Audit History
openapi-spec-generation - 8 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v8 Latest | Jul 8, 2026, 12:58 PM | No confirmed findings | 0 | No capability change |
| v7 | Jul 8, 2026, 12:58 PM | No confirmed findings | 0 | No capability change |
| v6 | Jul 1, 2026, 01:13 AM | No confirmed findings | 2 | No capability change |
| v5 | Jul 1, 2026, 01:13 AM | No confirmed findings | 2 | No capability change |
| v4 | Jan 17, 2026, 08:59 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 08:59 AM | No confirmed findings | 0 | Network accessExternal commands |
| v2 | Jan 4, 2026, 04:52 PM | No confirmed findings | 0 | No capability change |
| v1 | Jan 4, 2026, 04:52 PM | No confirmed findings | 0 | Baseline |
Jul 8, 2026, 12:58 PM
The flagged patterns are false positives from Markdown code fences, sample OpenAPI URLs, resource links, UUID schema examples, and generic error responses. No prompt injection, hidden command execution, credential access, or data exfiltration intent was found in SKILL.md.
Risk Factors
⚙️ External commands (11)
Jul 8, 2026, 12:58 PM
The flagged patterns are false positives from Markdown code fences, sample OpenAPI URLs, resource links, UUID schema examples, and generic error responses. No prompt injection, hidden command execution, credential access, or data exfiltration intent was found in SKILL.md.
Risk Factors
⚙️ External commands (11)
Jul 1, 2026, 01:13 AM
The static analyzer found command, URL, weak-crypto, and reconnaissance patterns in SKILL.md. Review found no malicious intent or prompt injection, but the skill includes legitimate install and CLI command examples that may modify the developer environment.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (4)
Detected Patterns
Jul 1, 2026, 01:13 AM
The static analyzer found command, URL, weak-crypto, and reconnaissance patterns in SKILL.md. Review found no malicious intent or prompt injection, but the skill includes legitimate install and CLI command examples that may modify the developer environment.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (4)
Detected Patterns
Jan 17, 2026, 08:59 AM
Pure documentation skill containing YAML OpenAPI templates, code examples (Python FastAPI, TypeScript tsoa), and validation patterns. No executable code, no file system access, no network calls. All 126 static findings are false positives: detected cryptographic keywords are data format specifiers in YAML schemas, backticks are markdown formatting in documentation code blocks, URLs are example domains and documentation references, and system keywords are standard OpenAPI syntax.
Risk Factors
🌐 Network access (12)
Jan 17, 2026, 08:59 AM
Pure documentation skill containing YAML OpenAPI templates, code examples (Python FastAPI, TypeScript tsoa), and validation patterns. No executable code, no file system access, no network calls. All 126 static findings are false positives: detected cryptographic keywords are data format specifiers in YAML schemas, backticks are markdown formatting in documentation code blocks, URLs are example domains and documentation references, and system keywords are standard OpenAPI syntax.
Risk Factors
🌐 Network access (12)
Jan 4, 2026, 04:52 PM
Pure documentation and template skill containing YAML OpenAPI specifications, code examples (Python FastAPI, TypeScript tsoa), and validation patterns. No executable code, no file access, no network calls. Contains only documentation and templates for users to reference.
Jan 4, 2026, 04:52 PM
Pure documentation and template skill containing YAML OpenAPI specifications, code examples (Python FastAPI, TypeScript tsoa), and validation patterns. No executable code, no file access, no network calls. Contains only documentation and templates for users to reference.