The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-supplied input from $ARGUMENTS directly into bash command strings across several generation phases (e.g., Phase 3, 4, and 6). Specifically, variables like $schema, $spec_file, and $api_url are used as command-line arguments for npx and curl without visible sanitization or validation, creating a high risk of command injection if the input contains shell metacharacters.
[REMOTE_CODE_EXECUTION]: The skill uses npm install --save-dev and npx to dynamically fetch and execute Node.js packages at runtime, including openapi-typescript, quicktype, and graphql-codegen. These packages are not pinned to specific versions, which introduces a supply chain risk where a compromised package or a subverted package name could lead to arbitrary code execution on the user's system.
[EXTERNAL_DOWNLOADS]: In Phase 6, the skill uses curl to fetch content from arbitrary API URLs provided in $ARGUMENTS. This functionality can be abused to make the agent interact with malicious external servers or perform Server-Side Request Forgery (SSRF) against internal network services.
[DATA_EXFILTRATION]: The skill possesses a dangerous combination of capabilities: it can read local project files (using find, grep, and cat for schema discovery) and it can perform network requests via curl. This creates a path for exfiltrating sensitive project code, configuration files, or schemas to an attacker-controlled URL passed as an argument.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external schemas (OpenAPI, GraphQL, JSON) to generate code.
Ingestion points: Files matching openapi*.yaml, schema.graphql, and *.schema.json are read and processed.
Boundary markers: The skill lacks delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The skill has access to subprocess execution (npx, npm), file reads/writes, and network operations (curl).
Sanitization: No escaping or validation of the schema content is performed before processing.

types-generate