Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation generator that reads user-selected local repositories and writes generated docs, with no evidence of hidden execution, exfiltration, or persistence.
Install only if you are comfortable letting the agent read the repositories and wikis under the ROOT_PATH you provide. Use a narrow ROOT_PATH, choose an OUTPUT_PATH you control, and review generated documentation before sharing it because it may consolidate internal architecture, process details, configuration names, and API examples.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Endpoint:
DELETE /api/v1/[resources]/{id}
Authentication: Required
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
[package-manager] install
# Set up environment variables
cp .env.example .env
# Edit .env with your configuration
# Run database migrations (if applicable)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Set up environment variables
cp .env.example .env
# Edit .env with your configuration
# Run database migrations (if applicable)
[migration-command]
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Common debugging commands:
# Command to enable debug mode
DEBUG=* [start-command]
# Command to see detailed logs
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This document provides comprehensive documentation for all API endpoints in [Project Name].
**Base URL:** `https://api.example.com/v1`
**API Version:** v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Getting your API token:
# Example command or process to obtain token
curl -X POST https://api.example.com/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"email": "user@example.com", "password": "password123"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Example Request:
curl -X POST "https://api.example.com/v1/users" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Example Request:
curl -X PATCH "https://api.example.com/v1/users/usr_123abc" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
This markdown file documents a delete endpoint and provides a direct example request, but it does not include any warning or caution that the operation removes data and may be irreversible. Under the markdown-specific SQP-2 criteria, destructive behaviors that could affect user data should be accompanied by a warning.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Use shared components from `components/common/`
3. **Add business logic:**
- Create service file in `services/[featureName].js`
- Implement API calls and data transformations
- Follow existing error handling patterns
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Environments
| Environment | URL | Purpose | Auto-deploys |
|------------|-----|---------|--------------|
| Development | [url] | Local development | No |
| Staging | [url] | Testing before production | Yes (main branch) |
The changelog content is written in Portuguese and references the pt-BR version of Keep a Changelog, but the file does not state that the skill is region-specific or that language choice is optional. This can indicate a natural-language locale constraint without explicit user opt-in or justification.
No suspicious patterns detected.