skills/agoodway/goodskills/openapi/Gen Agent Trust Hub

openapi

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes mix openapi.spec.json and mix openapi.spec.yaml to regenerate API documentation. These are standard commands provided by the established open_api_spex Elixir library.\n- [COMMAND_EXECUTION]: Uses grep to search the local lib/ directory for the ApiSpec configuration module. This is a local, read-only operation used for configuration discovery.\n- [COMMAND_EXECUTION]: Invokes git diff to allow the user to verify changes in the generated specification files, which is a standard development practice.\n- [PROMPT_INJECTION]: The skill interacts with untrusted project data, creating a potential surface for indirect prompt injection.\n
  • Ingestion points: Searches all .ex files in the lib/ directory and reads the contents of openapi.json and openapi.yaml.\n
  • Boundary markers: The skill does not define explicit delimiters to wrap the ingested project content or instruct the agent to ignore embedded directives.\n
  • Capability inventory: The skill has access to shell commands (mix, grep, git) across its workflows.\n
  • Sanitization: No specific escaping or validation is performed on the data extracted from the project files before it is processed by the agent.\n- [SAFE]: No external network operations, hardcoded credentials, or obfuscation techniques were identified. The skill's operations are confined to standard development tools and the local project directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 07:34 PM
Security Audit — agent-trust-hub — openapi