Security audit

Api Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent API code generator, but some generated authentication code is unsafe enough that users should review it carefully before using it.

Install only if you treat the output as scaffolding, not production-ready code. Review and harden generated auth before use, especially JWT secrets and API-key validation, validate generator inputs, and be aware that scripts/script.sh can write local usage history if invoked.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

other

Note

Location: scripts/apigen.sh:7
Finding: Undisclosed Promotional Content Injected into Generated Artifacts
Content: View full analysis
auth.js ``` 2. The script generates the requested code. 3. The script automatically appends the promotional domain and email address. 4. Because output is redirected, the promotional content becomes a persistent part of the user's source file. 5. The content may subsequently be committed, distributed, or deployed without the user intentionally adding it. ### Impact Assessment The behavior modifies user-owned generated artifacts and may cause unintended attribution, external promotion, policy violations, or source-code pollution. It does not provide system privileges, execute a remote payload, or expose credentials. The scope is limited to generated output. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/apigen.sh:333
Finding: Generated JWT Authentication Uses a Publicly Known Default Signing Secret
Content: View full analysis
auth.js ``` 2. The developer deploys the generated module without setting `JWT_SECRET`. 3. The application silently uses `change-me-in-production`. 4. An attacker creates a JWT containing a forged identity and privileged role, such as `admin`. 5. The attacker signs the token using the known fallback secret. 6 ...[truncated 502 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/apigen.sh:418
Finding: Generated API-Key Middleware Accepts Every Nonempty Key
Content: View full analysis
api-key-auth.js ``` 2. The generated middleware is attached to protected API routes without implementing the commented database lookup. 3. An unauthenticated attacker sends: ```http X-API-Key: arbitrary-value ``` 4. The nonempty value passes the only active check. 5. The middleware invokes `next()`. 6. The attacker reaches routes that were intended to require a valid API key. ### Impact Assessment This flaw causes complete authentication bypass for every endpoint protected solely by the generated middleware. An attacker obtains the same API access as an authenticated key holder. Depending on t ...[truncated 162 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/apigen.sh:5
Finding: Unvalidated Resource Names Permit Injection into Generated Source Code
Content: View full analysis
1 else "resource" cap = name.capitalize() print("""// ===== {cap} RESTful API (Express.js) ===== const express = require('express'); const router = express.Router(); // GET /{name}s - List all router.get('/{name}s', async (req, res) => {{ ``` The template is finalized with direct formatting: ```python """.format(name=name, cap=cap)) ``` ### Technical Analysis The command-line resource name is passed safely from Bash to Python as an argument, so this is not shell command injection in the generator process itself. However, the value is inserted without context-specific validation or escaping into generated JavaScript strings, JavaScript identifiers, Python identifiers, GraphQL identifiers, comments, and route paths. A resource name containing quotes, line breaks, delimiters, or source-language syntax can terminate an intended string or identifier and introduce attacker-controlled source text. The generated artifact may execute that text when a developer later saves and runs it. The same underlying pattern appears across the `rest`, `graphql`, `client`, `mock`, and `test` templates. A single transformed value such as `cap = name.capitalize()` does not make the value a safe source-code identifier. ### Attack Path 1. An attacker supplies, recommends, or places a crafted resource name into an automated invocation. 2. A developer generates code and redirects it into a project file: ```bash bash scripts/apigen.sh rest "$UNTRUSTED_NAME" > routes.js ``` 3. The generator inserts the value directly into source-language contexts without validation or escaping. 4. The crafted value breaks out of ...[truncated 636 chars]
Remediation: View remediation

other

Note

Location: scripts/script.sh:5
Finding: Secondary Script Performs Undisclosed Persistent Usage Logging
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash _log "init" "$name ($fw)" ``` ```bash _log "crud" "$resource" ``` ### Technical Analysis The secondary script creates a persistent data directory immediately at startup, regardless of the selected command. Its `init` and `crud` commands append timestamps and user-supplied project or resource names to `history.log`. The primary documentation states that generated code prints to standard output and does not describe persistent history logging. Although no external transmission was observed, project names and resource names may reveal confidential product, customer, or internal service information to other local processes or users if filesystem permissions are permissive. The configured data directory can also be redirected through `APIGEN_DIR`. The script relies on the process umask rather than explicitly restricting permissions on the directory and history file. ### Attack Path 1. A user invokes `scripts/script.sh`. 2. The script creates a persistent directory under the user's data directory before command processing. 3. The user runs `init` or `crud` with a potentially sensitive project or resource name. 4. The script appends that identifier and a timestamp to `history.log`. 5. The information remains after command completion and may be included in backups or accessed by another local principal where permissions allow. ### Impact Assessment The issue does not create a startup backdoor and therefore is not system persistence under T06. It causes unexpected cross-run retention of usage metadata. The affected informatio ...[truncated 146 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/apigen.sh (reported line 63)May include surrounding context.
sh
}} }}); // DELETE /{name}s/:id - Delete router.delete('/{name}s/:id', async (req, res) => {{ try {{ // await {cap}.findByIdAndDelete(req.params.id);

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/apigen.sh (reported line 610)May include surrounding context.
sh
}} }}); // DELETE /{name}s/:id - Delete router.delete('/{name}s/:id', async (req, res) => {{ try {{ // await {cap}.findByIdAndDelete(req.params.id);

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes shell execution and likely network/environment access via bash scripts/apigen.sh ..., but it does not declare any tool scope such as permissions or allowed-tools. This creates an unnecessary trust gap: a consumer cannot tell in advance what capabilities the skill may exercise, and any downstream script changes could broaden behavior without a corresponding manifest restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This shell skill generates client code that issues HTTP GET/POST/PUT/DELETE requests, including sending request bodies and deleting resources, but the generated output only contains neutral docstrings like 'Delete a resource' and no warning that data will be transmitted to a remote API or that delete is destructive. Under the code-file criteria, these safety-relevant operations lack meaningful disclosure beyond their functional names.
Content: No source excerpt is available for this finding.