skills/middleapi/orpc/orpc-contract/Gen Agent Trust Hub

orpc-contract

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves its intended purpose of providing technical documentation for the oRPC v2 framework. All code snippets and patterns align with standard software development practices.
  • [EXTERNAL_DOWNLOADS]: The skill references documentation resources at v2.orpc.dev. These are official project domains used for providing context to the AI agent.
  • [COMMAND_EXECUTION]: The skill includes common development CLI commands such as npx @hey-api/openapi-ts for code generation and tsdown for bundling. These are routine operations for the described workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external OpenAPI specifications to generate code, which is an expected attack surface for API development tools.
  • Ingestion points: The configuration for Hey API in SKILL.md allows specifying URLs or local files as input.
  • Boundary markers: No specific delimiters are defined in the instructions for the ingested schema data.
  • Capability inventory: The skill utilizes local file system writes (fs.writeFileSync) and code generation tools (@hey-api/openapi-ts).
  • Sanitization: The skill relies on standard third-party tools to process and validate external inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 10:36 PM
Security Audit — agent-trust-hub — orpc-contract