klh-openapi-directory-first
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches API list data and specific OpenAPI specifications from
api.github.com(GitHub's official API) andapi.apis.guru(a well-known service for API definitions). These sources are reputable and used according to the skill's primary purpose of providing accurate API documentation. - [COMMAND_EXECUTION]: The skill uses
curlpiped topython3to parse JSON metadata. The Python code is provided inline, is simple, and performs only data processing (filtering and printing JSON fields). It does not execute remote code or perform dangerous system operations. The automated scan flags these as remote code execution, but manual review confirms they are benign JSON processing steps using trusted data sources. - [SAFE]: The resources and external links are associated with
klh(the skill author) and reputable community projects like APIs-guru. No obfuscation, data exfiltration, or persistence mechanisms were detected.
Audit Metadata