add-tool

SUSPICIOUS: the skill is largely aligned with its stated code-generation purpose, but it tells the agent to fetch a mutable Swagger URL with TLS verification disabled. That insecure network fetch materially raises risk, while the rest of the footprint (local file reads, npm compile/test, code/test updates) is proportionate to the task.