Security checks for vulnerabilities and agentic risk
Overview
The skill stays local and does not show exfiltration, but it claims real OpenAPI analysis and validation while the shipped script returns canned results and can overwrite files.
Install only if you treat this as a demo/template helper, not a trustworthy OpenAPI analyzer. Do not rely on its validation result, redaction claims, endpoint discovery, or inferred schemas for production documentation, and avoid pointing it at sensitive HAR/PCAP files unless you review outputs manually and choose non-critical output paths.
Validation Command Unconditionally Approves Invalid or Hostile Specifications
Content
View full analysis
"
[ -f "$spec" ] || die "Spec file not found: $spec"
echo "=== OpenAPI Validation ==="
echo "Spec: $spec"
echo ""
local endpoint_count params_count ref_count
endpoint_count=$(grep -c '^\s'"/" "$spec" 2>/dev/null || echo 0)
ref_count=$(grep -c 'ref:' "$spec" 2>/dev/null || echo 0)
echo "Validation Results:"
echo " Endpoints: $(grep -c 'summary:' "$spec" 2>/dev/null || echo 0)"
echo " Schemas: $(grep -c 'type: object' "$spec" 2>/dev/null || echo 0)"
echo " Auth schemes: 1"
echo ""
echo "Warnings:"
echo " - 2 endpoints missing response description"
echo " - 1 schema missing example value"
echo ""
echo "Status: PASS (with minor warnings)"
echo ""
echo "To fix warnings, edit the spec and re-run validation."
}
```
### Technical Analysis
The validation routine does not parse YAML or JSON and does not validate the OpenAPI schema. It merely counts selected strings with `grep`, reports fixed authentication and warning values, and always prints:
```text
Status: PASS (with minor warnings)
```
The calculated `endpoint_count` and `ref_count` values do not affect the status. Any existing file—including malformed YAML, arbitrary text, broken references, or an injected OpenAPI document—receives a successful result and a zero exit status.
This is a fail-open security condition because the command presents itself as a validation boundary while performing no meaningful validation. It also contradicts the documented claim that structural validation and schema-reference checking are performed.
### Attack Path
1. An attacker supplies a malformed or intentionally manipulated specification, or exploits the
...[truncated 1220 chars]
Remediation
View remediation
other
Warning
Location
scripts/openapi-gen.sh:66
Finding
Simulated Analysis Creates False Security and Secret-Redaction Assurances
Content
View full analysis
"
echo "=== Endpoint Discovery ==="
echo "Source: $source"
echo ""
if [ -d "$source" ]; then
local framework="auto"
if ls "$source"/*.go 2>/dev/null | grep -q .; then
framework="Go (Gin)"
elif ls "$source"/pom.xml "$source"/build.gradle* 2>/dev/null | grep -q .; then
framework="Java (Spring)"
elif ls "$source"/*.py 2>/dev/null | grep -q .; then
framework="Python (FastAPI)"
elif ls "$source"/package.json 2>/dev/null | grep -q .; then
framework="Node (Express)"
fi
echo "Detected framework: $framework"
elif [ -f "$source" ]; then
local ext="${source##*.}"
case "$ext" in
har|json) echo "Source type: HAR file (browser traffic capture)" ;;
pcap|cap) echo "Source type: PCAP file (network capture)" ;;
yaml|yml) echo "Source type: Existing spec (re-scan mode)" ;;
*) echo "Source type: Unknown file format" ;;
esac
fi
echo ""
echo "Discovered endpoints (simulated):"
echo " GET /health"
echo " GET /api/v1/users"
echo " POST /api/v1/users"
echo " GET /api/v1/users/{id}"
echo " PUT /api/v1/users/{id}"
echo " DELETE /api/v1/users/{id}"
echo " GET /api/v1/users/{id}/orders"
echo " POST /api/v1/login"
echo ""
echo "Total: 8 endpoints across 3 route groups"
echo "Auth: Bearer JWT (detected from middleware)"
echo ""
echo "Next: openapi-gen.sh infer $source"
}
cmd_infer() {
local source="${1:-}"
[ -z "$source" ] && die "Usage: openapi-gen.sh infer "
echo "=== Schema Inference ==="
echo "Source: $source"
echo ""
echo "Inferred schemas:"
echo ""
...[truncated 3585 chars]
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
md
echo " POST /api/v1/users"
echo " GET /api/v1/users/{id}"
echo " PUT /api/v1/users/{id}"
echo " DELETE /api/v1/users/{id}"
echo " GET /api/v1/users/{id}/orders"
echo " POST /api/v1/login"
echo ""
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · scripts/openapi-gen.sh (reported line 105)May include surrounding context.
sh
echo " POST /api/v1/users"
echo " GET /api/v1/users/{id}"
echo " PUT /api/v1/users/{id}"
echo " DELETE /api/v1/users/{id}"
echo " GET /api/v1/users/{id}/orders"
echo " POST /api/v1/login"
echo ""
Intent-Code Divergence
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The generate command claims to auto-generate an OpenAPI spec from the input source, but always writes the same canned API definition. This is dangerous because users may deploy, publish, or validate against a spec they believe represents their real service, causing incorrect exposure documentation, broken client/server assumptions, and potential omission of sensitive or risky endpoints.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding
The sample prompts and user-facing examples from L175 through L218 are written exclusively in Chinese, and the document does not state that the skill supports multiple languages or that Chinese is optional. This can violate a language/locale policy when a skill appears to prescribe a specific language without user opt-in.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
The scan command claims to discover endpoints and detect Bearer JWT authentication, but it emits a fixed list unrelated to the provided source. In a security-sensitive developer tool, fabricated discovery results can cause users to omit real endpoints or trust false auth assumptions, producing inaccurate API inventories and unsafe downstream decisions.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The script writes directly to the output path with shell redirection and no confirmation, backup, or safe-create behavior. If a user supplies an existing file path, important files can be unintentionally overwritten, which is especially risky in an agent or automation context where paths may be programmatically constructed.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The validation command reports specific warning counts and conclusions that are not derived from real parsing or semantic validation of the provided OpenAPI spec. This can mislead users into trusting an invalid or incomplete specification, creating downstream security and reliability issues if the generated artifact is used for mocks, client generation, or documentation.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The mock command creates its output file by direct overwrite without warning. In automated environments, this can silently destroy prior configuration or user-edited mock settings, leading to loss of work or unintended changes in testing behavior.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
72% confidence
Finding
The workflow describes exporting a validated OpenAPI spec and optional mock server config after ingesting HAR, traffic logs, and PCAPs, which may contain sensitive internal URLs or inferred metadata. Although the Security Requirements mention sensitivity later, the export step itself does not warn users that generated files may still expose internal hostnames, endpoint structure, or other sensitive system details before saving or sharing.
