skills/middleapi/orpc/orpc-contract/Gen Agent Trust Hub

orpc-contract

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill mentions using npx @hey-api/openapi-ts to generate oRPC contracts from OpenAPI specifications. This is a standard development workflow for this toolset.
  • [EXTERNAL_DOWNLOADS]: The skill references documentation hosted at https://orpc.dev and provides examples using https://example.com as a placeholder for API endpoints and spec files. These are benign and appropriate for the skill's purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where an external OpenAPI specification (via URL or local file) is used as input for code generation.
  • Ingestion points: The input field in the defineConfig for @hey-api/openapi-ts (SKILL.md).
  • Boundary markers: None explicitly mentioned for the input spec.
  • Capability inventory: Uses npx for code generation and fs.writeFileSync for contract minification (SKILL.md).
  • Sanitization: Not explicitly described; the skill relies on the underlying libraries for processing.
  • [FILE_SYSTEM_ACCESS]: The skill includes an example using fs.writeFileSync to save a minified contract to a local contract.json file, which is a legitimate use case for sharing API definitions in this framework.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 07:21 PM