The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes existing API codebases, which serves as a surface for processing untrusted data that could contain malicious instructions.
Ingestion points: The API project path provided by the user (referenced in SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands within the source code are included.
Capability inventory: The skill executes local shell commands (e.g., framework CLIs, python, npm, curl), writes files (openapi.json, openapi.yaml), and invokes the speakeasy CLI tool.
Sanitization: The skill does not perform any sanitization or validation of the ingested source code content before execution.
[COMMAND_EXECUTION]: The skill requires the agent to execute various framework-specific commands (such as python manage.py spectacular, rails rswag:specs:swaggerize, and php artisan l5-swagger:generate) to extract documentation. It also uses curl to interact with local development servers (e.g., http://localhost:8080/v3/api-docs) to fetch generated specs.
[EXTERNAL_DOWNLOADS]: The documentation recommends the installation of several third-party libraries for OpenAPI generation (e.g., drf-spectacular, flask-openapi3, springdoc-openapi, rswag, and L5-Swagger) and the use of the speakeasy CLI tool for post-extraction validation.

extract-openapi-from-code