Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation aid for API design and uses placeholder examples rather than hidden execution or data collection.
Before installing, treat generated API docs and code snippets as drafts. Do not paste real secrets or customer data, and review any generated requests, repository writes, or publication steps before approving them.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**关于本表中的“危险示例”（重要）**
下表出现的 `DELETE /tasks/all` 等写法，是**评审反例**，用来说明“什么样的设计应该被
打回”。它不是可执行指令，本技能也不会替你发起任何请求。出现在此处的唯一目的是让你
在 code review 中识别并否决这类设计。
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**关于本表中的“危险示例”（重要）**
下表出现的 `DELETE /tasks/all` 等写法，是**评审反例**，用来说明“什么样的设计应该被
打回”。它不是可执行指令，本技能也不会替你发起任何请求。出现在此处的唯一目的是让你
在 code review 中识别并否决这类设计。
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**关于本表中的“危险示例”（重要）**
下表出现的 `DELETE /tasks/all` 等写法，是**评审反例**，用来说明“什么样的设计应该被
打回”。它不是可执行指令，本技能也不会替你发起任何请求。出现在此处的唯一目的是让你
在 code review 中识别并否决这类设计。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 5 分钟上手
1. 在控制台创建应用，取得 `client_id` 与 `client_secret`
2. 换取 token：
curl -X POST https://api.example.com/v1/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID -d client_secret=$CLIENT_SECRET
3. 调用第一个接口：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 5 分钟上手
1. 在控制台创建应用，取得 `client_id` 与 `client_secret`
2. 换取 token：
curl -X POST https://api.example.com/v1/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID -d client_secret=$CLIENT_SECRET
3. 调用第一个接口：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 5 分钟上手
1. 在控制台创建应用，取得 `client_id` 与 `client_secret`
2. 换取 token：
curl -X POST https://api.example.com/v1/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID -d client_secret=$CLIENT_SECRET
3. 调用第一个接口：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Production: https://api.tasks.example.com/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Production: https://api.tasks.example.com/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Production: https://api.tasks.example.com/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Production: https://api.tasks.example.com/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X {METHOD} {URL} \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <token>" \
-d '{body}'
No suspicious patterns detected.