Pentest API Attacker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:10 AM UTC
• Version: 0.1.0

Overview

This skill needs review because it claims to run real API security tests but actually generates canned high-severity findings and placeholder artifacts.

Install only with caution. Treat this as a placeholder or report generator, not a real API pentest skill, unless it is changed to perform actual scoped tests and clearly labels any synthetic output. Do not feed its findings into remediation, compliance, or ticketing workflows as validated vulnerabilities.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/api_attacker.py:20

Finding

Fabricated High-Severity Findings Without Performing API Security Tests

Content

View full analysis

Vulnerability Details

File Location: scripts/api_attacker.py:20-21, 38-45; functional claims at SKILL.md:7, 13
Vulnerability Type: Security-tool output spoofing
Risk Level: High

Vulnerable Code

python

def build_finding(target:str)->dict:
    return {'finding_id':f"{SKILL_NAME.replace('-', '_')}-001",'skill':SKILL_NAME,'timestamp':datetime.now(timezone.utc).isoformat(),'target':target,'title':'Pentest API Attacker identified a security weakness','cve':'N/A','cwe':'CWE-693','cvss_score':7.0,'cvss_vector':'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L','owasp_category':'A05:2021 - Security Misconfiguration','mitre_attack':'T1190','severity':'High','description':'Automated and manual testing identified a security condition requiring remediation.','proof_of_concept':'python scripts/api_attacker.py --dry-run','screenshot':'assets/findings/placeholder.png','remediation':'Apply least privilege, secure defaults, and verify fixes with retest.','references':["https://github.com/assetnote/kiterunner", "https://github.com/ticarpi/jwt_tool"],'status':'open'}

def main()->int:
    args=parse_args()
    scope_ok,scope_meta=validate_scope(args.target,args.scope)
    report_path=resolve_output_file(args.output,args.format,REPORT_STEM)
    if not scope_ok:
        r={'status':'error','summary':'TARGET NOT IN AUTHORIZED SCOPE - ABORTING','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}}
        render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); return 1
    if not args.i_have_authorization and not args.dry_run:
        r={'status':'error','summary':'You must pass --i-have-authorization to confirm written authorization.','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}}
        render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); re
...[truncated 3197 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional build_finding() invocation and generate findings only from validated observations.
2. Implement explicit, scope-bounded API checks for endpoint discovery, authentication controls, authorization boundaries, input handling, and relevant protocol behavior.
3. Require each reported finding to include reproducible request and response evidence, the tested endpoint and method, observed behavior, expected secure behavior, and a defensible severity calculation.
4. Do not emit vulnerability findings during dry-run execution. Dry-run output should contain only the planned actions, validated scope, and expected artifacts.
5. Clearly label any demonstration or placeholder data as synthetic and prevent it from entering production findings or downstream reports.
6. Use separate artifact schemas for discovered endpoints, verified findings, and execution metadata rather than writing the same placeholder object to every output.
7. Add automated tests confirming that a target with no observed weakness produces an empty findings collection.
8. Add tests ensuring that every finding is linked to collected evidence and that unsupported fixed findings cannot be generated.
9. Package or otherwise include the referenced shared module so its scope enforcement and file-handling behavior can be reviewed and the skill can execute independently.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises active API pentesting capabilities, including discovery, auth abuse, and protocol-specific checks, but the analyzed content indicates those behaviors are not actually implemented and may only produce placeholder artifacts. In a security workflow, this is dangerous because operators may rely on it for assurance, resulting in false confidence, missed vulnerabilities, and inaccurate downstream reporting or decision-making.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and command-line description imply active pentest behavior, yet the implementation only produces synthetic findings and files. In a security testing skill, this context makes the mismatch more dangerous because users may deploy it in assurance workflows and incorrectly conclude that OWASP API checks were completed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script advertises API security testing but, after basic scope and authorization checks, only loads input, constructs a canned finding, and writes placeholder artifacts. This is dangerous because operators may rely on it as if real API assessment occurred, creating a false sense of security and potentially causing missed vulnerabilities in production targets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.