Report 01M7FSR8BRZ50KTAFZG1089AMF · checks-v2

openapi-codegen skill: automated checks

What HostedMCP checked on 15 Nov 2026, 14:28 UTC. Every result links to the public source it came from, so you can check it yourself.

Not verified

90/100

7 of 7 checks ran · 0 high findings · not a security audit

Checked: 15 Nov 2026, 14:28 UTC
Folder: skills/api-integration/openapi-codegen ↗
Files read: SKILL.md and scripts
Methodology: checks-v2

What to fix for a higher score

One check can earn more points. The next scan runs within a week, or right after the repository changes.

Pre-approved tools are scoped up to +10 pts
Narrow allowed-tools to the commands the skill needs, for example Bash(git status:*), not Bash or Bash(curl:*). The agent still asks before anything else.

Origin

25 / 25 points

Source repository linked and reachable10 pts
claude-dev-suite/claude-dev-suite/skills/api-integration/openapi-codegen is public and reachable
github.com/claude-dev-suite/claude-dev-suite/tree/HEAD/skills/api-inte ↗
Pass
Open source license (OSI)10 pts
MIT
spdx.org/licenses/MIT.html ↗
Pass
Commit or release in the last year5 pts
Last commit 2026-11-09
github.com/claude-dev-suite/claude-dev-suite/commits ↗
Pass

Scripts

30 / 30 points

No download-and-run or credential theft in scripts30 pts
No scripts in the skill folder
Pass

Instructions to the agent

20 / 30 points

No hidden instructions in SKILL.md20 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/claude-dev-suite/claude-dev-suite/blob/HEAD/skills/api-inte ↗
Pass
Pre-approved tools are scoped10 pts
Bash lets the agent run any shell command without asking
github.com/claude-dev-suite/claude-dev-suite/blob/HEAD/skills/api-inte ↗
How to fix: Narrow allowed-tools to the commands the skill needs, for example Bash(git status:*), not Bash or Bash(curl:*). The agent still asks before anything else.
Finding

Format

15 / 15 points

SKILL.md follows the Agent Skills format15 pts
Valid name and description; says when to use it; 429 lines
github.com/claude-dev-suite/claude-dev-suite/blob/HEAD/skills/api-inte ↗
Pass

What these checks do not cover

Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
Results describe the skill folder on the date above; a later commit can differ.
A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.

What to fix for a higher score

One check can earn more points. The next scan runs within a week, or right after the repository changes.

Pre-approved tools are scoped up to +10 pts

Narrow allowed-tools to the commands the skill needs, for example Bash(git status:*), not Bash or Bash(curl:*). The agent still asks before anything else.