Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple API documentation generator with minor routing-quality issues but no hidden code execution, persistence, credential access, or destructive behavior.
Installers should know this skill may activate on broad API-doc terms like OpenAPI or Swagger, so review routing behavior if precise activation matters. The inspected package otherwise appears proportionate for generating API documentation from code the user chooses to provide.
The trigger phrase "API文档" is very broad and can match ordinary discussion about API documentation rather than an explicit request to invoke the skill. This can cause unintended skill activation, leading the agent to process code or generate outputs in contexts the user did not intend, which is a routing and least-surprise security issue.
The trigger phrase "API文档" is extremely broad and can activate this skill for many unrelated conversations about API documentation. Overbroad activation increases the chance that the agent invokes the wrong skill, causing unintended processing of user code or incorrect task routing.
Using generic standalone triggers like "openapi" and "swagger" makes the skill likely to activate whenever those common technology names appear, even if the user is not asking to generate documentation. This can lead to skill hijacking or misrouting, where unrelated requests are captured by this skill instead of the correct one.
The natural-language instructions, headings, and examples are presented exclusively in Chinese, and the file does not state that the skill is region-specific or that users may interact in other languages. This can be a language policy concern when a skill appears to force a locale without opt-in or justification.
No suspicious patterns detected.
