Security audit

2Ryun Skill

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate 2Ryun API helper, but it gives an agent broad remote document, deletion, import, and public publishing authority without enough confirmation guidance.

Install only if you intend to let your agent operate your 2Ryun account. Use a least-privilege API key if available, avoid importing confidential files unless you want them processed by 2Ryun, and require the agent to confirm exact resource names before any delete, update, import with extraction, or public publish action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The spec documents a destructive document-deletion endpoint without any explicit user-confirmation or safety guidance. In an agentic context, this increases the risk of accidental or prompt-induced deletion of user data, especially because document trees and downstream knowledge-base workflows may depend on the removed item.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Publishing generated pages makes content publicly accessible without an API key, but the spec does not foreground this as a high-visibility disclosure action. In this skill's context, documents may be imported and auto-extracted into a knowledge base, so an agent could accidentally publish sensitive internal material to a world-readable URL.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The site-deletion endpoint notes that associated generated pages can also be deleted, but it does not present this as a destructive operation requiring heightened caution. In agent workflows, this can cause unintended loss of published assets and break public URLs, producing both data-loss and availability impact.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Publishing a site exposes it publicly, yet the spec does not strongly warn that this changes confidentiality boundaries. Because this skill is explicitly about document import, knowledge extraction, and site generation, the context makes accidental publication particularly dangerous: internal docs can be transformed into a public website with a single agent action.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The note deletion endpoint is destructive and lacks explicit safety guidance, which can lead to accidental loss in agent-driven interactions. The impact is lower than document/site deletion because notes are narrower in scope and are not fed into the knowledge-base pipeline, but user data loss remains possible.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README instructs users to invoke the skill with very broad phrases such as "knowledge base" or "build a site," which can cause the skill to activate in contexts unrelated to 2Ryun. Because this skill performs remote document and publishing operations using an API key, unintended invocation increases the chance of accidental data import, modification, or site publication.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description and setup text describe storing an API key and using remote document-management capabilities, but they do not warn users that the skill may read, import, update, delete, search, or publish content to an external service. In this context, the omission is security-relevant because users may invoke the skill without understanding that sensitive documents and credentials are involved, increasing the risk of unintended data exposure or destructive remote actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to import files and publish generated sites publicly, but it does not require an explicit user-facing warning or confirmation about privacy, confidentiality, or public exposure. This creates a real risk that sensitive uploaded documents or knowledge-derived content could be unintentionally exposed through import, automatic extraction, or publication workflows.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ### 场景 1.3：更新 / 删除 - `PUT /restapi/documents/update/:id -d '{"title":"...","content":"..."}'` - `DELETE /restapi/documents/delete/:id` ---
Confidence: 79% confidence
Finding: DELETE /restapi/documents/delete/:id`

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - `GET /restapi/note?page=1&pageSize=20` — 笔记列表 - `GET /restapi/note/:id` — 获取单篇 - `PUT /restapi/note/update/:id -d '{"title":"...","content":"..."}'` — 更新 - `DELETE /restapi/note/delete/:id` — 删除 **笔记 vs 文档**：笔记**不进入知识库**，没有 `wikiAutoExtract` 设置。适合临时内容、随手记、灵感备忘。需要长期保存并进入知识库的内容用文档。
Confidence: 79% confidence
Finding: DELETE /restapi/note/delete/:id`

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: 2ryun-api-spec.md:10