orpc-contract
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill mentions using
npx @hey-api/openapi-tsto generate oRPC contracts from OpenAPI specifications. This is a standard development workflow for this toolset. - [EXTERNAL_DOWNLOADS]: The skill references documentation hosted at
https://orpc.devand provides examples usinghttps://example.comas a placeholder for API endpoints and spec files. These are benign and appropriate for the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where an external OpenAPI specification (via URL or local file) is used as input for code generation.
- Ingestion points: The
inputfield in thedefineConfigfor@hey-api/openapi-ts(SKILL.md). - Boundary markers: None explicitly mentioned for the input spec.
- Capability inventory: Uses
npxfor code generation andfs.writeFileSyncfor contract minification (SKILL.md). - Sanitization: Not explicitly described; the skill relies on the underlying libraries for processing.
- [FILE_SYSTEM_ACCESS]: The skill includes an example using
fs.writeFileSyncto save a minified contract to a localcontract.jsonfile, which is a legitimate use case for sharing API definitions in this framework.
Audit Metadata