Skills
Navigate
skills/alovajs/skills/alova-wormhole-usage/Gen Agent Trust Hub

alova-wormhole-usage

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing external OpenAPI/Swagger specifications to generate local API request functions.
  • Ingestion points: OpenAPI specification files or URLs provided via the input field in alova.config.js (as seen in SKILL.md).
  • Boundary markers: Not explicitly mentioned; generated output is derived directly from the external schema definitions.
  • Capability inventory: The skill uses CLI tools to write generated code and TypeScript definitions to the local filesystem in the directory specified by the output parameter.
  • Sanitization: The documentation does not describe specific validation or escaping mechanisms applied to the ingested OpenAPI data before generation.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @alova/wormhole package from the NPM registry as a development dependency.
  • [COMMAND_EXECUTION]: The skill involves running CLI commands such as npx alova gen and npx alova init to manage API configurations and trigger code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:11 PM