Openapi Docs Generator

• Outcome: Pass
• Latest audit: Jul 26, 2026 · 2:48 AM UTC
• Version: 0.1.0

Overview

This is a documentation-only OpenAPI/Swagger helper with some broad activation wording but no hidden execution, data access, persistence, or destructive behavior.

Install this skill for OpenAPI or Swagger documentation work. Be aware that its trigger wording is loose, so it may activate for some general backend or API discussions; explicitly invoke it for API documentation tasks and ignore it when the request is unrelated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger sentences are broad, natural-language phrases that could match ordinary user requests and cause the skill to activate unintentionally. In an agent-routing system, overbroad invocation patterns can misroute conversations, override more appropriate skills, and increase exposure to downstream prompt or workflow abuse even if the README itself contains no executable code.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger phrases are generic and template-like, which can cause the skill to activate for loosely related requests rather than explicit user intent. In an agent environment, overbroad invocation increases the chance of unintended routing, irrelevant actions, or accidental processing of sensitive API-related context under the wrong skill.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description includes very broad activation language such as helping with 'workflow, artifact, checklist, analysis, or implementation support,' which can match many unrelated requests outside OpenAPI documentation. Overbroad routing increases the chance that this skill is invoked in unintended contexts, causing mis-selection, confusion, and possible exposure of users to instructions or content not appropriate for their actual task.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger keywords include generic terms like 'software-and-data' and 'developer experience,' which are too broad to safely distinguish this skill from many unrelated developer tasks. This can cause accidental activation and inappropriate skill selection, especially in agentic environments where routing decisions rely heavily on keyword specificity.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The example trigger sentences are malformed, truncated, and do not clearly show when the skill should or should not be invoked. Ambiguous examples can degrade routing quality and lead to accidental activation, though the impact is lower because this mainly affects invocation clarity rather than introducing direct code execution or data exposure risk.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger keywords include broad terms such as "software-and-data", "openapi", and "rest api", plus generic example invocations. This can cause the skill to activate outside narrowly intended documentation-generation scenarios, leading to inappropriate routing, over-application of the skill, or misuse in contexts where a more specific or safer skill should respond.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The description says to use the skill when users ask about broad categories like software-and-data, openapi, swagger, api documentation, or rest api, but it does not clearly constrain the skill to documentation-focused tasks. In a routing system, this ambiguity increases the chance of accidental invocation for unrelated API engineering requests, which can reduce reliability and potentially expose users to incorrect workflows or outputs.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Enabling implicit invocation without explicit trigger constraints can cause the skill to activate for loosely related user requests. In a skill that targets broad API-documentation tasks, this increases the chance of unintended routing, prompt overlap, and misuse of the skill in contexts the user did not clearly request.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default prompt is written in broad, generic language around backend, platform, software, data, and API help, which may overlap with many normal engineering conversations. Combined with implicit invocation, this broad wording can cause accidental activation and context capture beyond the intended OpenAPI documentation use case.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger sentences are so generic and awkwardly templated that they could match unrelated user requests and invoke the skill outside its intended scope. Over-broad activation can cause incorrect routing, unexpected disclosure of internal guidance, or user confusion, especially in systems that auto-select skills based on loose phrase matching.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.