The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Go toolchain to perform common development tasks such as downloading dependencies (go get), tidying modules (go mod tidy), and running code generation (go generate). These commands are executed within the local project context.
[EXTERNAL_DOWNLOADS]: Fetches the oapi-codegen tool and runtime library from its official repository during the setup process. This is a standard and widely recognized tool in the Go ecosystem for OpenAPI client generation.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided inputs for file paths and package names which creates a potential injection surface.
Ingestion points: User prompts for OpenAPI spec path and Client package name as defined in SKILL.md.
Boundary markers: None present; inputs are directly interpolated into command strings and Go source templates.
Capability inventory: The skill executes shell commands via the Go toolchain and writes configuration files to the user's home directory.
Sanitization: No explicit sanitization or validation of the user-provided strings is described in the instructions before interpolation into sensitive contexts.
[CREDENTIALS_SAFE]: Implements a configuration management system that stores sensitive information like API keys in a dedicated file (~/.{APP_NAME}.yaml). The implementation correctly sets file permissions to 0600 to restrict access to the current user and includes logic to mask keys when displayed via the CLI show command.

bootstrap-go-openapi