILL.md:925-933 SKILL.md:933-970 SKILL.md:970-988 SKILL.md:988-996 SKILL.md:996-998 SKILL.md:998-1001 SKILL.md:1001-1002 SKILL.md:1002-1007 SKILL.md:1007-1010
🌐 網路存取 (11)
SKILL.md:521 SKILL.md:526 SKILL.md:661 SKILL.md:665 SKILL.md:668 SKILL.md:65 SKILL.md:131 SKILL.md:511 SKILL.md:276 SKILL.md:277 SKILL.md:938
📁 檔案系統存取 (3)
SKILL.md:843 SKILL.md:853 SKILL.md:914
🔑 環境變數 (4)
SKILL.md:821 SKILL.md:859 SKILL.md:46 SKILL.md:48
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/chaim12345-happyflow-generator/security.svg)](https://skillstore.io/skills/chaim12345-happyflow-generator?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/chaim12345-happyflow-generator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/chaim12345-happyflow-generator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/chaim12345-happyflow-generator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

Chaim12345. (2026). happyflow-generator security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9

BibTeX 引用

@techreport{chaim12345-chaim12345-happyflow-generator-2026, author = {Chaim12345}, title = {happyflow-generator security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "happyflow-generator security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "Chaim12345" date-released: "2026-07-05" url: "https://skillstore.io/skills/chaim12345-happyflow-generator/audits/9" identifiers: - type: other value: "skillstore:chaim12345-happyflow-generator:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
55
架構
85
可維護性
87
內容
70
社群
70
規範符合度

你可以打造什麼

驗證新的 API 契約

在與其他團隊分享 API 之前，從 OpenAPI 文件產生快速的成功路徑腳本。

準備迴歸冒煙測試

建立有序的端點檢查，以確認核心 API 流程在變更後仍會回傳成功回應。

檢查部署就緒狀態

在推進版本發布前，針對預備環境執行以規格為基礎的流程。

試試這些提示

產生基本流程 
Use happyflow-generator with this OpenAPI URL. Generate a sequential happy path test script and summarize the endpoint order before execution.
安全地使用驗證 
Use this local OpenAPI file and bearer token. Show the base URL and endpoints first. Wait for confirmation before running requests.
偵錯失敗的成功路徑步驟 
Review the failed happy path output. Explain the failing step, likely request data issue, and the smallest change needed to retry.
強化產生的測試 
Generate the happy path script, then refactor it to avoid embedded secrets, use environment variables, and add clear target confirmation steps.

最佳實務

  • 在允許任何請求執行前，先審查偵測到的基底 URL、token URL 和端點清單。
  • 使用權限有限的預備憑證，並在分享產生的腳本前移除或遮蔽機密。
  • 在具最小環境和嚴格網路允許清單的沙盒環境中執行產生的腳本。

避免

  • 未經明確核准和速率限制，不要對生產系統執行產生的腳本。
  • 不要將長期有效的 API keys 貼到提示或產生的原始碼檔案中。
  • 未先審查伺服器目標和範例前，不要信任來自未知 URL 的規格。

常見問題

此技能支援哪些規格格式？
它支援 OpenAPI 規格和簡化的 GraphQL 路徑。OpenAPI 支援較完整。
它可以自動執行請求嗎？
可以。此技能包含執行邏輯，因此使用者應在執行前確認目標和憑證。
它會處理驗證嗎？
可以。它可以準備 bearer、API key、Basic 和 OAuth2 client credentials 標頭。
每個產生的請求都會通過嗎？
不會。有些 API 需要特定商業資料，無法僅從規格推論。
它適合用於生產測試嗎？
請先在開發或預備環境中使用。生產環境使用需要核准、限制、監控和範圍限定的憑證。
Claude、Codex 和 Claude Code 可以使用此技能嗎？
報告列出 Claude、Codex 和 Claude Code 與以規格為基礎的 API 工作流程產生功能相容。

開發者詳細資訊

作者

Chaim12345

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/Chaim12345/happyflow-generator-skill/tree/main/skills/

引用

02f077c174c5335e2f5d02ca15e77b70d9543e58

維護新鮮度

2026/7/29

使用量

6 次下載 · 218 次瀏覽

檔案結構

📄 SKILL.md

相關技能

查看全部