generate-swagger-docs

SUSPICIOUS. The skill's purpose is coherent, but it relies on download-and-execute from a mutable raw GitHub script and forwards an OpenAI API key to third-party code that also stores the secret locally. This looks more like risky install/credential handling than confirmed malware, but the supply-chain and secret-exposure footprint is disproportionate enough to warrant caution.

The provided wrapper is intended to generate Swagger documentation, but it executes an unpinned and unverified shell script fetched from a mutable GitHub branch. This is a significant supply-chain risk because the remote script can change and runs with access to the repository and API key. The wrapper itself shows no clear malicious payload, but the downloaded script requires independent review or replacement with a pinned, integrity-verified release. The API key should not be passed on the command line, and the environment-variable handling should be corrected.