Security audit

2Ryun Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for 2Ryun, but it gives an agent broad authority to modify, delete, upload, and publish user content without enough user-control guidance.

Review before installing. Use a least-privilege, preferably read-only API key for search tasks; do not paste bearer keys into chat; require explicit confirmation before any delete, update, upload, share, extraction, or publish action; and avoid uploading sensitive files because generated pages and uploaded assets may be accessible by URL.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

Location: README.md:19
Finding: Unpinned Third-Party Package Execution During Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:289
Finding: Bearer API Key Requested Through the Conversational Channel
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: 2ryun-api-spec.md:21
Finding: Default API-Key Guidance Violates Least Privilege
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:47
Finding: Conflicting Automatic-Extraction Field Names May Defeat Privacy Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: A raw delete-by-ID endpoint is dangerous in an agent context because a model can be induced to target the wrong document ID or act on ambiguous instructions, causing irreversible data loss. The skill's document-import and knowledge-base role makes such destructive capability higher risk unless tightly constrained.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 268)May include surrounding context.
1.7 删除文档

text
DELETE /restapi/documents/delete/:id

返回

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 83% confidence
Finding: Unsharing by arbitrary document ID and user ID can be abused if an agent is tricked into revoking access for the wrong collaborator. While less severe than deleting content, it can disrupt workflows and remove legitimate access without clear user intent.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 421)May include surrounding context.
1.17 取消分享

text
DELETE /restapi/documents/share/:id/:userId

取消对特定用户的文档分享。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Deleting knowledge-base entries by ID enables irreversible removal of structured knowledge that may have been derived from many documents. In an agent-driven workflow, prompt injection or entity-resolution mistakes can easily turn this into unintended destructive action.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 755)May include surrounding context.
2.8 删除条目

text
DELETE /restapi/wiki/entries/:id

2.9 审核 Enrichment

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: Deleting generated pages by ID can remove published or draft content if an agent supplies the wrong identifier. This is especially risky because generated pages may be externally shared, making accidental deletion user-visible immediately.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 1105)May include surrounding context.
3.8 删除生成记录

text
DELETE /restapi/gen-html/generations/:id

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: A delete-note endpoint allows permanent removal of user-authored notes based solely on an ID parameter. In agent systems, free-form intent interpretation makes parameter mistakes and prompt-induced destructive actions plausible.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 1357)May include surrounding context.
5.5 删除笔记

text
DELETE /restapi/note/:id

返回

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Attachment deletion removes physical files and thumbnails, but the documentation provides no explicit user warning or confirmation requirement. Because attachments may be referenced by generated pages or documents and are publicly addressable by URL, deletion can cause both data loss and broken published content.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Attachment deletion is high risk because it destroys stored files and thumbnails and may break documents or published pages that reference those assets. An attacker or misled agent only needs a file ID to trigger impactful loss if safeguards are weak.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 1467)May include surrounding context.
6.5 删除附件

text
DELETE /restapi/attachments/:id

删除附件（同时删除物理文件与缩略图），并释放存储配额。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 84% confidence
Finding: The skill exposes destructive document-deletion operations without any guardrails such as confirmation, identifier validation, or ownership checks in the skill guidance. In an agent setting, ambiguous references, prompt injection, or mistaken entity resolution could cause unintended deletion of user documents.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
### 场景 1.3：更新 / 删除 - `PUT /restapi/documents/update/:id -d '{"title":"...","content":"..."}'` - `DELETE /restapi/documents/delete/:id` ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 84% confidence
Finding: The note deletion endpoint is another destructive action presented without confirmation or anti-misuse safeguards. Because notes are often informal and numerous, an agent could easily delete the wrong item if prompted ambiguously or manipulated into selecting an unintended ID.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
- `GET /restapi/note?page=1&pageSize=20` — 笔记列表 - `GET /restapi/note/:id` — 获取单篇 - `PUT /restapi/note/update/:id -d '{"title":"...","content":"..."}'` — 更新 - `DELETE /restapi/note/delete/:id` — 删除 **笔记 vs 文档**：笔记**不进入知识库**，没有 `wikiAutoExtract` 设置。适合临时内容、随手记、灵感备忘。需要长期保存并进入知识库的内容用文档。

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that uploaded attachments return a directly accessible URL and explicitly says no API key is required, but it does not require a user-facing warning or confirmation before upload. This creates a real risk of unintentionally exposing sensitive files publicly if the agent uploads private images, videos, or documents on the user's behalf.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: Attachment deletion is a destructive capability affecting user files, yet the skill provides no instruction to confirm intent or verify the file identity before deletion. In combination with the public-upload feature, mistakes here could either remove needed assets from published pages or be abused to disrupt user content.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
- `GET /restapi/attachments?type=image` — 列表（`type`: image/video/audio/document，支持分页、关键词、文件夹） - `GET /restapi/attachments/file/:id` — 下载文件 - `DELETE /restapi/attachments/:id` — 删除支持格式：图片（png/jpg/jpeg/gif/svg/webp）、视频（mp4/webm）、音频、文档等，单文件上限 20MB。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 168)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/documents/create \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 255)May include surrounding context.
请求示例

bash
curl -X PUT https://www.2ryun.com/restapi/documents/update/6a69810fef276a17f2fb089f \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"title": "更新后的标题", "content": "更新后的内容", "tags": ["新标签"]}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The spec exposes document deletion as a simple endpoint without emphasizing that the action is irreversible or requiring explicit confirmation. In an agent setting, ambiguous user instructions or prompt injection could lead to accidental permanent deletion of user content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 296)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/documents/batch \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"ids": ["6a69810fef276a17f2fb089f", "6a69810fef276a17f2fb08a0"]}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 467)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/wiki/extract \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 581)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/wiki/extract-batch \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 959)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/gen-html/generate \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 1127)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/gen-html/generations/xxx/chat \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"feedback": "请把页面标题颜色改为深蓝色，字号增大到 32px"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The publishing flow makes content publicly accessible without highlighting the privacy consequences of exposing document-derived content to anyone with the URL. In this skill context, users may upload internal documents for knowledge extraction, making silent publication especially risky.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented API surface extends beyond the skill's stated purpose of document import, knowledge-base construction, search, page generation, and publishing. Exposing note-taking and attachment-management capabilities gives an agent unnecessary access to unrelated user data and destructive operations, increasing the blast radius if the skill is misused or prompted into acting outside scope.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 1303)May include surrounding context.
请求示例

bash
curl -X POST https://www.2ryun.com/restapi/note/create \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"title": "灵感备忘", "content": "想到一个好点子..."}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 2ryun-api-spec.md (reported line 1346)May include surrounding context.
请求示例

bash
curl -X PUT https://www.2ryun.com/restapi/note/6a69810fef276a17f2fb0900 \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"title": "更新后的备忘", "content": "补充了更多细节"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The note deletion endpoint is documented without an explicit warning that user-authored content will be removed. In an agent workflow, that omission raises the risk of accidental data loss from mistaken intent interpretation or malicious prompt steering.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises create, update, delete, import, and publish-capable operations without prominently warning that these actions can alter or remove user data. In the context of a knowledge/content platform with automatic knowledge extraction and website publication, lack of explicit warnings and confirmation expectations makes accidental destructive or privacy-impacting actions more likely.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

1.7 删除文档

Tool Parameter Abuse

1.17 取消分享

Tool Parameter Abuse

2.8 删除条目

2.9 审核 Enrichment

Tool Parameter Abuse

3.8 删除生成记录

Tool Parameter Abuse

5.5 删除笔记

Missing User Warnings

Tool Parameter Abuse

6.5 删除附件

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Tool Parameter Abuse

External Transmission

External Transmission

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Description-Behavior Mismatch

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings