The Agent Skills Directory

[SAFE]: The skill is designed for local static analysis of codebases. It reads project files (controllers, routes, and specifications) to produce documentation, which is the legitimate and expected behavior for this tool.
[COMMAND_EXECUTION]: The skill includes a Python script (scripts/inventory_openapi.py) used to generate API inventories. While the included unit tests utilize subprocess.run to verify the CLI interface of this script, the execution is restricted to the local environment and the script's own logic, posing no risk of unauthorized command injection.
[DATA_EXPOSURE]: Security guidelines within SKILL.md (Step 3: Resolve schemas) explicitly command the agent to "Redact secrets and personal data from examples," mitigating the risk of accidental exposure of sensitive information during documentation generation.
[DYNAMIC_EXECUTION]: The test suite (tests/test_inventory_openapi.py) uses importlib to dynamically load and execute the inventory_openapi.py script for verification. This is a standard practice in Python testing and is limited to the skill's own local files.

api-doc-generator