Security audit

2ryun第二现实（中文版）

Security checks for vulnerabilities and agentic risk

Overview

The skill looks like a legitimate 2Ryun API guide, but it needs Review because it can publish content publicly and delete remote documents or files without clear confirmation safeguards.

Install only if you intend to let an agent manage a 2Ryun account. Use a narrowly scoped API key where possible, and require explicit confirmation before uploads, publishing, sharing, updates, or deletes, especially for confidential documents or assets that may become publicly accessible.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The spec explicitly documents a publish flow that makes generated HTML reachable without authentication, but it does not prominently warn that publishing changes the access model from private to world-readable. In a skill that helps agents create and publish content from documents, this omission can lead to accidental disclosure of sensitive material if the agent or user treats publishing as a routine save/share action.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The attachment section states that uploaded files are accessible via direct public URLs without API authentication, but the documentation does not clearly frame this as a security-sensitive exposure risk. In this skill context, agents may upload source documents, images, or exports containing internal data and then inadvertently expose them as public assets.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The delete endpoint is destructive, yet the spec provides no caution about irreversibility, recovery expectations, or required confirmation. This is primarily an operational safety weakness rather than a direct exploit primitive, but in an agent-driven workflow it increases the chance of accidental data loss from over-broad or mistaken delete actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The attachment delete API notes that both metadata and physical files are removed, but it omits a clear warning about permanent loss and downstream broken links. Because attachments are publicly addressable and may be embedded in generated pages or documents, deletion can silently break published content and destroy evidence or assets without user awareness.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill description is overly broad and includes common concepts such as documents, knowledge bases, webpages, and publishing, which can cause the agent to invoke this skill in many unrelated conversations. Over-triggering is dangerous here because the skill exposes write, delete, publish, and upload operations against an external service, increasing the chance of unintended side effects or data handling without clear user intent.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ### 场景 1.3：更新 / 删除 - `PUT /restapi/documents/update/:id -d '{"title":"...","content":"..."}'` - `DELETE /restapi/documents/delete/:id` ---
Confidence: 88% confidence
Finding: The skill exposes a document deletion endpoint using a caller-supplied `:id` with no safety guidance such as confirmation, ownership verification, or scoping constraints. In an agent setting, ambiguous references, prompt injection from document content, or parameter mix-ups could cause unintended permanent deletion of the wrong document.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - `GET /restapi/note?page=1&pageSize=20` — 笔记列表 - `GET /restapi/note/:id` — 获取单篇 - `PUT /restapi/note/update/:id -d '{"title":"...","content":"..."}'` — 更新 - `DELETE /restapi/note/delete/:id` — 删除 **笔记 vs 文档**：笔记**不进入知识库**，没有 `wikiAutoExtract` 设置。适合临时内容、随手记、灵感备忘。需要长期保存并进入知识库的内容用文档。
Confidence: 88% confidence
Finding: The note deletion endpoint presents the same unsafe pattern: destructive action on a parameterized resource without confirmation or validation guidance. Because notes are likely to be numerous and similarly titled, an agent can easily delete the wrong item if it maps a natural-language request to an incorrect `:id`.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - `GET /restapi/attachments?type=image` — 列表（`type`: image/video/audio/document，支持分页、关键词、文件夹） - `GET /restapi/attachments/file/:id` — 下载文件 - `DELETE /restapi/attachments/:id` — 删除支持格式：图片（png/jpg/jpeg/gif/svg/webp）、视频（mp4/webm）、音频、文档等，单文件上限 20MB。
Confidence: 90% confidence
Finding: The attachment deletion endpoint allows removal of uploaded files by ID without any documented safeguards. In this skill's context, attachments may back published pages or documents, so mistaken or manipulated deletion can break content, destroy user assets, and cause broader availability and integrity issues.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: 2ryun-api-spec-cn.md:10