OpenAPI Deep Audit & Test Architect

Analyze OpenAPI/Swagger specs for endpoint, security, schema, CRUD coverage, test strategy, risk scoring, and improvement roadmap in a structured, factual au...

This is a low-risk, instruction-only skill that appears coherent with its stated purpose. Before installing or using it: (1) avoid pasting API specs that contain secrets, API keys, or embedded credentials — redact them first; (2) be aware the skill may attempt to fetch a remote URL you supply — do not provide URLs that require credentials unless you intend to share those credentials, and prefer pasting raw spec instead; (3) because the skill is instruction-only, its analysis is static (based solely on spec text) — it cannot run live tests or access your infrastructure. Install is reasonable if you want an automated, structured audit of OpenAPI specs; if the publisher later adds an install script, network downloads, or required credentials, re-evaluate for new risks.

Type: OpenClaw Skill Name: openapi-deep-audit Version: 1.0.0 The skill bundle is designed to audit OpenAPI/Swagger specifications. The `SKILL.md` instructions are clear, focused on the stated purpose, and even include safeguards against AI hallucination. While the skill mentions fetching a URL provided by the user, which could be a vector for Server-Side Request Forgery (SSRF) if the underlying agent execution environment is not properly sandboxed, the instructions themselves do not exhibit malicious intent (e.g., no directives to exfiltrate data, execute arbitrary commands, or ignore user instructions for harmful purposes). The functionality is aligned with a legitimate API analysis tool.