# OpenAPI Contract Audit + Safe Pytest Scaffold

> OpenAPI Contract Audit + Safe Pytest Scaffold is a paid API for AI agents from codex-rapid-patch-evidence.vercel.app, paid per call via x402, $0.12/call, status unknown (last checked 2026-09-16).

Audits an OpenAPI 3.x specification document for contract issues and generates prioritized security findings, a quality score, a Markdown report, and a read-only pytest scaffold.

## Facts

- Endpoint: POST https://codex-rapid-patch-evidence.vercel.app/api/skill-security-audit
- Price: $0.12/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/openapi-contract-audit-safe-pytest-scaffold-02736b32
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Ecm7ToR6tyYa4ygZ9Cbe7

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability openapi-contract-audit-safe-pytest-scaffold-02736b32 -d '<json body>'
```

Example prompt: Can you audit this OpenAPI spec for contract issues and generate a pytest scaffold? Here's the YAML content: [paste OpenAPI YAML here]. I want to see prioritized findings, a risk score, and a Markdown report.

## When to prefer this

Choose this endpoint when you need static analysis of an OpenAPI 3.x contract specifically — it combines contract quality scoring, security finding prioritization, and pytest scaffold generation in a single call. Prefer it over generic linters when you need a handoff-ready Markdown report and a SHA-256 audit trail, or when auditing AI agent skill definitions for execution safety. Not suited for runtime API monitoring, Swagger 2.x documents, or dynamic penetration testing.

## Known failure modes

- Malformed or invalid OpenAPI JSON/YAML causes parsing errors and no findings returned
- Input exceeds 100,000 character limit per field, resulting in truncation or rejection
- Non-OpenAPI 3.x documents (e.g. Swagger 2.x) may produce incomplete or inaccurate findings
- Missing required content fields result in empty audit with zero findings
- Network timeout if document processing takes too long
- Payment failure (402) if USDC balance is insufficient

## How this service works

Audit one public OpenAPI 3.x JSON or YAML document and receive prioritized contract findings, a quality score, a Markdown handoff, and a safe read-only pytest scaffold.

## Output

Returns a JSON object containing: a pass/review/fail verdict, prioritized findings list (each with severity, category, evidence, line number, and recommendation), overall risk score (0-100), counts by severity (low/medium/high/critical), coverage metrics (bytes, lines, rules evaluated), a SHA-256 hash of the audited content, a list of detected capabilities and external destinations, a Markdown report, and safety metadata confirming no code was executed during analysis.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "oneOf": [
    {
     "type": "array",
     "items": {
      "oneOf": [
       {
        "type": "string"
       },
       {
        "type": "object",
        "required": [
         "content"
        ],
        "properties": {
         "name": {
          "type": "string",
          "maxLength": 300
         },
         "path": {
          "type": "string",
          "maxLength": 300
         },
         "content": {
          "type": "string",
          "maxLength": 100000
         }
        },
        "additionalProperties": false
       }
      ]
     },
     "maxItems": 20
    },
    {
     "type": "object",
     "additionalProperties": {
      "type": "string",
      "maxLength": 100000
     }
    }
   ],
   "description": "Optional bounded supporting files as an array of {path, content} or an object keyed by path."
  },
  "skill": {
   "type": "string",
   "maxLength": 100000,
   "description": "AI skill Markdown or source text to audit statically."
  },
  "content": {
   "type": "string",
   "maxLength": 100000,
   "description": "Alias for skill."
  },
  "skill_markdown": {
   "type": "string",
   "maxLength": 100000,
   "description": "Alias for skill."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "counts": {
   "low": 0,
   "high": 1,
   "medium": 0,
   "critical": 0
  },
  "safety": {
   "codeExecuted": false,
   "inputRetained": false,
   "networkRequests": 0,
   "staticAnalysisOnly": true
  },
  "product": "AI Agent Skill Security Audit",
  "verdict": "REVIEW",
  "coverage": {
   "bytes": 1200,
   "lines": 38,
   "rulesEvaluated": 10
  },
  "findings": [
   {
    "code": "DYNAMIC_CODE_EXECUTION",
    "line": 8,
    "message": "Uses dynamic code execution or an unrestricted shell boundary.",
    "category": "execution",
    "evidence": "exec(userInput)",
    "severity": "high",
    "recommendation": "Use a fixed command allowlist and structured arguments; do not evaluate generated text as code."
   }
  ],
  "riskScore": 20,
  "generatedAt": "2026-01-01T00:00:00.000Z",
  "skillSha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "capabilities": [
   "dynamic execution"
  ],
  "destinations": [],
  "reportMarkdown": "# AI Agent Skill Security Audit\n\nVerdict: **REVIEW**"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/openapi-contract-audit-safe-pytest-scaffold-02736b32/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from codex-rapid-patch-evidence.vercel.app](https://www.zero.xyz/host/codex-rapid-patch-evidence.vercel.app/llms.txt)