generate-swagger-docs
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an execution script from the author's repository at
https://raw.githubusercontent.com/qodex-ai/apimesh/refs/heads/main/run.sh. This download is performed usingcurland is a core component of the skill's functionality. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to run a wrapper script (generate-with-key.sh) which in turn executes the downloadedapimesh/run.sh. The script handles environment variable setup and command-line arguments for the documentation generation process. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository source code using an LLM to generate OpenAPI specifications, creating a potential surface for indirect prompt injection from untrusted code comments or documentation.
- Ingestion points: Local source code files discovered during repository analysis (e.g., Express, FastAPI, or Django endpoints).
- Boundary markers: None present in the wrapper scripts to delimit user code from agent instructions.
- Capability inventory: File system read/write access and shell command execution via the
Bashtool. - Sanitization: No explicit sanitization or filtering of the analyzed source code is performed in the provided wrapper scripts.
Audit Metadata