Security audit
Security checks for vulnerabilities and agentic risk
The skill is not deceptive, but it gives an agent broad Outline read, write, admin, sharing, export, and OAuth-management guidance with limited safety boundaries.
Install only if you intend the agent to operate against your Outline instance with the privileges of the API key you provide. Prefer a least-privilege or read-only key when possible, set OUTLINE_BASE_URL only to a trusted Outline API URL, and require explicit human confirmation before exports, sharing changes, invites, permission changes, user/group administration, trash deletion, or OAuth client/secret operations.
The skill description is broad enough to trigger on many routine knowledge-base tasks, including potentially sensitive document, user, export, and permission operations. Over-broad activation increases the chance the agent invokes this skill in contexts where the user did not clearly intend external API interaction, which can lead to unintended data access or modification.
The description is written to enforce Chinese-language behavior without indicating that this depends on user preference. Forcing a language can cause misunderstanding of high-risk actions, consent prompts, or returned content, which is especially problematic for operations like delete, invite, export, or permission management.
This skill is explicitly designed to send data and credentials to an external Outline API using an environment-provided bearer token. In context, external transmission is expected, but it still creates real security risk because the skill supports broad read/write/admin operations, including listing users, exporting content, sharing documents, and deleting resources; misuse or accidental invocation could expose or alter sensitive organizational data.
读取环境变量后用 curl 调用：
OUTLINE_BASE_URL="${OUTLINE_BASE_URL:?未设置 OUTLINE_BASE_URL}"
The API reference lists numerous destructive operations—delete, revoke, suspend, archive, unpublish, remove_user, rotate_secret, and empty_trash—without any embedded warnings, approval requirements, or operational safety notes. In an agent setting, this omission makes dangerous actions appear routine and increases the likelihood that an LLM or user triggers irreversible or high-impact changes without informed consent.
This section includes organization-administration actions such as group management, user role changes, suspension, activation, deletion, and invitations that are substantially broader than a typical knowledge-base interaction skill description. When such admin functions are bundled into a general-purpose agent skill, users and reviewers may underestimate the authority granted, increasing the chance of unauthorized or socially engineered tenant-wide changes.
The reference documents OAuth client and authentication management endpoints, including client creation, secret rotation, and deletion, which materially expands the capability surface beyond ordinary knowledge-base content operations. In an agent skill, exposing or normalizing these endpoints can enable credential lifecycle changes or broader integration control if the agent is permitted to invoke them, creating a privilege-escalation and account takeover risk.
No suspicious patterns detected.