hey-api-openapi-codegen
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process OpenAPI specification files, which creates a potential surface for indirect instructions if the source files are untrusted. However, the skill explicitly mandates security controls such as pinning specific versions, using local snapshots in version control, and performing mandatory diff reviews and type checks in CI to mitigate these risks.\n
- Ingestion points: Local or remote OpenAPI specification files defined in openapi-ts.config.ts as documented in references/01-overview.md.\n
- Boundary markers: The skill instructs developers to use local snapshots in the repository and perform git diff checks on the generated output to ensure no unexpected changes occur.\n
- Capability inventory: The generator performs file system write operations to populate the src/lib/api/generated directory and can execute post-processing tools like Prettier.\n
- Sanitization: The skill recommends using automated type checking (TSC/Svelte-check) and manual code review to validate that the generated artifacts conform to expectations before deployment.
Audit Metadata