OpenAPI Docs Generator

• Outcome: Pass
• Latest audit: Jun 14, 2026 at 8:45 AM UTC
• Version:
  0.1.0

Overview

This is a documentation-only OpenAPI/Swagger helper skill with some sloppy activation wording, but no executable code, credential use, persistence, or hidden data handling.

Install only if you want an assistant workflow for OpenAPI or Swagger documentation. Be aware it may trigger on some loosely related API or developer-experience requests, so explicit invocation is preferable until the publisher tightens the trigger wording.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are generic and malformed enough that they could cause the skill to activate for loosely related requests instead of only clear OpenAPI/Swagger documentation tasks. Over-broad activation increases the chance of unintended routing, context hijacking, or the skill being invoked on requests outside its safe and intended scope, which can degrade decision quality and expose users to irrelevant or unsafe instructions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad and partially templated, so the skill may activate on vague requests that merely mention APIs, documentation, or workflows. Unintended invocation can route user prompts into this skill when another tool or response path would be more appropriate, causing confusion, over-collection of context, or misuse of generated documentation guidance.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description contains broad activation terms like 'practical workflow, artifact, checklist, analysis, or implementation support' in addition to domain keywords. This can cause the skill to activate on loosely related software requests, increasing the chance of inappropriate routing, over-collection of context, or unintended influence over tasks outside OpenAPI documentation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example trigger sentences use vague phrasing like 'Help me' and 'I need a practical workflow' with only partial domain anchoring, which may match everyday requests too easily. In a skill-routing system, ambiguous triggers can lead to misactivation and unintended application of this skill to unrelated engineering tasks.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill description and invocation conditions are broad enough that the router may select this skill for many generic software/API-related requests, not just OpenAPI documentation tasks. Over-broad routing can cause unintended activation, leading the agent to follow an irrelevant workflow, mishandle user intent, or expose capability surfaces in contexts where this skill should not run.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword list includes high-frequency generic terms such as 'software-and-data' and 'developer experience', which are likely to appear in many unrelated prompts. This increases accidental triggering and skill confusion, making it easier for the system to invoke this skill when another, more appropriate skill should handle the request.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The example trigger phrases begin with very generic formulations like 'Help me' and 'I need a practical workflow', without clarifying that the request must specifically concern OpenAPI/Swagger documentation. These examples can bias routing toward broad activation patterns and reduce precision in distinguishing this skill from general engineering assistance.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The default prompt contains a broad, natural-language trigger phrase that could cause the skill to be invoked in situations beyond narrowly scoped OpenAPI documentation tasks. Because implicit invocation is enabled, this increases the chance of unintended activation on generic software or API-related requests, which can confuse routing, expose users to unexpected behavior, or let the skill influence conversations outside its intended boundary.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger sentence is so broad and awkwardly templated that it can match ordinary user phrasing rather than a clearly scoped invocation, causing the skill to activate in contexts where the user did not explicitly request it. In an agent system, overbroad activation can override safer or more appropriate skills, create prompt-routing confusion, and increase the chance of unintended data handling or misleading output.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation scope is ambiguous because the listed trigger sentences do not clearly define when the skill should and should not run, and they include malformed, truncated language that can be interpreted unpredictably by a router. This makes routing behavior less deterministic and raises the risk of accidental invocation, poor task-to-skill matching, and user confusion.

VirusTotal

64/64 vendors flagged this skill as clean.