The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external OpenAPI specifications from various remote and local sources to generate TypeScript code.
Ingestion points: Remote URLs, local file paths, and registry shorthands (e.g., 'hey-api/backend', 'scalar:...', 'readme:...') defined in SKILL.md and references/setup-config.md.
Boundary markers: The instructions do not provide explicit delimiters or "ignore embedded instructions" warnings for the agent when processing these external specifications.
Capability inventory: The skill uses bunx to execute the openapi-ts CLI, writes generated files to the local file system (output path), and performs network operations to fetch specifications.
Sanitization: The skill relies on the internal parsing and validation logic of the @hey-api/openapi-ts library to handle untrusted input data.
[EXTERNAL_DOWNLOADS]: The skill facilitates fetching configuration files and API specifications from remote network locations.
Evidence: Documentation in references/setup-config.md demonstrates fetching specs from arbitrary URLs and specialized registries.
Security Configuration: The documentation mentions setting NODE_TLS_REJECT_UNAUTHORIZED=0 to accommodate self-signed certificates in development. This practice bypasses standard TLS verification and could be exploited if applied in non-isolated or production-like environments.

heyapi