Openapi Spec Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:35 AM UTC
• Version: 1.0.0

Overview

The skill stays local and does not show exfiltration, but it claims real OpenAPI analysis and validation while the shipped script returns canned results and can overwrite files.

Install only if you treat this as a demo/template helper, not a trustworthy OpenAPI analyzer. Do not rely on its validation result, redaction claims, endpoint discovery, or inferred schemas for production documentation, and avoid pointing it at sensitive HAR/PCAP files unless you review outputs manually and choose non-critical output paths.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openapi-gen.sh:155
• Finding: Unescaped User-Controlled Values Permit YAML and OpenAPI Document Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openapi-gen.sh`, lines 155–185 **Vulnerability Type**: YAML document injection through unsafe string interpolation **Risk Level**: Medium ### Vulnerable Code ```bash cmd_generate() { local source="${1:-}" output="openapi.yaml" api_title="" api_version="1.0.0" format="yaml" server_url="" shift 2>/dev/null || true [ -z "$source" ] && die "Usage: openapi-gen.sh generate <source> [--output <path>] [--title ...]" while [ $# -gt 0 ]; do case "$1" in --output) output="$2"; shift 2 ;; --title) api_title="$2"; shift 2 ;; --version) api_version="$2"; shift 2 ;; --format) format="$2"; shift 2 ;; --server) server_url="$2"; shift 2 ;; *) shift ;; esac done [ -z "$api_title" ] && api_title="$(basename "$source" | tr '[:lower:]' '[:upper:]' | head -c20) API" echo "=== OpenAPI Spec Generation ===" echo "Title: $api_title" echo "Version: $api_version" echo "Source: $source" echo "Output: $output" echo "" cat > "$output" <<YAML openapi: 3.0.3 info: title: "${api_title}" version: "${api_version}" description: "Auto-generated by openapi-gen.sh v${VERSION}" servers: - url: "${server_url:-http://localhost:8080}" ``` ### Technical Analysis The `--title`, `--version`, and `--server` arguments are controlled by the caller and are inserted directly into a YAML here-document. Quotation marks, newlines, backslashes, and other YAML-significant characters are not escaped. Wrapping an interpolated value in double quotes does not make this construction safe. An attacker can include a quote and newline that terminate the intended scalar and introduce additional YAML or OpenAPI properties. The resulting document could contain attacker-selected server entries, paths, extension fields, or external references. This does not directly execute commands in the shell because here-document expansion does not recursively evaluate command syntax found i ...[truncated 1608 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate YAML or JSON through a structured serializer rather than string interpolation. 2. Pass title, version, and server URL values as data to the serializer. 3. Reject carriage returns, line feeds, control characters, and invalid Unicode in scalar-only command-line options. 4. Validate `--server` as an absolute HTTP or HTTPS URL and apply an explicit policy for allowed schemes and hosts. 5. Validate the version and title against documented length and character constraints. 6. Parse and structurally validate the completed document before moving it to the requested output path. 7. Write to a securely created temporary file and atomically rename it only after successful validation. 8. Add regression tests using embedded quotes, multiline input, YAML tags, anchors, comments, and attempted field injection. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openapi-gen.sh:308
• Finding: Validation Command Unconditionally Approves Invalid or Hostile Specifications<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openapi-gen.sh`, lines 308–329 **Vulnerability Type**: Fail-open and fabricated OpenAPI validation **Risk Level**: Medium ### Vulnerable Code ```bash cmd_validate() { local spec="${1:-}" [ -z "$spec" ] && die "Usage: openapi-gen.sh validate <spec>" [ -f "$spec" ] || die "Spec file not found: $spec" echo "=== OpenAPI Validation ===" echo "Spec: $spec" echo "" local endpoint_count params_count ref_count endpoint_count=$(grep -c '^\s'"/" "$spec" 2>/dev/null || echo 0) ref_count=$(grep -c 'ref:' "$spec" 2>/dev/null || echo 0) echo "Validation Results:" echo " Endpoints: $(grep -c 'summary:' "$spec" 2>/dev/null || echo 0)" echo " Schemas: $(grep -c 'type: object' "$spec" 2>/dev/null || echo 0)" echo " Auth schemes: 1" echo "" echo "Warnings:" echo " - 2 endpoints missing response description" echo " - 1 schema missing example value" echo "" echo "Status: PASS (with minor warnings)" echo "" echo "To fix warnings, edit the spec and re-run validation." } ``` ### Technical Analysis The validation routine does not parse YAML or JSON and does not validate the OpenAPI schema. It merely counts selected strings with `grep`, reports fixed authentication and warning values, and always prints: ```text Status: PASS (with minor warnings) ``` The calculated `endpoint_count` and `ref_count` values do not affect the status. Any existing file—including malformed YAML, arbitrary text, broken references, or an injected OpenAPI document—receives a successful result and a zero exit status. This is a fail-open security condition because the command presents itself as a validation boundary while performing no meaningful validation. It also contradicts the documented claim that structural validation and schema-reference checking are performed. ### Attack Path 1. An attacker supplies a malformed or intentionally manipulated specification, or exploits the ...[truncated 1220 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the `grep` checks with a reputable, pinned OpenAPI 3.x validator that operates locally. 2. Parse YAML and JSON with safe parsers before performing OpenAPI semantic validation. 3. Validate required fields, operation structures, parameter consistency, schema definitions, and all references. 4. Disable external reference retrieval by default. If external references are required, restrict schemes and destinations and block loopback, private, link-local, and metadata-service addresses. 5. Return a nonzero exit status for syntax errors, schema violations, unresolved references, or validator execution failures. 6. Derive the displayed status and warning list exclusively from actual validation results. 7. Remove fixed endpoint, schema, authentication, and warning counts. 8. Add negative tests for arbitrary text, malformed YAML, malformed JSON, broken `$ref` values, duplicate operations, and documents generated with injection payloads. ]]>

other

Warning

• Location: scripts/openapi-gen.sh:66
• Finding: Simulated Analysis Creates False Security and Secret-Redaction Assurances<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openapi-gen.sh`, lines 66–148; security claims in `SKILL.md`, lines 289–296 **Vulnerability Type**: Deceptive capability and security-control claims **Risk Level**: Medium ### Vulnerable Code ```bash cmd_scan() { local source="${1:-}" [ -z "$source" ] && die "Usage: openapi-gen.sh scan <source>" echo "=== Endpoint Discovery ===" echo "Source: $source" echo "" if [ -d "$source" ]; then local framework="auto" if ls "$source"/*.go 2>/dev/null | grep -q .; then framework="Go (Gin)" elif ls "$source"/pom.xml "$source"/build.gradle* 2>/dev/null | grep -q .; then framework="Java (Spring)" elif ls "$source"/*.py 2>/dev/null | grep -q .; then framework="Python (FastAPI)" elif ls "$source"/package.json 2>/dev/null | grep -q .; then framework="Node (Express)" fi echo "Detected framework: $framework" elif [ -f "$source" ]; then local ext="${source##*.}" case "$ext" in har|json) echo "Source type: HAR file (browser traffic capture)" ;; pcap|cap) echo "Source type: PCAP file (network capture)" ;; yaml|yml) echo "Source type: Existing spec (re-scan mode)" ;; *) echo "Source type: Unknown file format" ;; esac fi echo "" echo "Discovered endpoints (simulated):" echo " GET /health" echo " GET /api/v1/users" echo " POST /api/v1/users" echo " GET /api/v1/users/{id}" echo " PUT /api/v1/users/{id}" echo " DELETE /api/v1/users/{id}" echo " GET /api/v1/users/{id}/orders" echo " POST /api/v1/login" echo "" echo "Total: 8 endpoints across 3 route groups" echo "Auth: Bearer JWT (detected from middleware)" echo "" echo "Next: openapi-gen.sh infer $source" } cmd_infer() { local source="${1:-}" [ -z "$source" ] && die "Usage: openapi-gen.sh infer <source>" echo "=== Schema Inference ===" echo "Source: $source" echo "" echo "Inferred schemas:" echo "" ...[truncated 3585 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement actual parsers and scanners for every advertised source type before claiming support. 2. Parse repository files recursively using framework-specific syntax or AST analysis rather than top-level filename checks. 3. Parse HAR and traffic inputs with strict size limits, format validation, and safe handling of malformed records. 4. Implement credential, token, cookie, password, personal-data, and internal-host redaction before including any observed values in output. 5. Avoid retaining raw bodies longer than needed and document the actual lifecycle of sensitive data. 6. Derive endpoint, schema, framework, and authentication findings from collected evidence and attach confidence levels. 7. Clearly label any demonstration or placeholder output as synthetic and prevent it from being represented as analysis. 8. Until these controls exist, remove claims of automatic redaction, middleware detection, PCAP reconstruction, schema inference, and official OpenAPI validation. 9. Add end-to-end tests showing that different source inputs produce evidence-based outputs and that known secrets never appear in generated files or logs. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "  POST   /api/v1/users"
  echo "  GET    /api/v1/users/{id}"
  echo "  PUT    /api/v1/users/{id}"
  echo "  DELETE /api/v1/users/{id}"
  echo "  GET    /api/v1/users/{id}/orders"
  echo "  POST   /api/v1/login"
  echo ""

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "  POST   /api/v1/users"
  echo "  GET    /api/v1/users/{id}"
  echo "  PUT    /api/v1/users/{id}"
  echo "  DELETE /api/v1/users/{id}"
  echo "  GET    /api/v1/users/{id}/orders"
  echo "  POST   /api/v1/login"
  echo ""

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The generate command claims to auto-generate an OpenAPI spec from the input source, but always writes the same canned API definition. This is dangerous because users may deploy, publish, or validate against a spec they believe represents their real service, causing incorrect exposure documentation, broken client/server assumptions, and potential omission of sensitive or risky endpoints.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The sample prompts and user-facing examples from L175 through L218 are written exclusively in Chinese, and the document does not state that the skill supports multiple languages or that Chinese is optional. This can violate a language/locale policy when a skill appears to prescribe a specific language without user opt-in.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The scan command claims to discover endpoints and detect Bearer JWT authentication, but it emits a fixed list unrelated to the provided source. In a security-sensitive developer tool, fabricated discovery results can cause users to omit real endpoints or trust false auth assumptions, producing inaccurate API inventories and unsafe downstream decisions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes directly to the output path with shell redirection and no confirmation, backup, or safe-create behavior. If a user supplies an existing file path, important files can be unintentionally overwritten, which is especially risky in an agent or automation context where paths may be programmatically constructed.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The validation command reports specific warning counts and conclusions that are not derived from real parsing or semantic validation of the provided OpenAPI spec. This can mislead users into trusting an invalid or incomplete specification, creating downstream security and reliability issues if the generated artifact is used for mocks, client generation, or documentation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The mock command creates its output file by direct overwrite without warning. In automated environments, this can silently destroy prior configuration or user-edited mock settings, leading to loss of work or unintended changes in testing behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The workflow describes exporting a validated OpenAPI spec and optional mock server config after ingesting HAR, traffic logs, and PCAPs, which may contain sensitive internal URLs or inferred metadata. Although the Security Requirements mention sensitivity later, the export step itself does not warn users that generated files may still expose internal hostnames, endpoint structure, or other sensitive system details before saving or sharing.

Static analysis

No suspicious patterns detected.