add-tool
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard local development commands (
npm run compile,npm run build,npm test) to verify the integrity of the generated code. These are performed within the local project context and follow strict execution rules (e.g., 'RUN COMMANDS SEPARATELY'). - [EXTERNAL_DOWNLOADS]: The skill fetches a Swagger specification using
curl -sk {swaggerUrl}based on a URL found in a local configuration file (.discover.json). This is a standard operation for API tool generation and uses a target determined by the local environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a Swagger/OpenAPI specification to generate code. While this presents an injection surface where a malicious specification could attempt to influence the generated code, the risk is mitigated by the skill's workflow, which includes a mandatory review step by a specialized agent (
mcp-tool-reviewer) and subsequent compilation/test validation steps.
Audit Metadata