openapi-to-typescript
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external OpenAPI files (JSON/YAML) and interpolates that content directly into generated TypeScript code.
- Ingestion points: Step 2 of the Workflow in
SKILL.mdreads and validates the OpenAPI specification file provided by the user or found in the path. - Boundary markers: There are no boundary markers or explicit instructions to ignore embedded commands within the descriptions or fields of the OpenAPI spec being processed.
- Capability inventory: The skill has the capability to read local files (the spec) and write local files (the generated TypeScript interfaces, default
types/api.ts). - Sanitization: The skill lacks explicit sanitization or filtering of the
descriptionfields or property names from the OpenAPI spec, which are directly used to generate JSDoc comments and interface keys in the output file.
Audit Metadata