The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted OpenAPI/Swagger specifications from external URLs or local files to drive a multi-phase code generation pipeline. Malicious instructions or malicious code snippets embedded within the spec (e.g., in field descriptions, metadata, or schema examples) could potentially influence the agent's reasoning or be interpolated directly into the generated source code, resulting in prompt injection or cross-site scripting/code injection vulnerabilities in the output artifacts. While the workflow includes normalization and multiple validation layers, there are no explicit boundary markers or sanitization protocols for external content.
Ingestion points: Phase 1 (Ingest the spec) in SKILL.md accepts input from URLs, local paths, or raw text.
Boundary markers: None explicitly mentioned to separate untrusted spec data from agent instructions.
Capability inventory: The skill writes a full project structure (Phase 6) and executes the generated CLI as a subprocess (Phase 7).
Sanitization: Normalization (Phase 2) enforces naming conventions, but doesn't sanitize prose content.
[COMMAND_EXECUTION]: During the validation phase, the skill is instructed to build, install, and execute the generated CLI as a subprocess to verify stdout/stderr separation, exit codes, and JSON parsability. This involves running commands like npm install -g ., pip install -e ., or go install ./... on the generated project files.
[EXTERNAL_DOWNLOADS]: The skill fetches a normative design contract (CLI-MANIFEST.md) from a GitHub Gist repository authored by the skill owner (thomasrohde). This document is used to govern the structure and behavior of the generated CLIs.

api-anything