orpc-contract
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves its intended purpose of providing technical documentation for the oRPC v2 framework. All code snippets and patterns align with standard software development practices.
- [EXTERNAL_DOWNLOADS]: The skill references documentation resources at
v2.orpc.dev. These are official project domains used for providing context to the AI agent. - [COMMAND_EXECUTION]: The skill includes common development CLI commands such as
npx @hey-api/openapi-tsfor code generation andtsdownfor bundling. These are routine operations for the described workflow. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external OpenAPI specifications to generate code, which is an expected attack surface for API development tools.
- Ingestion points: The configuration for Hey API in
SKILL.mdallows specifying URLs or local files as input. - Boundary markers: No specific delimiters are defined in the instructions for the ingested schema data.
- Capability inventory: The skill utilizes local file system writes (
fs.writeFileSync) and code generation tools (@hey-api/openapi-ts). - Sanitization: The skill relies on standard third-party tools to process and validate external inputs.
Audit Metadata