umbraco-openapi-client
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The script
Client/scripts/generate-openapi.jsdownloads a specification from a URL provided via command line. It explicitly disables SSL certificate validation by settingprocess.env.NODE_TLS_REJECT_UNAUTHORIZED = "0", which allows attackers to intercept and modify the specification during transit via Man-in-the-Middle (MITM) attacks.\n- [COMMAND_EXECUTION] (LOW): The skill defines agenerate-clientscript inpackage.jsonand requires theBashtool to run the generation process.\n- [DYNAMIC_EXECUTION] (MEDIUM): The skill uses the@hey-api/openapi-tslibrary to generate TypeScript source code at runtime based on the contents of the fetched OpenAPI specification. If the specification is compromised, the generated code could contain malicious logic or vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION] (LOW):\n - Ingestion points:
Client/scripts/generate-openapi.jsfetches from a URL specified by the user.\n - Boundary markers: None identified for the specification content.\n
- Capability inventory: Uses
createClientto write generated code to the local file system (src/api).\n - Sanitization: No validation or sanitization of the downloaded specification is performed before code generation.
Audit Metadata