The Agent Skills Directory

[SAFE]: The skill is designed for local static analysis of API specifications. It reads input spec files and writes generated documentation to a local directory, with no network exfiltration or sensitive data access detected.
[EXTERNAL_DOWNLOADS]: The documentation provides standard instructions to install the tool using go install from the author's official GitHub repository (github.com/xSAVIKx/okf-skills). This is a legitimate distribution method from the skill's official vendor.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it processes untrusted API specifications.
Ingestion points: The --spec flag in main.go identifies the input OpenAPI/Swagger file processed by loadSpec and extractConcepts.
Boundary markers: None present; the skill transforms spec descriptions directly into markdown frontmatter and body content.
Capability inventory: The tool has file-writing capabilities via os.WriteFile and os.MkdirAll in main.go to create the OKF bundle.
Sanitization: The sanitize function in openapi.go escapes markdown pipe characters (|) and newlines to prevent breakage of the generated documentation tables.
Assessment: The risk is inherent to the tool's primary purpose of documenting external contracts and is mitigated by its local execution model and basic output sanitization.

okf-openapi