manage-openapi-overlays
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external OpenAPI specifications and overlay files, which constitutes a potential surface for indirect prompt injection attacks where malicious content in those files could attempt to influence the agent's behavior.
- Ingestion points: 'Target spec' and 'Overlay file' defined as inputs in
SKILL.md. - Boundary markers: No explicit instructions for delimiters or treating input as untrusted are provided in the guide.
- Capability inventory: The skill performs file reading and transformation using the
speakeasyCLI. - Sanitization: No validation or sanitization of the input file content is mentioned beyond syntax validation.
- [COMMAND_EXECUTION]: The skill instructions involve executing shell commands using the
speakeasyCLI, such asspeakeasy overlay applyandspeakeasy lint. These commands are the primary intended function of the skill to facilitate OpenAPI document management.
Audit Metadata