Security audit

智能接口工具箱

Security checks across malware telemetry and agentic risk

Overview

MockLab is a coherent local mock/API debugging tool, but it exposes unauthenticated network-accessible controls and arbitrary request forwarding that users should review before installing.

Install only if you are comfortable running a local API debugging server with broad control endpoints. Run it on a trusted machine or container, avoid exposing port 18080 to other devices, use test credentials only, do not proxy to untrusted URLs, and review exported schemas/state files for secrets before sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The server exposes unauthenticated CRUD endpoints that can create, modify, and delete project interfaces and persist those changes to disk. In an agent skill context, this exceeds passive mock serving and lets any caller alter future server behavior, creating integrity risks, persistence, and potential abuse as a stateful backdoor or sabotage mechanism.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The /mock/proxy endpoint accepts arbitrary target URLs and forwards outbound HTTP requests with caller-controlled method, headers, and body, which is classic SSRF behavior. In an agent-accessible environment this can be abused to reach internal services, cloud metadata endpoints, or other network resources that the user should not be able to access through the skill.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The UI accepts a user-supplied target URL and then issues browser-direct fetch requests to that destination, turning a mock/debugging tool into a generic outbound request client. In this skill context, that broadens data flow beyond mock generation and can be used to send request bodies and operator-supplied headers to arbitrary third-party endpoints, increasing exfiltration and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The interface allows arbitrary custom headers to be attached to forwarded requests with no visible restriction on header names or values. That can enable users to send sensitive, privileged, or misleading headers to arbitrary destinations, which is especially risky when combined with the free-form proxy URL feature.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README promotes request forwarding to real endpoints and adding custom Authorization headers, but does not warn users that the tool may transmit live credentials and sensitive request data to external or localhost services. In a skill explicitly designed to proxy requests and replay API traffic, this omission increases the risk of accidental data disclosure, misuse of production tokens, or unintended interaction with real systems.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README promotes a real proxy feature that forwards requests, including custom headers such as Authorization, to an arbitrary target address without any warning about credential disclosure, sensitive data transmission, or SSRF-style misuse. In a tool explicitly designed for debugging and request forwarding, this omission materially increases the chance that users will send tokens, session data, or internal API traffic to unintended destinations.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The import/export documentation describes sharing schema files with teammates but gives no warning that exported schemas may embed sensitive API definitions, example payloads, custom headers, endpoints, or state-linked values. This can lead to accidental leakage of internal integration details or reusable tokens when files are shared outside the intended trust boundary.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad and conversational, such as requests to mock an interface or connect to a third-party API, which can overlap with normal discussion and accidentally invoke the skill. Misfires are risky here because the skill can read documents, fetch URLs, write files, and launch a local service, so an unintended activation has meaningful side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill workflow includes sensitive operations—reading local files, fetching remote content, writing schemas, persisting state, starting a server, and opening a browser—but the instructions lack a centralized and explicit warning about these risks. Without a clear upfront notice, users may provide confidential API documentation or tokens and inadvertently expose them through storage, network retrieval, or local service interfaces.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger phrase "启动 MockLab" is broad and framed as a natural-language activation phrase, which increases the chance of unintended invocation during ordinary conversation. Because this skill can launch services, parse supplied documents, and initiate proxy behavior, accidental triggering could cause unexpected processing or network actions without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document promotes forwarding requests to real target addresses, including localhost or other endpoints, but does not warn that request contents may be sent to external or sensitive destinations. In an agent context, this creates SSRF-like and data exfiltration risk because users may unknowingly proxy secrets, internal API calls, or private test data to untrusted targets.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Supporting custom headers such as Authorization without warning users about credential handling creates a clear risk of secret leakage or unintended reuse of live tokens. When combined with proxy forwarding, these headers could be transmitted to attacker-controlled or misconfigured endpoints, exposing API keys, bearer tokens, or session credentials.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The export/share workflow for Schema files omits any notice that exported configurations may include sensitive endpoint details, field mappings, state references, or header settings. Sharing such files broadly could leak internal API structure, authentication-related configuration, or environment-specific integration details to unauthorized recipients.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The proxy forwards arbitrary headers and bodies to external destinations without guardrails or disclosure, enabling exfiltration of secrets placed in headers or request payloads. In an AI skill setting, users may not realize that sensitive tokens or data can be relayed to attacker-controlled endpoints through this feature.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The UI presents a proxy target field and send action without any explicit disclosure that request bodies and custom headers may be transmitted to an arbitrary external system. This creates a consent and data-handling risk because users may assume they are only interacting with local mock infrastructure while actually sending data off-platform.

Missing User Warnings

High

Confidence: 91% confidence
Finding: The clear-state control immediately issues a DELETE request to reset state without any confirmation prompt or warning about irreversible data loss. In a stateful mock/debugging tool, accidental activation could destroy test state and interfere with ongoing work or debugging sessions.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly supports pulling values from request bodies, path/query parameters, headers, and cross-call state into generated responses, which can include secrets or personal data. In a mock server context this is especially dangerous because developers often test with real tokens, identifiers, and customer data, so the server may inadvertently retain and disclose sensitive values across requests or to anyone who can access the local UI/service.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill instructs persistent storage of cross-interface state, including tokens such as accessToken, into a state file that survives restarts. Persisting authentication artifacts and related state materially increases exposure risk through filesystem access, accidental sharing, debugging logs, backups, or reuse in later sessions beyond the user's original intent.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The examples normalize echoing request body data and headers such as Authorization back into responses, which can directly leak credentials, session material, and sensitive user input. Because mock services are often shared across teams or exposed through local tunnels, reflected secrets can be captured in logs, browser tools, screenshots, or by other users hitting the endpoint.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.