openapi-spec-generation
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to install and run CLI tools such as Spectral, Redocly, and the OpenAPI Generator for API validation and SDK generation.
- [EXTERNAL_DOWNLOADS]: Downloads official tooling and dependencies from the public NPM registry.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external source code and design patterns, which creates a potential surface for indirect prompt injection from comments or metadata in the analyzed code.
- Ingestion points: User-provided Python and TypeScript source code files and API design specifications mentioned in SKILL.md and references/code-first-and-tooling.md.
- Boundary markers: The instructions do not define specific delimiters to separate untrusted code content from the agent's generation logic.
- Capability inventory: The skill utilizes file writing for specification output and command execution for tool interaction.
- Sanitization: There are no explicit sanitization or filtering steps defined for the input data.
Audit Metadata