openapi-to-typescript
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external OpenAPI files (JSON or YAML) which are untrusted data sources that could contain embedded instructions.
- Ingestion points: Reads OpenAPI specifications from the local file system as input for code generation.
- Boundary markers: The skill defines validation for OpenAPI version and structure but does not include instructions for the agent to ignore or delimit natural language commands potentially hidden in schema descriptions.
- Capability inventory: The skill has the capability to write files to the local file system (e.g., types/api.ts).
- Sanitization: The instructions lack specific guidance for sanitizing or escaping string metadata such as 'description' or 'title' before they are interpolated into the generated TypeScript JSDoc and interfaces.
Audit Metadata