openapi-to-typescript
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were identified. The skill follows standard developer workflow patterns for code generation, including basic schema validation and default output paths.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from OpenAPI specifications (JSON/YAML) which are then interpolated into generated TypeScript files and JSDoc comments. This creates a surface where malicious content in an API spec could attempt to influence the agent or affect the generated code.
- Ingestion points: Reads local OpenAPI files as defined in the SKILL.md and README.md workflows.
- Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the interpolation of schema descriptions into the generated output.
- Capability inventory: The skill performs local file system write operations to save the generated TypeScript code.
- Sanitization: Input validation is performed to ensure the file matches the OpenAPI 3.0.x specification format.
Audit Metadata