Frontend Backend Flow Test

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:56 AM UTC
• Version: 0.3.1

Overview

This is a coherent API contract audit skill, but its optional live test generator can unexpectedly change data and persist credentials, so it should be reviewed before installation.

Use the static audit command only if you install this skill. Avoid scripts/generate_tests.py until the read-only delete path, credential handling, and template injection issues are fixed; do not run generated helpers against production or with real reusable credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_tests.py:173

Finding

Read-only mode can generate helpers that issue DELETE requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_tests.py:41

Finding

Test-account credentials are embedded in executable generated source files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_tests.py:441

Finding

Untrusted configuration is interpolated into executable Python source

Content

View full analysis

Remediation

View remediation

` syntax. 4. Validate API URLs using a URL parser and restrict schemes to HTTPS, with explicit development exceptions if required. 5. Validate endpoint paths, class names, feature keys, field names, JSON extraction paths, and header names against strict schemas. 6. Reject unexpected properties and control characters in configuration. 7. Avoid generating arbitrary authentication-header source fragments; construct headers at runtime as dictionaries. 8. Create generated files with restrictive permissions and clearly label them as untrusted until reviewed. 9. Add tests using quote-breaking, newline, brace, and method-injection payloads to verify that generated output cannot escape data contexts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill positions itself as audit-first and says live verification is secondary and limited, yet the behavior described in the finding includes generating and encouraging execution of write-capable live API tests with authentication handling. That mismatch is dangerous because users may trust it as a safe static analyzer and accidentally run state-changing requests against real services, causing data modification or operational impact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill positions itself as audit-first and says live verification is secondary and limited, yet the behavior described in the finding includes generating and encouraging execution of write-capable live API tests with authentication handling. That mismatch is dangerous because users may trust it as a safe static analyzer and accidentally run state-changing requests against real services, causing data modification or operational impact.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/auditlib/backend_extractors.py (reported line 121)May include surrounding context.

python

any_req = re.search(r'\.anyRequest\(\)\.(permitAll|authenticated)\s*\(', text)
        if any_req and any_req.group(1) == 'authenticated':
            rules.append((re.compile(r'^/.*'), RequestHints(auth=['authenticated-route'])))
    return rules


def match_security_hints(path: str, rules: List[Tuple[re.Pattern, RequestHints]]) -> RequestHints:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs use of shell commands, file reads/writes, and potentially live verification, but it declares no explicit tool scope or permission boundaries. That omission can cause an agent runtime to over-grant capabilities, increasing the chance of unintended filesystem, environment, or network access during analysis or follow-up checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The finding summaries, unknown-status messages, and recommendations are written in Korean string literals, which imposes a specific language on downstream users or operators. The file does not offer a language/locale choice or explain that the tool is intentionally Korea-specific, so this appears to violate the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated markdown includes multiple user-facing strings in Korean such as '위험도' and '즉시 확인할 항목'. This imposes a specific language on users without opt-in, which matches the natural-language locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The string '외 ...건' is another user-visible Korean phrase in the generated report. Combined with other Korean literals, this indicates the skill consistently forces a locale rather than offering user choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_tests.py (reported line 47)May include surrounding context.

python

}}

        if "{login_request_encoding}" == "json":
            r = requests.post(
                f"{{API_BASE}}{login_endpoint}",
                json=login_payload,
                timeout=10

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code deliberately generates runnable scripts that perform authenticated CREATE/UPDATE/DELETE requests against a configured API and then prints commands encouraging users to execute them. In an audit-first static contract analysis skill, that materially expands the trust boundary and creates risk of unintended state changes, notification triggers, quota consumption, or data corruption, especially because the production guard is heuristic and bypassable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The main flow loads arbitrary configuration and generates executable test files that may send authenticated write requests whenever --allow-writes is supplied, which is a weak control for a skill whose stated purpose is static compatibility analysis. The surrounding warnings help, but they do not prevent misuse, and the generated output directly instructs operators to run the files, making accidental live impact plausible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The code scans for .env* files and reads their contents to derive a default base path, which is a sensitive configuration source. There is no confirmation prompt, logging, comment, or docstring at this operation to disclose that environment-derived configuration files will be accessed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Using '없음' as a default output value is a user-facing language choice embedded directly in code. This is a smaller instance of the same locale policy issue because the skill does not provide opt-in or explain a Korean-only requirement.

Content

No source excerpt is available for this finding.