openapi-spec-generation
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install standard API development tools from the npm registry, including
@stoplight/spectral-cli,@redocly/cli, and@openapitools/openapi-generator-cli. - [COMMAND_EXECUTION]: The skill includes shell commands to create configuration files and execute linting or SDK generation tasks using the installed CLI tools.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as its primary function involves processing external, potentially untrusted OpenAPI specification files.
- Ingestion points: Commands in Template 4 and the SDK Generation section read from an
openapi.yamlfile. - Boundary markers: No explicit boundary markers or warnings are included to delimit untrusted file content.
- Capability inventory: The skill uses subprocess calls to run
spectral,redocly, andopenapi-generator-clion the input files. - Sanitization: No validation or sanitization of the input file content is implemented before processing.
Audit Metadata