Security audit

Basic Integration Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only integration guide that describes sensitive configuration and powerful service APIs, but it does not install or run code itself.

Install this as a reference guide, not production-ready operational policy. Before using copied examples, replace placeholder hosts and tokens, use TLS or mTLS where appropriate, keep secrets in a secret manager, and put approval, backup, audit, and rollback procedures around delete, reset, import, publish, rollback, draft-clearing, and batch storage operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide documents destructive operations such as delete, reset, rollback, import/export overwrite, and batch/storage-affecting actions without any warning about irreversible effects, backup expectations, authorization requirements, or operational safeguards. In an integration guide, this can lead developers to automate or invoke dangerous endpoints in production without confirmation flows, dry-run support, or recovery planning, increasing the chance of accidental data loss.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The tenant and dictionary sections include cascading deletions, publish, rollback, draft clearing, and import operations but do not warn that these actions can remove dependent records or revert shared configuration state. Because these APIs affect multi-tenant and shared dictionary data, misuse could impact many users or tenants at once, making omissions in operational safety guidance more dangerous.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The documentation enumerates sensitive environment variables for database, OIDC, OSS, and storage credentials without advising secure secret storage, rotation, masking, or avoiding logs and source control. This is a documentation security weakness because readers may copy these patterns into insecure deployment practices, leading to credential exposure.

Static analysis

No suspicious patterns detected.