Security audit

api-test

Security checks across malware telemetry and agentic risk

Overview

This skill is advertised as an API documentation helper, but its code can make arbitrary external GET and POST requests with user-supplied data.

Review before installing. Use this only if you intentionally want a generic API-calling tool, not merely an API documentation template. Do not provide authorization headers, secrets, internal URLs, or sensitive request bodies unless the skill is renamed, clearly disclosed, and constrained with destination limits and explicit confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill is presented as a documentation helper, but static analysis indicates hidden network-capable behavior without any declared permissions. Undeclared outbound connectivity materially expands the attack surface because it can exfiltrate prompts, secrets, or user-provided API data while appearing to perform a benign writing task.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a strong true positive because the declared purpose is API documentation generation, while the behavior includes arbitrary GET/POST requests, custom headers, parameters, body submission, timeout control, and returning remote content. That mismatch can let the skill operate as a covert HTTP client or proxy, enabling SSRF, data exfiltration, and misuse of user trust under the cover of a harmless documentation tool.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The implemented skill is a generic HTTP client that can send arbitrary GET/POST requests to attacker-controlled URLs, which is materially different from the declared purpose of writing API documentation. This capability expansion is dangerous because users or downstream agents may invoke it under the assumption it is a documentation helper, enabling hidden network access, data exfiltration, or misuse as a proxy.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill accepts a user-provided URL, headers, query params, and body, then performs outbound requests without validation or restriction. In the context of an API documentation assistant, this is unjustified network capability and can be abused for SSRF-style access to internal services, contacting malicious hosts, or relaying sensitive data off-platform.

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The file comments and class metadata explicitly describe an API data-fetching tool, which contradicts the registered skill metadata claiming this is an API documentation writer. This mismatch increases risk because it conceals the true behavior of the skill, making unsafe capabilities harder for reviewers and users to notice and more likely to be invoked in inappropriate contexts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The POST path transmits user-supplied params and JSON data to arbitrary external URLs with no disclosure, warning, or confirmation. This creates a direct exfiltration channel: sensitive prompts, tokens, internal identifiers, or user content could be sent to attacker-controlled infrastructure without the user understanding that external transmission is occurring.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.