Security audit

Openapi Docs Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple OpenAPI documentation helper with no hidden code execution, persistence, credential use, or data exfiltration behavior found.

Installers should understand that the skill may be auto-selected for broad API or developer-experience requests because its triggers are loose. It is otherwise a low-risk documentation helper; review generated OpenAPI specs and code edits as you normally would before applying them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence begins with generic phrasing like 'Help me' and then appends a long requirement description, which risks accidental activation from ordinary user language rather than a clearly scoped invocation. In an agent routing system, overly broad triggers can cause the wrong skill to run, leading to misrouting, prompt contamination across tools, or unintended handling of unrelated requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are extremely generic and effectively mirror broad user intents such as asking for help or a workflow, which increases the likelihood that the skill is invoked unintentionally or in the wrong context. In an agent system, overbroad routing can cause inappropriate capability activation, reduce user control, and lead to incorrect or unexpected handling of requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad and partially templated in a way that can match ordinary user requests about OpenAPI, Swagger, or API documentation without clear intent to invoke this specific skill. This increases the risk of unintended activation, causing the agent to apply the skill in inappropriate contexts and potentially override more suitable handling or user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description is broad enough to activate on generic software-and-data or API-related requests that may not specifically be about generating OpenAPI documentation. Over-broad activation can cause inappropriate skill selection, leading the agent to apply the wrong workflow, expose irrelevant capabilities, or interfere with more suitable safeguards or domain-specific skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The keyword list contains broad terms such as 'openapi', 'swagger', 'api documentation', and 'developer experience' without additional qualifiers, which increases the chance of accidental triggering on unrelated or only loosely related requests. In agent routing systems, imprecise keywords can expand the skill's authority beyond its intended purpose and degrade control over when specialized instructions are applied.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata says to use this skill whenever users mention broad terms like 'software-and-data', 'openapi', 'swagger', 'api documentation', or 'rest api', which are common in many unrelated conversations. This creates an overbroad activation surface that can cause the agent to invoke the skill in contexts the user did not intend, potentially steering outputs, overriding better-matched skills, or exposing the user to irrelevant workflow guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example trigger phrases are written as generic everyday requests like 'I need a practical workflow...' and 'Help me...', which overlap heavily with ordinary user dialogue. Because these examples can be matched accidentally, they increase the chance of unintended skill routing and prompt injection through normal conversation patterns rather than deliberate invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt is broad and generic, describing many common software tasks without clear activation boundaries. In combination with agent routing, this can cause the skill to be invoked for loosely related requests, increasing the chance of unintended prompt injection exposure, data handling beyond intended scope, or user confusion about why the skill activated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Implicit invocation is enabled even though the skill description and prompt are not tightly scoped. This makes accidental or overly broad auto-selection more likely, which expands the attack surface by allowing the skill to engage on partially related requests where adversarial user content or misrouting could influence behavior outside the intended OpenAPI documentation domain.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is ambiguous because it does not clearly define the activation boundary and instead mirrors a broad natural-language request template. This increases the chance that the skill is selected for loosely related backend or documentation questions, which can degrade safety and reliability by expanding the skill's effective scope beyond intended use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file lists separate English and Chinese skill/user guides, but does not state how the user's language preference is selected or whether the user can choose. Under the language/locale policy, documentation should make clear that language behavior is user-driven or otherwise justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This file is labeled as a Chinese README, but important descriptive and usage text is presented in English, including the core demand statement and trigger phrases. In a locale-specific document, this can violate language policy expectations by not offering a consistent user-language experience or explicit opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The example trigger sentences use generic phrasing like 'Help me' and 'I need a practical workflow' while embedding a truncated requirement statement, which does not clearly communicate activation boundaries. Although lower risk than the broader metadata fields, vague examples can still bias matching systems or maintainers toward over-permissive routing behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.