openapi-spec-generation
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install global CLI tools for API linting and SDK generation from well-known package registries.
- Evidence:
references/code-first-and-tooling.mdlists commands to install@stoplight/spectral-cli,@redocly/cli, and@openapitools/openapi-generator-cli. These are recognized industry-standard tools. - [COMMAND_EXECUTION]: The skill includes examples of executing CLI commands to lint specifications and generate client SDKs.
- Evidence:
references/code-first-and-tooling.mdprovides command-line examples forspectral lint,redocly lint, andopenapi-generator-cli generate. - [INDIRECT_PROMPT_INJECTION]: The skill processes external source code and API designs to generate documentation, creating a surface for potential instruction injection via code comments or metadata.
- Ingestion points: External source code (FastAPI/TypeScript) and design-first specification inputs are processed as described in
references/code-first-and-tooling.mdandreferences/details.md. - Boundary markers: The skill does not provide specific delimiters or instructions to isolate the untrusted input data from the agent's logic.
- Capability inventory: The skill utilizes shell commands for linting and SDK generation based on the processed inputs.
- Sanitization: No explicit sanitization or filtering of input code comments or metadata is documented before the content is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill generates configuration files for linting tools by executing shell scripts with embedded templates.
- Evidence:
references/code-first-and-tooling.mduses shell heredocs (cat > .spectral.yaml << 'EOF') to create configuration files locally from static templates.
Audit Metadata