Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

openapi-parser

v1.0.0

Parses complex OpenAPI specs and generates Drift test cases from them. Use whenever the user wants to generate, write, or scaffold Drift tests from an OpenAP...

0· 68·0 current·0 all-time
byKevin Rohan Vaz@kevinrvaz

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kevinrvaz/openapi-parser.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "openapi-parser" (kevinrvaz/openapi-parser) from ClawHub.
Skill page: https://clawhub.ai/kevinrvaz/openapi-parser
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install openapi-parser

ClawHub CLI

Package manager switcher

npx clawhub@latest install openapi-parser
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name and description match the actual instructions: the SKILL.md describes how to locate endpoints, resolve $refs, enumerate schema variants, and emit Drift YAML. The skill declares no binaries, env vars, or installs — which is proportionate for an instruction-only parser/authoring helper.
Instruction Scope
Instructions are narrowly focused on parsing OpenAPI files and generating Drift operations/datasets. They include shell command examples (grep/Select-String) for locating spec fragments and an explicit policy for resolving $ref chains. One notable runtime behavior: external $refs may require fetching remote URLs (the doc says 'fetch the URL if needed'), which implies network access if the agent follows that step. The skill does not instruct the agent to read unrelated system files or secrets.
Install Mechanism
No install spec or bundled code — instruction-only. This minimizes installation risk; nothing is downloaded or written to disk by the skill itself.
Credentials
The skill requires no environment variables, credentials, or config paths. The SKILL.md references Drift dataset expressions and functions (e.g. ${functions:generate_uuid}), which are appropriate for producing Drift YAML and do not imply secret access.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not modify other skills or system-wide settings. Autonomous invocation is allowed by platform default and is not combined with other worrying privileges.
Assessment
This skill is coherent with its stated purpose: it helps you read OpenAPI specs and output Drift test YAML and asks for nothing sensitive. Before installing or invoking it, be aware that following its instructions may cause the agent to (1) read local spec files you point it to and (2) optionally fetch remote $ref URLs referenced by the spec — if those remote URLs are untrusted they could expose the agent to remote content. If you plan to run it, ensure the spec files you provide don't contain or reference secrets and that you are comfortable with the agent performing local file reads and occasional network fetches to resolve external $refs. If you want to avoid network activity, remove or vendor external $refs before running the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cyzqd41xk0h8nf40xfrg4y184t2sx
68downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

OpenAPI Parser Skill

Reference files

  • references/schema-patterns.md — how to interpret and enumerate every complex pattern (anyOf / oneOf / allOf / discriminator / $ref / enum / pattern / nullable / optional), with real examples from snyk, digitalocean, posthog, and front/core specs
  • references/drift-mapping.md — how to map enumerated schema variants to Drift YAML, including datasets, expressions, lifecycle hooks for stateful cases, and expected response matchers for each pattern type

Workflow

OpenAPI version: This skill targets OpenAPI 3.x. Swagger 2.0 specs use the same structural patterns ($ref, allOf, oneOf) but different envelope syntax — you may need to adapt field names manually. If working from the konfig-sdks/openapi-examples collection, see references/example-repos.md for navigation commands.

1. Locate the endpoint

Extract only what's needed:

# Find the line number of the endpoint (macOS/Linux/Git Bash/WSL)
grep -n "^  /path/to/endpoint" spec.yaml

# Read just that block (adjust line range as needed)
# Then follow each $ref to components/schemas
grep -n "SchemaName:" spec.yaml
# PowerShell equivalents (Windows)
Select-String -Path spec.yaml -Pattern "^  /path/to/endpoint" | Select-Object LineNumber, Line
Select-String -Path spec.yaml -Pattern "SchemaName:" | Select-Object LineNumber, Line

Extract: path/query/header parameters, request body schema, and each response status code's schema.

2. Resolve $refs recursively

  1. Grep for Foo: in the spec to find its definition block
  2. If Foo itself contains refs, resolve those too
  3. Stop at primitive types (string, integer, boolean, array, object)

allOf: [$ref: Base, properties: {...}] is inheritance — merge Base fields with local properties to get the full schema. See references/schema-patterns.md for all patterns.

3. Enumerate viable combinations

For each response status code, enumerate structurally distinct schema variants. Aim for minimum tests that maximise schema coverage — not a combinatorial explosion of optional field permutations.

PatternTests to generate
oneOf / anyOf with N branchesN tests — one per branch
discriminator with N mapping valuesN tests — one per discriminator value
allOf (composition / inheritance)1 test — merge all schemas into one payload
enum1 test covers it; add boundary variants only if the value drives behaviour
Optional field cluster2 tests: one with all optional fields, one without
nullable fieldCovered by happy path; add null variant only if it changes behaviour
pattern (regex)1 valid example matching the pattern; 1 invalid for negative testing

4. Generate Drift test cases

For each combination produce a Drift operation block. See references/drift-mapping.md for full patterns. Key conventions:

  • Name operations as {operationId}_{variant} — e.g. getImage_byId, getImage_bySlug
  • For discriminated unions, set the discriminator property explicitly in the request body
  • For anyOf path parameters, write one test per type variant
  • Use dataset for test data; use inline parameters only for static, non-variant values (e.g. a fixed enum query param like type: user)
  • For 401 tests, strip global auth with exclude: [auth] and pass an invalid bearer token explicitly
  • Add ignore: { schema: true } to any operation that sends an intentionally invalid request body
  • Tag each test to indicate which schema branch it covers
  • Omitting body from expected lets Drift validate the response against the OpenAPI schema automatically; add explicit body matchers only when asserting a specific field value (e.g. the discriminator property came back correctly)

5. Output format

Always produce:

  1. Analysis — number of status codes, which schemas are polymorphic, how many tests will be generated and why
  2. Drift operations YAML — the complete operations: block, ready to paste
  3. Dataset YAML (if needed) — the datasets: block for any referenced test data
  4. Gaps — schema combinations intentionally excluded, with the reason

Example

Given GET /v2/images/{image_id} where image_id: anyOf: [integer, string]:

operations:
  getImage_byId:
    target: source-oas:getImage
    tags: [images, param-integer]
    parameters:
      path:
        image_id: ${image-data:images.existing.id}
    expected:
      response:
        statusCode: 200

  getImage_bySlug:
    target: source-oas:getImage
    tags: [images, param-string]
    parameters:
      path:
        image_id: ${image-data:images.existing.slug}
    expected:
      response:
        statusCode: 200

  getImage_notFound:
    target: source-oas:getImage
    parameters:
      path:
        image_id: ${image-data:notIn(images.*.id)}
    expected:
      response:
        statusCode: 404

Comments

Loading comments...