generating-typescript-types-from-apis
Warn
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides a script template in
SKILL.md(scripts/generate-types.ts) that programmatically constructs TypeScript source code strings using data retrieved from a networkfetchcall and writes the resulting code to the local filesystem usingfs.writeFileSync.\n- [INDIRECT_PROMPT_INJECTION]: The code generation workflow creates a potential surface for indirect injection by incorporating external data directly into project source code.\n - Ingestion points: Data retrieved from
https://api.example.com/users/1viafetchinSKILL.md(Step 8).\n - Boundary markers: The provided generation logic lacks explicit delimiters or validation rules to ensure that keys from the API response do not break the TypeScript interface syntax.\n
- Capability inventory: The skill facilitates network access (
fetch), filesystem write operations (writeFileSync,npxoutput redirection), and command execution (npm,npx,tsc).\n - Sanitization: No validation or escaping is performed on property keys extracted from the JSON response before they are interpolated into the generated
.tsfile.\n- [EXTERNAL_DOWNLOADS]: The instructions recommend usingnpxto download and execute tools likeopenapi-typescriptandopenapi-fetchfrom the NPM registry, including commands that fetch remote schema specifications from external URLs.\n- [COMMAND_EXECUTION]: The workflow requires the execution of shell commands for package management (npm install), automated code generation (npx openapi-typescript), and code validation (npx tsc).
Audit Metadata