OpenAPI Docs Generator 002325

• Outcome: Pass
• Latest audit: Jun 24, 2026 · 4:40 AM UTC
• Version: 0.1.0

Overview

This is a documentation helper for OpenAPI/Swagger work, with no executable code, credential handling, persistence, or hidden data access.

This skill appears safe to install for OpenAPI or Swagger documentation tasks. Be aware it may activate on some broad API or developer-experience prompts, so invoke a more specific skill manually if the request is not about REST API documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are extremely generic and closely mirror normal user requests such as asking for help or a workflow, which increases the chance that the skill is invoked unintentionally. In an agent system, over-broad activation can route unrelated conversations into this skill, causing incorrect task handling, context leakage across skills, or unexpected actions based on the wrong workflow.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger phrases are broad and generic enough that the skill may activate for loosely related requests, causing it to handle prompts outside its intended scope. In an agent environment, overbroad activation can lead to unintended execution paths, confused delegation, or exposure of internal workflows when a more appropriate skill should have been selected.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill description and activation guidance are broad enough to match many general software or API-related requests, increasing the chance the skill is invoked outside its intended scope. Over-broad routing can cause inappropriate tool or workflow selection, producing irrelevant outputs or causing an agent to rely on this skill when a more suitable, narrower skill should handle the request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The listed keywords include generic terms such as 'software-and-data' and 'developer experience' that can match a wide range of unrelated prompts. In an automated skill-selection system, this can lead to accidental invocation and context hijacking, where the agent follows this skill's workflow despite the user's request not being specifically about API documentation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill description and usage conditions are broad enough to match many requests that merely mention software, data, APIs, or documentation, even when the user did not intend to invoke this specific skill. Over-broad routing can cause inappropriate activation, leading the agent to apply the wrong workflow, expose irrelevant capabilities, or mishandle user intent in security-sensitive contexts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The keyword list includes generic terms like "software-and-data" and broad API-related phrases without sufficient constraints, which increases the chance of accidental or adversarial triggering. This can be exploited to steer unrelated conversations into this skill's workflow, reducing reliability and potentially bypassing more appropriate safety or domain-specific handling.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default prompt contains a broad, natural-language trigger phrase that can cause the skill to be invoked for loosely related user requests rather than explicit intent. This increases the chance of unintended activation, prompt-routing mistakes, and exposing the skill's behavior in contexts where the user did not clearly request it.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger sentence is broad enough that normal user requests about OpenAPI or general help could activate the skill unexpectedly. Over-broad activation increases the chance of inappropriate routing, causing the agent to apply this skill outside the user's intended scope and potentially produce irrelevant or misleading documentation guidance.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The sentence 'I need a practical workflow for ...' is too generic and does not clearly constrain when the skill should activate. Ambiguous activation rules can cause accidental invocation from ordinary planning requests, reducing reliability and creating an attack surface for prompt-routing manipulation.

VirusTotal

62/62 vendors flagged this skill as clean.