validate-oas
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local development scripts and tools including
yarn,node, andmake. These are standard vendor-specific tools and scripts for the Elastic/Kibana ecosystem. - [COMMAND_EXECUTION]: Potential shell command injection vulnerability. The interaction flow instructs the agent to accept one or more HTTP API paths from the user and interpolate them directly into a shell command:
node ./scripts/validate_oas_docs.js --only traditional --skip-printing-issues --path <api_route_prefix>. If a user provides malicious input containing shell metacharacters (such as;,&, or|), it could lead to the execution of arbitrary commands on the underlying system.
Audit Metadata