Security audit

ChatDOC Studio API

Security checks for vulnerabilities and agentic risk

Overview

This is mostly transparent API documentation, but it includes an unsafe bulk app-deletion example and limited privacy guidance for uploaded documents.

Install only if you are comfortable using ChatDOC Studio as an external document-processing service. Do not run the bulk app cleanup example as written; require a dry run, explicit app ID allowlist, backups, and confirmation before any DELETE call. Avoid uploading confidential, regulated, or customer documents unless your organization has approved ChatDOC Studio's handling, retention, and access controls for that data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: apps/apps_examples.md:295
Finding: Unattended Irreversible Bulk Deletion of Applications
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: chat/chat_app_examples.md:586
Finding: Predictable Shared Temporary File in Chat App Publishing Script
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: parsers/pdf_parser_examples.md:50
Finding: Unpinned npm Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (89)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · apps/apps.md (reported line 64)May include surrounding context.
md
Delete an application by app_id. This operation permanently removes the app and all its associated data. **Endpoint:** `DELETE /apps/{app_id}` **Path Parameters:**

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The complete workflow automates bulk destructive behavior by iterating through apps and deleting those older than 90 days, yet it lacks a strong markdown warning or safeguards. In agentic settings, examples like this can be adapted into unattended jobs, leading to mass deletion and operational disruption.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · chat/chat_app.md (reported line 263)May include surrounding context.
md
- You need to **poll** this endpoint until it returns `201` (published successfully) - During processing, the endpoint may return `400` with error code `training`; keep polling - If you call publish again after successful publication, you'll get `already_published` error - An app must be published before you can send messages to it **Create/Update Notes**: - `suggested_messages` can contain at most 3 items, and each item must be 50 characters or fewer.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · chat/chat_app.md (reported line 468)May include surrounding context.
md
- You need to **poll** this endpoint until it returns `201` (published successfully) - During processing, the endpoint may return `400` with error code `training`; keep polling - If you call publish again after successful publication, you'll get `already_published` error - An app must be published before you can send messages to it **Create/Update Notes**: - `suggested_messages` can contain at most 3 items, and each item must be 50 characters or fewer.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · chat/chat_app.md (reported line 488)May include surrounding context.
md
- You need to **poll** this endpoint until it returns `201` (published successfully) - During processing, the endpoint may return `400` with error code `training`; keep polling - If you call publish again after successful publication, you'll get `already_published` error - An app must be published before you can send messages to it **Create/Update Notes**: - `suggested_messages` can contain at most 3 items, and each item must be 50 characters or fewer.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agent/agent_app_examples.md (reported line 98)May include surrounding context.
console.log(Task status: ${task.status});

text
### cURL ```bash curl -X POST "${CHATDOC_STUDIO_BASE_URL}/agent/apps/tasks" \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is presented as a usage guide for parsing/chat/retrieval/extraction APIs, but it also includes destructive administrative operations for deleting apps and lifecycle management. In a skill context, this broadens capability beyond the stated purpose and can mislead downstream agents or users into invoking irreversible actions they did not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Destructive deletion workflows are included in markdown examples without prominent safety framing in the surrounding documentation. Users often copy examples directly; without warnings, the examples normalize irreversible actions and increase the risk of accidental execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The cURL delete example is directly executable and omits an inline warning that it permanently deletes the specified app. Because cURL snippets are frequently pasted verbatim, the absence of safety notes materially increases the risk of accidental destructive use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow demonstrates bulk deletion of apps based solely on age, which is an unsafe destructive pattern that can delete valid production assets without human review. Providing turnkey automation for irreversible deletion increases the chance that an agent or operator will run it as-is and cause large-scale accidental loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation encourages binding documents and enabling source tracing without warning that quoted passages, snippets, or metadata from uploaded documents may be surfaced to end users. In a document-Q&A application, this can unintentionally disclose confidential content if developers attach sensitive files or enable tracing in broadly accessible apps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents creation, listing, and retrieval of conversations and full message histories but does not warn that these endpoints expose potentially sensitive user prompts, model outputs, and persistent conversation data. In an agent skill context, omission of privacy guidance can lead downstream integrators to enable logging, retention, or display of chat history without user consent or access controls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · chat/chat_app_examples.md (reported line 299)May include surrounding context.
}

text
### cURL ```bash # Customer Service App

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The messaging and conversation examples transmit user prompts, conversation identifiers, and retrieved dialogue content to a third-party API, but the documentation does not warn users about privacy, retention, or sensitive-data handling. In an agent skill context, this omission can cause developers to unknowingly route confidential user or document data off-platform.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · chat/chat_app_examples.md (reported line 801)May include surrounding context.
console.log(Answer: ${result.answer});

text
### cURL ```bash # Send message with conversation_id

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs users to upload documents for extraction but does not warn that full document contents may be transmitted to and processed by an external service. In a document-processing API, this omission can lead users to submit sensitive PDFs, contracts, or personal data without understanding the privacy, compliance, or data-handling implications.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · extraction/extract_app_examples.md (reported line 202)May include surrounding context.
}

text
### cURL ```bash curl -X POST "${CHATDOC_STUDIO_BASE_URL}/extract/apps" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples encourage uploading local files such as invoice.pdf to a remote service without warning that document contents will leave the local environment. In a document-extraction context, those files may contain sensitive financial, personal, or regulated data, so omission of a privacy/transmission warning can lead to unintended data disclosure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation presents extract-again as a GET request even though it triggers server-side reprocessing, which is a state-changing action. Using GET for side effects increases the chance of accidental invocation by link prefetchers, crawlers, caches, or automated tooling that assumes GET is safe and idempotent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to upload PDF files and retrieve parsed content from a remote API, but it does not clearly disclose that full document contents may be transmitted to and processed by an external service. This can lead users to submit sensitive or regulated documents without understanding the privacy, confidentiality, or compliance implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The examples explicitly upload local PDF files to a third-party remote API but do not warn users that document contents leave the local system and may include sensitive or regulated data. In documentation for file-processing APIs, omission of a clear data-transmission notice can cause unintended disclosure when users test with confidential documents.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This code example defaults to a remote API endpoint and is used by an upload function that sends a local PDF to an external service. In context, the risk is not the URL string itself but that the example operationalizes off-system transmission without an adjacent privacy or sensitivity warning.
Content: Scanner excerpt · parsers/pdf_parser_examples.md (reported line 22)May include surrounding context.
md
import os import requests BASE_URL = os.getenv("CHATDOC_STUDIO_BASE_URL", "https://api.chatdoc.studio/v1") API_KEY = os.getenv("CHATDOC_STUDIO_API_KEY") def upload_pdf(file_path: str, wait: bool = False) -> dict:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This TypeScript example hardcodes a remote default endpoint and is part of a file upload flow that transmits PDF content externally. Without disclosure in the surrounding docs, users may unknowingly expose sensitive documents during testing or integration.
Content: Scanner excerpt · parsers/pdf_parser_examples.md (reported line 55)May include surrounding context.
md
import FormData from 'form-data'; import axios from 'axios'; const BASE_URL = process.env.CHATDOC_STUDIO_BASE_URL || 'https://api.chatdoc.studio/v1'; const API_KEY = process.env.CHATDOC_STUDIO_API_KEY || ''; interface UploadResponse {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This Rust example embeds the external API base URL and is used in code that reads and uploads a local PDF to a remote server. The danger is unintended disclosure of document contents if users run the sample with real files without understanding the remote-processing model.
Content: Scanner excerpt · parsers/pdf_parser_examples.md (reported line 110)May include surrounding context.
md
use reqwest::Client; use serde::Deserialize; const BASE_URL: &str = "https://api.chatdoc.studio/v1"; #[derive(Debug, Deserialize)] struct UploadData {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The retrieval API documentation describes sending arbitrary user queries and returning document-derived content, but it does not warn users that both query text and retrieved document content are transmitted to the external API service. This can cause developers to unintentionally send sensitive personal, proprietary, or regulated data off-platform, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.