api-documentation-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited api-documentation-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Analyze a repository to extract and generate comprehensive API documentation, including endpoints, request/response schemas, authentication, and usage examples organized in a clear, multi-file structure.
Scan the repository to identify all sources of API information:
Primary sources (in priority order):
.yaml, .yml, .json)/docs, /api, /spec, /openapiopenapi.yaml, swagger.json, api-spec.yaml, etc./docs, /documentation, /api-docsroutes.rb, urls.py, routes.jsDiscovery approach:
# Find OpenAPI specs
find . -name "openapi.*" -o -name "swagger.*" -o -name "*api-spec*"
# Find API route definitions
grep -r "@app.route\|@router\|app.get\|app.post" --include="*.py" --include="*.js"
# Find documentation
find . -path "*/docs/*" -name "*.md" -o -path "*/api/*" -name "*.md"Based on discovered sources, extract key information:
#### From OpenAPI Specs
Parse YAML/JSON to extract:
#### From Code Comments/Docstrings
Look for patterns like:
Python (FastAPI/Flask):
@app.post("/users")
async def create_user(user: UserCreate):
"""
Create a new user.
Args:
user: User creation data
Returns:
Created user object
"""JavaScript (Express):
/**
* GET /users
* List all users
* @param {number} page - Page number
* @param {number} limit - Items per page
* @returns {Array<User>} List of users
*/
app.get('/users', (req, res) => { ... })Extract:
#### From Existing Documentation
Parse markdown files to extract:
Create a multi-file documentation structure organized by resource or API area:
docs/
├── README.md # Overview, authentication, getting started
├── endpoints/
│ ├── users.md # User-related endpoints
│ ├── products.md # Product-related endpoints
│ ├── orders.md # Order-related endpoints
│ └── ...
├── models/
│ └── schemas.md # Data models and schemas
├── errors.md # Error codes and handling
└── examples.md # Complete usage examplesGrouping strategy:
For each file, use the template from assets/api-doc-template.md as a guide.
#### README.md (Main Overview)
# API Documentation
## Overview
[Brief description of the API and its purpose]
## Base URL
https://api.example.com/v1
## Authentication
[Describe auth method: Bearer tokens, API keys, OAuth2]
## Quick Start
[Simple example showing how to make first API call]
## Endpoints
- [Users](endpoints/users.md) - User management endpoints
- [Products](endpoints/products.md) - Product catalog endpoints
- [Orders](endpoints/orders.md) - Order processing endpoints
## Resources
- [Data Models](models/schemas.md) - Request/response schemas
- [Errors](errors.md) - Error codes and handling
- [Examples](examples.md) - Complete usage examples
## Rate Limiting
[Rate limit details if applicable]
## Versioning
[API versioning strategy if applicable]#### Endpoint Files (e.g., endpoints/users.md)
For each endpoint, document:
Endpoint header:
### POST /users
Create a new user account.Request details:
**Request:**
- **Method:** `POST`
- **Path:** `/users`
- **Headers:**
- `Content-Type: application/json`
- `Authorization: Bearer YOUR_TOKEN`
**Body:**
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| name | string | Yes | User's full name |
| email | string | Yes | User's email address |
| role | string | No | User role (default: user) |
**Example:**
{ "name": "John Doe", "email": "[email protected]", "role": "admin" }
Response details:
**Response:**
- **Status:** `201 Created`
- **Headers:**
- `Location: /users/123`
**Body:**
{ "id": 123, "name": "John Doe", "email": "[email protected]", "role": "admin", "created_at": "2024-01-15T10:30:00Z" }
**Error Responses:**
- `400 Bad Request` - Invalid input data
- `409 Conflict` - Email already existsCode examples:
**Example Request:**
curl -X POST "https://api.example.com/v1/users" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer YOUR_TOKEN" \ -d '{ "name": "John Doe", "email": "[email protected]" }'
import requests
response = requests.post( "https://api.example.com/v1/users", headers={"Authorization": "Bearer YOUR_TOKEN"}, json={ "name": "John Doe", "email": "[email protected]" } )
user = response.json() print(f"Created user: {user['id']}")
#### Data Models File (models/schemas.md)
Document all data structures:
# Data Models
## User
| Field | Type | Description |
|-------|------|-------------|
| id | integer | Unique identifier |
| name | string | User's full name |
| email | string | User's email address |
| role | string | User role (admin, user, guest) |
| created_at | datetime | Account creation timestamp |
| updated_at | datetime | Last update timestamp |
**Example:**
{ "id": 123, "name": "John Doe", "email": "[email protected]", "role": "user", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }
#### Error Reference (errors.md)
# Error Handling
All errors follow this format:
{ "error": { "code": "ERROR_CODE", "message": "Human-readable message" } }
## Error Codes
| Status | Code | Description |
|--------|------|-------------|
| 400 | BAD_REQUEST | Invalid request data |
| 401 | UNAUTHORIZED | Missing/invalid auth |
| 403 | FORBIDDEN | Insufficient permissions |
| 404 | NOT_FOUND | Resource not found |
| 409 | CONFLICT | Resource conflict |
| 422 | VALIDATION_ERROR | Validation failed |
| 429 | RATE_LIMIT_EXCEEDED | Too many requests |
| 500 | INTERNAL_ERROR | Server error |For major use cases, provide complete code examples:
# Examples
## Creating and Managing Users
### 1. Create a User
curl -X POST "https://api.example.com/v1/users" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer YOUR_TOKEN" \ -d '{"name": "John Doe", "email": "[email protected]"}'
import requests
response = requests.post( "https://api.example.com/v1/users", headers={"Authorization": "Bearer YOUR_TOKEN"}, json={"name": "John Doe", "email": "[email protected]"} )
user_id = response.json()["id"]
### 2. Retrieve the User
response = requests.get( f"https://api.example.com/v1/users/{user_id}", headers={"Authorization": "Bearer YOUR_TOKEN"} )
user = response.json() print(f"User: {user['name']} ({user['email']})")
#### No OpenAPI Spec Available
When no OpenAPI spec exists:
#### Multiple API Versions
When multiple versions exist:
#### Incomplete Information
When information is missing:
[To be documented](inferred from code)#### GraphQL APIs
For GraphQL:
.graphql files or introspectionBefore finalizing documentation:
User request:
"Generate API documentation for this repository"
Response approach:
openapi.yaml in /docs directoryUser request:
"Document the API endpoints in this Flask application"
Response approach:
@app.route, @blueprint.route)User request:
"Summarize the API documentation from all available sources"
Response approach:
Be comprehensive but concise:
Use consistent formatting:
Make it navigable:
Provide context:
Keep it current:
Use the template in assets/api-doc-template.md as a starting point for each documentation file. Adapt the structure based on the specific API being documented.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.