The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides a script (generate-openapi.js) that performs runtime code generation. It fetches an OpenAPI specification from a remote URL and uses the @hey-api/openapi-ts library to generate TypeScript source files based on the fetched content.
[COMMAND_EXECUTION]: The provided generation script includes a configuration that explicitly disables SSL/TLS certificate validation by setting process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";. This practice bypasses critical security protections, making the connection to the OpenAPI source vulnerable to Man-in-the-Middle (MITM) attacks.
[INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The generate-openapi.js script accepts a URL argument and fetches external JSON data (the OpenAPI specification) into the environment.
- Boundary markers: The script lacks boundary markers or instructions to the generator to ignore potentially malicious embedded content within the specification.
- Capability inventory: The skill uses node-fetch for network operations and the createClient function, which has the capability to write multiple files to the local directory (src/api/).
- Sanitization: There is no validation, filtering, or sanitization performed on the fetched OpenAPI content before it is used for code generation.

umbraco-openapi-client