openapi-generator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code and JSDoc comments to generate API documentation. This creates a surface where external data enters the agent's context.\n
- Ingestion points: The scripts read local project files and parse them using Babel and TypeScript compilers to extract route and schema information.\n
- Boundary markers: No specific boundary markers or instructions to ignore embedded prompts are included in the extraction logic.\n
- Capability inventory: The skill uses
fsfor reading source files and writing the output specification, andcommanderfor CLI interaction.\n - Sanitization: The tool relies on structured AST parsing to interpret code, which inherently structures the data but does not sanitize text content within comments.\n- [SAFE]: All libraries, file system operations, and code patterns are consistent with the skill's stated purpose of API documentation generation.
Audit Metadata