API Documentation Generator

Auto-generates comprehensive API docs from code. REST, GraphQL, WebSocket with examples and schemas.

Security Scan

The skill's runtime instructions for producing API docs are reasonable, but the package claims to 'auto-generate ... from code' while providing no mechanism to access source code (no install, no file access guidance, no env/config requirements) — clarify how code is provided before trusting it.

Purpose & Capability

Name/description promise: 'Auto-generates ... from code'. What is delivered: an instruction-only SKILL.md that tells the agent how to format documentation but does not say how to obtain or analyze the user's codebase (no guidance to read files, clone repos, or accept a code path). This is an incoherence: a tool that claims to operate on code would normally require repository/file access or explicit instructions to prompt the user for code.

Instruction Scope

The SKILL.md gives a bounded and appropriate formatting checklist (endpoints, auth, schemas, examples) and specifies output format (OpenAPI/Swagger-compatible markdown). It does not instruct the agent to read arbitrary system files, environment variables, or to contact external endpoints. However, it is vague about where endpoint information comes from (implies code input but doesn't describe how to obtain it).

Install Mechanism

No install spec and no code files — lowest-risk instruction-only skill. Nothing will be written to disk or automatically installed by the skill itself.

Credentials

No environment variables, credentials, or config paths are requested. This is proportionate to the visible instructions, though it reinforces the mismatch: if the skill truly needed automated access to a repository it would typically request repo credentials or a path.

Persistence & Privilege

always is false and there are no persistence or privilege escalations declared. The skill does not request ongoing presence or system-level configuration changes.

What to consider before installing

This skill is instruction-only and safe from install-time execution, but it claims to auto-generate docs 'from code' without any mechanism to access your repository. Before installing or using it: (1) Ask the skill author how the agent is expected to obtain source code (upload, paste, repo clone, file path). (2) If you must paste code into the agent, avoid including secrets (API keys, credentials, private tokens) — test first with non-sensitive samples. (3) Prefer using it interactively (user-invoked) rather than allowing autonomous runs, since autonomous operation combined with unclear code-access behavior could prompt credential disclosure. (4) If you need automated repo scanning, prefer a tool that explicitly documents how it accesses repos and what permissions it requires.

You generate professional API documentation.

For each endpoint generate:

1. Method, path, description
2. Authentication requirements
3. Request headers, params, body schema with types
4. Response status codes, body schema, error formats
5. Examples in curl, JavaScript fetch, Python requests
6. Rate limiting info

Format as OpenAPI/Swagger-compatible markdown with tables for parameters and JSON examples for request/response bodies.