openapi-spec-generation

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install global CLI tools for API linting and SDK generation from well-known package registries.
  • Evidence: references/code-first-and-tooling.md lists commands to install @stoplight/spectral-cli, @redocly/cli, and @openapitools/openapi-generator-cli. These are recognized industry-standard tools.
  • [COMMAND_EXECUTION]: The skill includes examples of executing CLI commands to lint specifications and generate client SDKs.
  • Evidence: references/code-first-and-tooling.md provides command-line examples for spectral lint, redocly lint, and openapi-generator-cli generate.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external source code and API designs to generate documentation, creating a surface for potential instruction injection via code comments or metadata.
  • Ingestion points: External source code (FastAPI/TypeScript) and design-first specification inputs are processed as described in references/code-first-and-tooling.md and references/details.md.
  • Boundary markers: The skill does not provide specific delimiters or instructions to isolate the untrusted input data from the agent's logic.
  • Capability inventory: The skill utilizes shell commands for linting and SDK generation based on the processed inputs.
  • Sanitization: No explicit sanitization or filtering of input code comments or metadata is documented before the content is processed by the agent.
  • [DYNAMIC_EXECUTION]: The skill generates configuration files for linting tools by executing shell scripts with embedded templates.
  • Evidence: references/code-first-and-tooling.md uses shell heredocs (cat > .spectral.yaml << 'EOF') to create configuration files locally from static templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 08:03 PM