openapi-first
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration references the
openapi-generator-maven-plugin(version 7.5.0) from theorg.openapitoolsgroup. This is an industry-standard tool for generating API boilerplate and does not originate from a suspicious source. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface where the agent processes external data from an
openapi.yamlspecification. - Ingestion points: The specification file is located at
src/main/resources/openapi.yaml(SKILL.md). - Boundary markers: None are defined to separate user-provided API descriptions from agent instructions.
- Capability inventory: The agent is primarily tasked with generating Java source code for Controller Delegates and Data Transfer Objects (DTOs).
- Sanitization: There is no mention of sanitizing or validating the input specification for malicious injection patterns.
- [NO_CODE]: The skill consists of documentation, Markdown files, and code templates. It does not include any executable scripts, binaries, or active shell commands.
Audit Metadata