mcp-openapi-typescript-stack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required workflow explicitly ingests an OpenAPI "input" that can be a path, URL, or registry id (see reference/openapi-ts.md "input: './openapi.json' // path, URL, or supported registry id" and the CLI examples in SKILL.md), and the generated SDK/Zod schemas from that external spec are consumed to register MCP tools (src/generated) so untrusted public specs can directly change tool inputs and runtime behavior.