check-api-compat
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the OpenAI OpenAPI specification from the official GitHub repository (github.com/openai/openai-openapi). This is a well-known service and the resource is directly related to the skill's primary purpose.
- [COMMAND_EXECUTION]: The skill uses a brief Python command (
python -c "import openai,os;print(os.path.dirname(openai.__file__))") to locate the file path of the installed OpenAI SDK. This is a standard method for diagnostic path discovery in development environments. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for indirect prompt injection because it processes external API documentation and local source code files.
- Ingestion points: Reads content from remote URLs (GitHub and Claude documentation) and local Python files (
vllm/entrypoints/). - Boundary markers: The skill does not explicitly define boundary markers for the processed data, though it targets structured technical content.
- Capability inventory: The skill can execute local shell commands (Python snippets) and perform network fetches via the agent's tools.
- Sanitization: No specific sanitization logic is provided for the fetched content.
Audit Metadata