Agent skill for stateful OpenAPI mock servers
SaferSkills independently audited mockapi (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 4 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to create stateful mock API servers from OpenAPI contracts. The agent owns behavior analysis and sidecar authoring; bundled scripts only perform structural validation and deterministic typed scaffolding. Generated operation services are TODOs; the agent completes wiring and behavior from .mockapi/behavior.md anchors.
Route invocations:
profile, generate, and freeformexamples. Ask what the user wants to do.
profile: read reference/profile.md and follow that workflow.Everything after profile is the target or context.
generate: before any OpenAPI search or repo-wide file scan,read reference/generate.md and run the generate sidecar preflight from that workflow. Everything after generate is the target or context. After the profile and sidecars are present and validation succeeds, always run <python> <skill-root>/scripts/generate.py; do not satisfy a generate command by only describing, planning, or hand-writing the scaffold.
Do not reject unknown first words merely because they are not commands.
General mockapi request routing:
"scaffold", or "use this OpenAPI" route to reference/generate.md. generate auto-runs the profile workflow when sidecars are missing.
reference/profile.md.
scripts/validate_profile.py, read reference/sidecars.md, and repair or report blockers as needed. The validator checks profile.toml and behavior.md unless --profile-only is used.
reference/generated-server.md, reference/mock-server-structure.md, and reference/mock-server-examples.md, then inspect the relevant files. When finishing or reviewing LLM-owned generated server code, also read reference/mock-server-quality.md.
If the freeform intent remains ambiguous after inspecting the repository, ask one concise clarification before mutating files. Do not invent extra commands or run unbundled scripts.
<python> to anexecutable whose version is 3.11+ before running script examples. If no suitable interpreter exists, stop and report the requirement to the user. Bundled CLI scripts also verify the active interpreter and fail with a clear error when it is too old.
<skill-root> to the directory containing this SKILL.md. Run shellcommand examples by replacing <skill-root> with that absolute or repository-relative skill directory.
scripts/*.py during normalskill usage.
reference/*.md and the target repository context as the primarycontract for agent decisions. Do not read script source as a source of profiling requirements during normal profile work.
reference/sidecars.md as the authoritative sidecar schema, includingvalid profile.toml fields. If a needed sidecar shape is missing from the references, stop and report the exact documentation gap instead of inferring it from scripts/mockapi_runtime/*.py.
after running the committed scripts. Do not use script source to discover valid sidecar fields, defaults, or profile behavior policy.
scripts/detect_package_manager.py; do not hand-roll command -v package manager checks or rely on interactive shell startup files.
generate workflows, run generated package codegen before implementing orediting LLM-owned controller wiring or feature modules.
changes.
.mockapi/profile.toml and .mockapi/behavior.md as the durablesource of truth for generation.
generate workflow, run scripts/generate.py --run-codegen aftersuccessful validation. If validation fails, repair sidecars or report blockers instead of running the generator on invalid data.
profile.toml as the structural operation index. Implement operationbehavior from the matching behavior.md anchor, not from operation shape.
reference/sidecars.md for sidecar shape and validation expectations.reference/generated-server.md, reference/mock-server-structure.md,reference/mock-server-examples.md, reference/seed-data.md, reference/testing.md, and reference/mock-server-quality.md when inspecting or finishing generated server code.
Validate sidecars:
<python> <skill-root>/scripts/validate_profile.pyPreflight sidecars for generate:
<python> <skill-root>/scripts/preflight_generate.py --root .Profile-only validation:
<python> <skill-root>/scripts/validate_profile.py --profile-onlyGenerate server scaffold and run codegen:
<python> <skill-root>/scripts/generate.py --root . --profile .mockapi/profile.toml --run-codegenDetect generated package manager for manual regeneration:
<python> <skill-root>/scripts/detect_package_manager.py --root . --profile .mockapi/profile.tomlFinal quality gate after implementation only:
<python> <skill-root>/scripts/check_generated_quality.py --package-root <packageRoot> --profile .mockapi/profile.toml~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.