dmr-openapi-skeleton
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs standard development tasks, including generating Python DTOs, controllers, and routers based on structured OpenAPI metadata.
- [SAFE]: File operations are limited to project scaffolding (e.g., creating
views.py,urls.py,manage.py, andpyproject.toml) and environment configuration. - [SAFE]: Package installation instructions use standard package managers (uv, poetry, pip) to install the legitimate
django-modern-restframework and its associated extras. - [SAFE]: The skill uses
wemake-django-templateas a base for new projects, which is an expected resource provided by the skill's author (wemake-services). - [SAFE]: The instructions contain strong negative constraints that prevent the agent from inventing domain logic, persistence layers, or authentication backends, effectively mitigating risks associated with autonomous code generation.
- [SAFE]: An indirect prompt injection surface is present as the skill processes external OpenAPI documents. However, the risk is minimized by the skill's narrow focus on transport-layer skeleton generation and explicit requirements for deterministic, non-business-logic implementations.
- Ingestion points: OpenAPI 3.1+ specifications (files, URLs, or pasted text).
- Boundary markers: Present via structural workflow steps that enforce deterministic mapping of spec parts to specific framework constructs.
- Capability inventory: File system writes (scaffolding), subprocess execution (package managers), and documentation URL references.
- Sanitization: Provided through the enforcement of the django-modern-rest framework's type-safe patterns (Pydantic/Msgspec DTOs).
Audit Metadata