oas-api-spec-generator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's workflow explicitly instructs the agent to use WebFetch to pull live API documentation and official OpenAPI specs from public provider URLs (see "Step 2: Fetch Current API Documentation" and "Generation Workflow" in SKILL.md, which list numerous external docs/raw GitHub URLs), so the agent will read and act on open/public third‑party content that can materially change its spec-generation behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly performs WebFetch at runtime to pull official OpenAPI specs and provider docs (e.g., https://raw.githubusercontent.com/openai/openai-openapi/master/openapi.yaml and other raw.githubusercontent.com provider spec URLs), and then uses that fetched content as the authoritative input to generate/modify the agent's OpenAPI-generation instructions—so remote documents can directly control the agent's output.