openapi-spec-generation
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The implementation playbook documents the installation of well-known industry tools including
@stoplight/spectral-cli,@redocly/cli, and@openapitools/openapi-generator-clivia npm. These are established services used for API validation and SDK generation. - [COMMAND_EXECUTION]: The skill provides example shell commands for linting specifications, bundling files, and executing SDK generators. These are standard developer workflows and are presented as educational templates for the user.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process code or design documents to produce API specifications. While this involves processing external data, the skill includes strong cautionary instructions to treat external references ($ref) and rendered descriptions as untrusted and to restrict network destinations during resolution.
- [DYNAMIC_EXECUTION]: The playbook contains patterns for generating boilerplate application code (FastAPI, Express) and client SDKs. The documentation explicitly advises the user to review all generated code before installation or building, mitigating the risk of executing insecure automated output.
Audit Metadata