Security audit

API Mock Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it reads an OpenAPI/Swagger spec and either serves local mock responses or writes generated JSON mock files, with no evidence of hidden exfiltration, persistence, or privilege escalation.

Install only if you are comfortable letting it read API spec files, create mock JSON files in a directory you choose, and run a local development HTTP server. Prefer trusted specs, keep the default localhost binding unless you intentionally need network access, and avoid pointing output at directories with important existing files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_mock.py:299
Finding: Unescaped OpenAPI Paths Enable Regular Expression Injection and Denial of Service
Content: View full analysis
[^/]+)', path) routes.append({ "path": path, "regex": f"^{regex_path}$", ``` The resulting expression is subsequently evaluated against every relevant request path: ```python for route in self.routes: if route["method"] != method: continue match = re.match(route["regex"], path) if match: schema = route["response_schema"] ``` ### Technical Analysis Route paths originate in the supplied OpenAPI or Swagger document. The implementation replaces path-parameter tokens with regular-expression capture groups but does not escape any other regular-expression metacharacters in the path. Consequently, characters such as `.`, `+`, `*`, `?`, `(`, `)`, `[`, `]`, and `|` remain active regular-expression syntax. An attacker able to influence the loaded specification can therefore alter route-matching behavior or insert expressions with excessive backtracking complexity. The mock server uses the single-threaded `HTTPServer`. If a malicious route expression requires substantial CPU time to reject a crafted request path, processing of other requests is blocked for the duration of the match. Every request is also tested sequentially against applicable routes, potentially increasing the effect when several malicious routes are present. ### Attack Path 1. An attacker creates or modifies an OpenAPI/Swagger specification containing a path with malicious regular-expression syntax, such as a nested or ambiguous quantified expression. 2. A user starts the mock server with that specification: `python3 scripts/generate_mock.py serve malicious-spec.json` 3. `extract_routes()` inserts the path ...[truncated 1230 chars]
Remediation: View remediation
[^/]+)`. 4. Validate parameter names against a strict pattern, for example `^[A-Za-z_][A-Za-z0-9_]*$`. 5. Reject unsupported or malformed path syntax. 6. Set reasonable maximum lengths for specification paths and incoming request targets. 7. Consider eliminating regular expressions entirely by comparing path segments directly. 8. Consider a threaded server or operational request limits as defense in depth; these measures do not replace correct escaping. A safe construction pattern is: ```python PARAMETER = re.compile(r"\{([A-Za-z_][A-Za-z0-9_]*)\}") def compile_openapi_path(path: str) -> re.Pattern: parts = [] position = 0 for match in PARAMETER.finditer(path): parts.append(re.escape(path[position:match.start()])) name = match.group(1) parts.append(f"(?P<{name}>[^/]+)") position = match.end() parts.append(re.escape(path[position:])) return re.compile("^" + "".join(parts) + "$") ``` Store the compiled expression in each route and use its `match()` or `fullmatch()` method during request handling. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises and instructs use of local file reads/writes and can start a local HTTP server, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens sandboxing and review because consumers cannot easily tell that the skill may access files and expose network functionality, increasing the chance of unintended data exposure or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code performs filesystem-modifying actions by creating the output directory and writing multiple JSON files plus a manifest. Although the command is named "generate" and the output path is user-supplied, there is no confirmation prompt or explicit user-facing warning in this file that running it will create or overwrite files in the target directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.