OpenAPI Docs Generator

• Outcome: Pass
• Latest audit: Jun 23, 2026 · 5:07 AM UTC
• Version: 0.1.1

Overview

This skill is a documentation helper for OpenAPI/Swagger specs and does not include executable code, persistence, credential access, or hidden data movement.

Install this if you want an agent helper for OpenAPI or Swagger documentation work. Be aware that its trigger terms are broad, so it may activate on some general API-documentation conversations; review generated specs for accidental inclusion of secrets, customer data, or private endpoint details before publishing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description and activation scope are broad enough to match many ordinary developer queries about APIs, schemas, or documentation, which can cause unintended invocation outside the user's actual intent. Over-broad routing increases the chance that the agent applies this skill in the wrong context, leading to irrelevant actions, hidden prompt influence, or accidental overshadowing of a more appropriate skill.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger keyword list includes very common terms like OpenAPI, Swagger, REST API, API docs, schema, and SDK without qualifiers, making incidental matches likely in routine engineering conversations. Because there are no constraints or negative examples, the routing layer may invoke this skill for loosely related requests, increasing prompt-surface exposure and reducing reliability of skill selection.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill metadata uses a broad short description and a generic default prompt that can match many common API-documentation requests, which increases the chance of unintended implicit invocation. Because implicit invocation is enabled, the agent may route user requests to this skill even when the user did not explicitly ask for it, causing unreviewed processing of potentially sensitive code, routes, or schemas.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger sentence begins with a generic phrase ('Help me') and then appends a long requirement description, making activation semantics overly broad and prone to accidental matching in normal user conversation. In a skill-routing system, this can cause unintended invocation of the skill on unrelated requests, which may misroute user data or override a more appropriate skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger sentence 'I need a practical workflow for ...' is ambiguous because it does not clearly constrain the activation scope to OpenAPI/Swagger documentation tasks and instead embeds a broad requirement statement. This increases the chance that ordinary planning or workflow-related requests will activate the skill unintentionally, leading to incorrect task routing and reduced trust in the agent system.

VirusTotal

61/61 vendors flagged this skill as clean.