openapi-spec-generation
Generate OpenAPI Specs from Code and Contracts
API teams need accurate OpenAPI contracts for docs, SDKs, and validation. This skill provides OpenAPI 3.1 templates, code-first examples, and linting workflows.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "openapi-spec-generation" from https://skillstore.io/skills/wshobson-openapi-spec-generation.md and its manifest at https://skillstore.io/api/skills/wshobson-openapi-spec-generation/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "openapi-spec-generation". A team needs documentation for users, profiles, authentication, and admin operations.
Expected outcome:
A structured OpenAPI plan with server entries, grouped tags, reusable user schemas, security schemes, paginated list operations, and shared error responses.
Using "openapi-spec-generation". A FastAPI service has route handlers but incomplete public API documentation.
Expected outcome:
A mapping from models and routes to OpenAPI operations, including parameter descriptions, response models, validation constraints, and example payload guidance.
Using "openapi-spec-generation". A release requires client SDKs for TypeScript, Python, and Go.
Expected outcome:
A validation and generation checklist covering lint rules, bundled specs, generator targets, package names, output directories, and documentation preview steps.
Security Audit
SafeThe flagged patterns are false positives from Markdown code fences, sample OpenAPI URLs, resource links, UUID schema examples, and generic error responses. No prompt injection, hidden command execution, credential access, or data exfiltration intent was found in SKILL.md.
Risk Factors
⚙️ External commands (11)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/wshobson-openapi-spec-generation/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/wshobson-openapi-spec-generation?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/wshobson-openapi-spec-generation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-openapi-spec-generation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/wshobson-openapi-spec-generation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
wshobson. (2026). openapi-spec-generation security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-openapi-spec-generation/audits/8BibTeX citation
@techreport{wshobson-wshobson-openapi-spec-generation-2026,
author = {wshobson},
title = {openapi-spec-generation security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/wshobson-openapi-spec-generation/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "openapi-spec-generation security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "wshobson"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/wshobson-openapi-spec-generation/audits/8"
identifiers:
- type: other
value: "skillstore:wshobson-openapi-spec-generation:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
sickn33-openapi-spec-generation
2026-08-21
wshobson-openapi-spec-generation
2026-08-21
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Draft a new REST contract
Create a design-first OpenAPI 3.1 specification with paths, schemas, security, and examples before implementation starts.
Document an existing service
Map FastAPI or TypeScript route code into structured OpenAPI operations, responses, request bodies, and generated schemas.
Prepare SDK generation
Lint, bundle, and refine an OpenAPI file so client libraries can be generated for multiple languages.
Try These Prompts
Create an OpenAPI 3.1 starter spec for my REST API. Include info, servers, tags, security schemes, two resource paths, reusable schemas, and common error responses.
Review these API routes and produce an OpenAPI 3.1 outline. Identify operation IDs, parameters, request bodies, responses, schemas, and missing examples.
Audit this OpenAPI draft for completeness. Check security, reusable components, response coverage, schema constraints, examples, naming consistency, and linting issues.
Prepare this OpenAPI spec for SDK generation. Recommend bundling steps, Spectral rules, Redocly checks, generator options, package naming, and breaking-change safeguards.
Best Practices
- Define operation IDs, reusable schemas, shared responses, and security schemes before adding detailed examples.
- Run linting and bundling checks before publishing documentation or generating SDKs.
- Use realistic examples, explicit nullable fields, and consistent naming across paths, schemas, and parameters.
Avoid
- Publishing generated specs without reviewing security requirements and error responses.
- Duplicating schemas across endpoints instead of using shared components.
- Hardcoding environment-specific server URLs without variables or clear descriptions.