Security audit

Api Contract Auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, local, read-only API documentation audit helper, with some unused broader audit code that users should be aware of but no evidence of hidden execution, exfiltration, or persistence.

Install this if you are comfortable with a Chinese-language API audit helper that reads the local file or directory you point it at and optionally writes a Markdown/JSON report. Avoid pointing it at broad private directories unless you intend those files to be sampled in the report.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is a narrow API contract audit, but the analyzed behavior indicates a much broader, spec-driven scanning workflow including directory auditing, regex-based sensitive pattern scanning, CSV analysis, and package/frontmatter inspection. This mismatch is security-relevant because it can induce users or orchestrators to grant trust, data access, or execution rights appropriate for a small documentation checker while the skill actually processes a wider set of files and contexts.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The listed trigger examples, especially “检查 API 文档和示例是否一致” and “找 breaking change 风险,” are phrased as broad natural-language requests without explicit scope constraints or exclusion conditions. In a routing context, this ambiguity could cause the skill to activate for general API review conversations rather than a narrowly defined invocation scenario.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises execution capability via `python3` and references local resources and generated output, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization and review gap: a host may permit broader file or shell access than users expect, increasing the chance of unintended command execution or filesystem writes during what is presented as a read-oriented audit task.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill's title, routing guidance, work rules, output structure, and safety instructions are all written exclusively in Chinese, indicating the skill operates in a fixed language/locale. There is no statement offering the user a language choice or clarifying that Chinese is optional, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The user-facing title, labels, summary, examples, and risk text are all written in Chinese, with no indication that the skill supports other languages or that Chinese is a justified region-specific requirement. This creates a natural-language locale policy concern because the skill appears to impose a specific language without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The template content is entirely written in Chinese and the title indicates it is the shared output template, which implies the skill output is expected in a specific language. There is no indication that users can choose another language or that the Chinese-only requirement is justified as a region-specific constraint.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The generated report strings are hard-coded in Chinese, including titles, summaries, and next-step instructions. This enforces a specific language for users regardless of their locale or preference, which is a natural-language policy violation under the stated rules.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code performs regex scanning for secrets, private URLs, and shell-danger patterns such as curl-pipe-bash and rm -rf, which is unrelated to the stated API contract auditing purpose. In this skill context, that mismatch is risky because it turns the tool into a generic sensitive-content scanner over arbitrary files, increasing the chance of unintended data exposure and unauthorized inspection of local content.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill can audit arbitrary skill-package completeness and parse SKILL.md frontmatter, which is outside API contract auditing and broadens the accessible content surface. In an agent environment, this can be misused to inspect unrelated project metadata and repository structure under the trusted label of an API auditor, making the capability mismatch itself a security concern.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The dispatcher supports multiple unrelated modes such as directory, CSV, pattern, and skill-package auditing, which materially expands the skill’s operational scope beyond API contract review. In an agent setting, this kind of scope drift is dangerous because it enables use on arbitrary filesystem inputs and broad analysis tasks that users and orchestrators may not expect from the declared skill.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: This markdown file presents the skill self-check exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the Chinese-only presentation is a documented locale-specific requirement. Under the policy for language or locale constraints, forcing a specific language without user opt-in can be a policy violation.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: This markdown file presents the skill output entirely in Chinese, including headings and instructions, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.