The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests OpenAPI specifications (YAML/JSON) which are untrusted external inputs. Any malicious instructions embedded in the 'description' or 'summary' fields of the specification could potentially influence the agent's code generation or documentation output.
Ingestion points: SKILL.md (Step 1: Read and validate OpenAPI specification).
Boundary markers: The skill does not define clear boundaries or 'ignore' instructions for the content of the specification file.
Capability inventory: The skill has access to Bash, Write, and Edit tools, allowing for command execution and file modification.
Sanitization: No explicit sanitization or validation of natural language fields within the OpenAPI spec is performed before they are interpolated into the generated SDK code and documentation.
[EXTERNAL_DOWNLOADS]: The skill uses npx openapi-generator-cli to download and execute the SDK generator, which is a common developer practice for this task.
[DYNAMIC_EXECUTION]: The skill generates source code in multiple languages (TypeScript, Python, Go, Java) and subsequently executes test suites using npm test and pytest to validate the generated SDKs.
[CREDENTIALS_UNSAFE]: references/examples.md includes an example API key sk_live_abc123. Although this uses a prefix associated with live production keys, the suffix abc123 indicates it is a non-functional placeholder for illustrative examples.

generating-api-sdks