Security audit
Security checks for vulnerabilities and agentic risk
This is a plain documentation skill for using AceDataCloud APIs; its external API calls and token examples are disclosed and fit that purpose.
Install this only if you intend to work with AceDataCloud. Treat real API tokens as secrets, prefer service-scoped tokens over global tokens, store tokens in environment variables or a secret manager, avoid committing or pasting tokens into chats, and remember that API calls may consume paid quota.
The manifest description says to use the skill when 'authenticating, making API calls, managing credentials, understanding billing, or integrating AceDataCloud services into applications.' Several of these phrases are broad on their own and there are no negative examples or explicit trigger constraints, which may cause unintended invocation for generic API or credential-help requests.
The skill teaches users to create and use API tokens but does not warn them to keep tokens secret, avoid hardcoding them, or avoid sharing them in prompts, logs, or source control. In a credential-focused skill, this omission increases the chance of accidental token exposure and downstream unauthorized API use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All APIs use Bearer token authentication:
curl -X POST https://api.acedata.cloud/<endpoint> \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{ ... }'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All APIs use Bearer token authentication:
curl -X POST https://api.acedata.cloud/<endpoint> \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{ ... }'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All APIs use Bearer token authentication:
curl -X POST https://api.acedata.cloud/<endpoint> \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{ ... }'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All APIs use Bearer token authentication:
curl -X POST https://api.acedata.cloud/<endpoint> \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{ ... }'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All APIs use Bearer token authentication:
curl -X POST https://api.acedata.cloud/<endpoint> \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{ ... }'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Some APIs return results immediately (e.g., face transform, search):
curl -X POST https://api.acedata.cloud/face/analyze \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"image_url": "https://example.com/photo.jpg"}'
No suspicious patterns detected.