Security audit
Security checks for vulnerabilities and agentic risk
This is a small user-directed API testing skill with local report output, with no evidence of hidden exfiltration, privilege escalation, or persistence beyond saved reports.
Install only if you are comfortable with the skill sending test requests to URLs you provide and saving local markdown reports. Avoid testing endpoints that return secrets, tokens, personal data, or confidential internal error details unless you are comfortable with the first 200 response characters being written to disk.
The natural-language content of the skill, including its description, capabilities, usage instructions, and pricing, is presented only in Chinese. This imposes a language constraint on users without any explicit opt-in or justification that the skill is region-specific.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
SCRIPT_DIR = Path(__file__).parent.resolve()
OUTPUT_DIR = SCRIPT_DIR / "output"
def test_api_endpoint(url, method="GET", auth=False):
"""测试 API 端点"""
try:
import requests
The script stores server response content, including a preview of up to 200 characters, into a local markdown report file without any consent prompt, redaction, or sensitivity checks. If the tested endpoint returns secrets, personal data, tokens, or internal error details, this behavior can create unintended local data exposure and persistence beyond the test session.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(" test <url> [method] [auth] - Test API endpoint")
print("\nExamples:")
print(" python3 main.py test https://api.example.com")
print(" python3 main.py test https://api.example.com/users POST")
print(" python3 main.py test https://api.example.com/login POST auth")
sys.exit(1)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(" test <url> [method] [auth] - Test API endpoint")
print("\nExamples:")
print(" python3 main.py test https://api.example.com")
print(" python3 main.py test https://api.example.com/users POST")
print(" python3 main.py test https://api.example.com/login POST auth")
sys.exit(1)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(" test <url> [method] [auth] - Test API endpoint")
print("\nExamples:")
print(" python3 main.py test https://api.example.com")
print(" python3 main.py test https://api.example.com/users POST")
print(" python3 main.py test https://api.example.com/login POST auth")
sys.exit(1)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(" test <url> [method] [auth] - Test API endpoint")
print("\nExamples:")
print(" python3 main.py test https://api.example.com")
print(" python3 main.py test https://api.example.com/users POST")
print(" python3 main.py test https://api.example.com/login POST auth")
sys.exit(1)
The docstring for the main API test function is written only in Chinese, which imposes a language choice without user opt-in. Under the policy, language-specific behavior or instructions should either offer a choice or clearly justify the locale restriction.
The package description includes Chinese text ("自动化 API 测试和监控") alongside English, which may impose or assume a specific language presentation without documenting user opt-in or locale constraints. Under the language/locale policy, natural-language content should not force a language unless choice or justification is provided.
No suspicious patterns detected.