start-new-sdk-project
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the use of the
speakeasyCLI, instructing the agent to execute commands such asspeakeasy quickstartandspeakeasy runfor project initialization and SDK generation. - [INDIRECT_PROMPT_INJECTION]: The skill processes external OpenAPI specifications from local paths or remote URLs, which constitutes an indirect prompt injection surface.
- Ingestion points: The
--schemaflag in thespeakeasy quickstartcommand (SKILL.md) allows loading data from external files and URLs. - Boundary markers: No explicit delimiters or isolation instructions are provided to separate schema data from agent instructions.
- Capability inventory: Shell command execution and file system writes via the
speakeasyCLI (SKILL.md). - Sanitization: The skill does not describe any sanitization or validation of the ingested schema content.
Audit Metadata