api-integration - API 集成

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.0.0

Overview

This is a simple API-integration reference skill with expected example code for making API calls and handling OAuth credentials, and no hidden execution or persistence.

Install this only if you want API integration guidance. When applying its examples, treat API keys, client secrets, bearer tokens, headers, and request bodies as sensitive; verify the endpoint and HTTPS destination, prefer environment variables or a secret manager, and explicitly approve POST, PUT, or DELETE requests because they can change third-party data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes code examples that send arbitrary request data and OAuth client credentials to external endpoints, but it does not warn users that using these snippets will transmit data off-system. In an agent skill context, this omission can cause unintended disclosure of secrets or sensitive payloads because users may treat the examples as safe default guidance.

VirusTotal

67/67 vendors flagged this skill as clean.