API Documentation & Diagram Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 0.1.2

Overview

This appears to be a real Workflow Weaver integration, but its setup can expose long-lived credentials and runs mutable npm packages, so it should be reviewed before installation.

Install only if you trust the Workflow Weaver npm packages and service. Prefer pinned package versions, avoid `npx @latest`, do not print refresh tokens into an agent or terminal transcript, and avoid putting real tokens in project-local MCP config files. Review any source material before generating public share links, and rotate the Workflow Weaver token if it was exposed in logs or committed files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:162

Finding

Unpinned third-party packages are installed and executed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50

Finding

Authentication refresh token is printed to standard output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:176

Finding

Long-lived credentials are embedded in plaintext MCP configuration files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does not implement API documentation generation, diagram creation, workflow rendering, or export functionality. Instead, it is an operational test script for the Workflow Weaver CLI/MCP environment. Its primary purpose is validating installation and runtime behavior, especially around authentication, billing, and MCP protocol responses. These are materially different capabilities from the declared end-user documentation/diagram generation purpose, so this is a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill when asked to 'create API docs, generate diagrams, build process guides, or turn code into visual workflows,' which are broad natural-language requests without clear boundaries or exclusions. In a manifest/markdown context, this can cause unintended activation for many ordinary user requests that may not specifically require this skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

| No hardcoded credentials | Never embed tokens, passwords, or keys in scripts, logs, or skill files |
| Refresh token via env var only | `WORKFLOW_WEAVER_REFRESH_TOKEN` — never interpolate into log lines or `echo` |
| Supabase credentials via env var only | `WORKFLOW_WEAVER_SUPABASE_URL` and `WORKFLOW_WEAVER_SUPABASE_KEY` — never in scripts |
| Config file path | `~/.workflow-weaver/config.json` (chmod 600) — document but never read directly in automation scripts; one-time setup extraction is acceptable |
| Stripe/billing URLs | Present to the user to open in a browser — never open programmatically |
| Smoke placeholder | Use clearly-named placeholders like `smoke-test-invalid-token`, never real-looking values |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

"WORKFLOW_WEAVER_SUPABASE_KEY": "***"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents creation of public share links but does not prominently warn that these links may expose project contents to anyone with the URL. In an agent context, users may not realize generated workflows or imported API sources could contain proprietary architecture, internal endpoints, or sensitive documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.