generating-typescript-types-from-apis

Warn

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill provides a script template in SKILL.md (scripts/generate-types.ts) that programmatically constructs TypeScript source code strings using data retrieved from a network fetch call and writes the resulting code to the local filesystem using fs.writeFileSync.\n- [INDIRECT_PROMPT_INJECTION]: The code generation workflow creates a potential surface for indirect injection by incorporating external data directly into project source code.\n
  • Ingestion points: Data retrieved from https://api.example.com/users/1 via fetch in SKILL.md (Step 8).\n
  • Boundary markers: The provided generation logic lacks explicit delimiters or validation rules to ensure that keys from the API response do not break the TypeScript interface syntax.\n
  • Capability inventory: The skill facilitates network access (fetch), filesystem write operations (writeFileSync, npx output redirection), and command execution (npm, npx, tsc).\n
  • Sanitization: No validation or escaping is performed on property keys extracted from the JSON response before they are interpolated into the generated .ts file.\n- [EXTERNAL_DOWNLOADS]: The instructions recommend using npx to download and execute tools like openapi-typescript and openapi-fetch from the NPM registry, including commands that fetch remote schema specifications from external URLs.\n- [COMMAND_EXECUTION]: The workflow requires the execution of shell commands for package management (npm install), automated code generation (npx openapi-typescript), and code validation (npx tsc).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 22, 2026, 08:02 PM