dmr-openapi-skeleton

Pass

Audited by Gen Agent Trust Hub on Apr 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs standard development tasks, including generating Python DTOs, controllers, and routers based on structured OpenAPI metadata.
  • [SAFE]: File operations are limited to project scaffolding (e.g., creating views.py, urls.py, manage.py, and pyproject.toml) and environment configuration.
  • [SAFE]: Package installation instructions use standard package managers (uv, poetry, pip) to install the legitimate django-modern-rest framework and its associated extras.
  • [SAFE]: The skill uses wemake-django-template as a base for new projects, which is an expected resource provided by the skill's author (wemake-services).
  • [SAFE]: The instructions contain strong negative constraints that prevent the agent from inventing domain logic, persistence layers, or authentication backends, effectively mitigating risks associated with autonomous code generation.
  • [SAFE]: An indirect prompt injection surface is present as the skill processes external OpenAPI documents. However, the risk is minimized by the skill's narrow focus on transport-layer skeleton generation and explicit requirements for deterministic, non-business-logic implementations.
  • Ingestion points: OpenAPI 3.1+ specifications (files, URLs, or pasted text).
  • Boundary markers: Present via structural workflow steps that enforce deterministic mapping of spec parts to specific framework constructs.
  • Capability inventory: File system writes (scaffolding), subprocess execution (package managers), and documentation URL references.
  • Sanitization: Provided through the enforcement of the django-modern-rest framework's type-safe patterns (Pydantic/Msgspec DTOs).
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 24, 2026, 11:08 AM
Security Audit — agent-trust-hub — dmr-openapi-skeleton