Code Documenter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:40 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent documentation helper, but some interactive API documentation templates normalize risky credential persistence, credentialed browser requests, mutable remote scripts, and unpinned package execution without enough warning or scoping.

Install only if you are comfortable reviewing generated documentation-site and interactive API portal configs before use. Pin package and CDN versions, avoid mutable latest URLs, disable persisted API authorization unless there is a controlled need, avoid sending browser credentials from try-it consoles by default, and add clear notices before collecting search analytics, uploading files, or logging account data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T08 · Insecure Dependencies

Warning

• Location: references/documentation-systems.md:7
• Finding: Execution of an Unpinned Docusaurus Package<![CDATA[ ## Vulnerability Details **File Location**: `references/documentation-systems.md:7-10` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash # Setup npx create-docusaurus@latest docs classic cd docs && npm start ``` ### Technical Analysis The documented setup command instructs users or an executing agent to retrieve and immediately run the mutable `latest` version of `create-docusaurus`. The effective code therefore can change after the Skill has been reviewed. `npx` may download package code and execute its entry point with the invoking user's permissions. Package installation scripts and transitive dependencies may also run. Although this behavior is relevant to creating a documentation site, automatically executing an unpinned package is not the minimum privilege required to generate documentation. No evidence indicates that the referenced package is currently malicious. The risk arises from mutable remote code, package-registry compromise, account takeover, and compromised transitive dependencies. ### Attack Path 1. An agent follows the documentation-site setup guidance. 2. The agent runs `npx create-docusaurus@latest docs classic`. 3. `npx` resolves the package and dependencies from the configured package registry. 4. A compromised or unexpectedly changed release is downloaded. 5. Package code or lifecycle scripts execute with the user's local permissions. 6. Malicious code could access files, environment variables, network credentials, or source repositories available to that user. ### Impact Assessment Successful exploitation would provide code execution under the account running `npx`. The accessible scope could include the current project, user-readable files, environment variables, package-registry credentials, and other resources available to the invoking process. The command does not itself request elevated operating-system privileges, so its direct privilege boundary is ...[truncated 34 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `@latest` with an exact, reviewed version, such as `create-docusaurus@x.y.z`. - Record the selected version in a lockfile and review lockfile changes. - Require explicit user approval before downloading or executing packages. - Use a trusted registry and package-manager integrity verification. - Run scaffolding tools in a restricted container or sandbox without production secrets. - Disable package lifecycle scripts where feasible during dependency review. - Periodically scan direct and transitive dependencies for known vulnerabilities. ]]>

T08 · Insecure Dependencies

Note

• Location: references/coverage-reports.md:104
• Finding: Unpinned Documentation Tool Installation Commands<![CDATA[ ## Vulnerability Details **File Location**: `references/coverage-reports.md:104-115` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```bash # JavaScript/TypeScript - ESLint npm install eslint-plugin-jsdoc --save-dev # Add to .eslintrc: "plugins": ["jsdoc"] # Python - pydocstyle pip install pydocstyle pydocstyle --convention=google src/ # Python - interrogate (coverage) pip install interrogate interrogate -v src/ ``` ### Technical Analysis These commands install mutable package versions without exact version constraints. The package manager may resolve a newer release than the one assessed when the Skill was published. Installation may also introduce mutable transitive dependencies, and npm packages can define lifecycle scripts that execute during installation. The packages are relevant to documentation linting and coverage, and no evidence shows that the named packages are malicious. The issue is the absence of version pinning, lockfile requirements, integrity controls, and an approval boundary before installation. ### Attack Path 1. A user or agent follows the coverage-report instructions. 2. The package manager resolves current package versions from a registry. 3. A compromised package release, maintainer account, registry response, or transitive dependency is selected. 4. The package is installed; applicable lifecycle scripts execute. 5. Later commands import or execute the installed package. 6. Malicious package code runs with the invoking user's permissions. ### Impact Assessment Potential impact includes local code execution, modification of project files, access to user-readable files and environment variables, and outbound network access. The scope is limited to permissions held by the process performing installation; no explicit privilege escalation is present. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin each tool to a reviewed exact version. - For npm, commit and enforce a lockfile and use `npm ci` in automated environments. - For Python, use a hash-locked requirements file, such as one generated with `pip-compile --generate-hashes`. - Require user confirmation before changing project dependencies. - Run documentation tooling in a sandbox with minimal filesystem and network access. - Review package provenance, maintainers, lifecycle scripts, and transitive dependency changes. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/documentation-systems.md:187
• Finding: Mutable Third-Party JavaScript Loaded into Documentation Pages<![CDATA[ ## Vulnerability Details **File Location**: `references/documentation-systems.md:187-193` **Vulnerability Type**: Remote payload retrieval in generated documentation **Risk Level**: Medium ### Vulnerable Code ```html <!-- Add to theme --> <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@docsearch/css@3" /> <script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3"></script> <script> docsearch({ appId: 'YOUR_APP_ID', apiKey: 'YOUR_API_KEY', ``` ### Technical Analysis The template loads JavaScript directly from a third-party CDN using a major-version selector rather than an immutable artifact. It does not specify Subresource Integrity. Consequently, the JavaScript that executes in the documentation origin can change after the generated site has been reviewed or deployed. The placeholder Algolia values are not real secrets, and the audit found no credential-exfiltration logic in the Skill itself. However, a compromised CDN response or upstream package release could execute arbitrary browser code within the documentation page. ### Attack Path 1. A documentation site incorporates the provided template. 2. A visitor opens the documentation page. 3. The browser requests the DocSearch script from the third-party CDN. 4. The CDN, package release, DNS path, or upstream account is compromised. 5. A modified script executes in the documentation page. 6. The script accesses page-visible data, browser storage available to the origin, or authenticated documentation functions and transmits that data externally. ### Impact Assessment Impact is primarily limited to users visiting the affected documentation site. A malicious script could alter displayed API guidance, capture data entered into the page, issue same-origin requests using the visitor's browser session, or access origin-scoped storage. The exact scope depends on the documentation site's origin isolation, Content Security Policy, and authentication design. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin CDN resources to exact immutable versions. - Add a verified `integrity` attribute and `crossorigin="anonymous"` to external assets. - Prefer self-hosting reviewed JavaScript and CSS artifacts. - Deploy a restrictive Content Security Policy that limits `script-src`, `connect-src`, and other relevant directives. - Isolate public documentation from administrative and production application origins. - Avoid exposing production credentials or privileged browser sessions to pages that execute third-party scripts. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/interactive-api-docs.md:162
• Finding: Unpinned Redoc Runtime Loaded from a Remote CDN<![CDATA[ ## Vulnerability Details **File Location**: `references/interactive-api-docs.md:162-186` **Vulnerability Type**: Remote mutable JavaScript execution **Risk Level**: Medium ### Vulnerable Code ```html <!DOCTYPE html> <html> <head> <title>API Documentation</title> <link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet"> </head> <body> <redoc spec-url='./openapi.yaml' hide-download-button required-props-first native-scrollbars theme='{ "colors": { "primary": { "main": "#4285F4" } }, "typography": { "fontSize": "16px", "fontFamily": "Roboto, sans-serif" } }'> </redoc> <script src="https://cdn.redoc.ly/redoc/latest/bundles/redoc.standalone.js"></script> </body> </html> ``` ### Technical Analysis The Redoc script explicitly uses the mutable `latest` path and has no Subresource Integrity metadata. Every page load therefore retrieves code whose contents can change independently of the audited Skill and deployed documentation source. Loading Redoc is functionally relevant to interactive API documentation, but using an unpinned remote executable asset exceeds the minimum trust necessary. The external font stylesheet also introduces a third-party request, although the executable JavaScript is the primary security concern. ### Attack Path 1. The generated API portal uses the supplied Redoc template. 2. A visitor loads the portal. 3. The browser retrieves `redoc.standalone.js` from the remote `latest` URL. 4. The CDN or upstream release is compromised or replaced. 5. The modified script runs in the portal's browser context. 6. It can alter the API specification display, capture user interactions, access origin-visible data, or send requests to attacker-controlled services. ### Impact Assessment A successful compromise affects visitors to the generated API portal. Potential impact includes documentation tamp ...[truncated 249 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `/latest/` with an exact, reviewed Redoc version. - Self-host the pinned bundle where practical. - Add Subresource Integrity if a CDN must be used. - Apply a restrictive Content Security Policy and tightly limit outbound connections. - Host interactive API documentation on an origin isolated from privileged application sessions. - Establish a controlled dependency-update process that reviews and tests new Redoc versions before deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/interactive-api-docs.md:137
• Finding: Persistent Storage of Interactive API Authorization Credentials<![CDATA[ ## Vulnerability Details **File Location**: `references/interactive-api-docs.md:137-154` **Vulnerability Type**: Unsafe persistence of API authorization material **Risk Level**: Medium ### Vulnerable Code ```javascript const options = { customCss: '.swagger-ui .topbar { display: none }', customSiteTitle: "API Docs", customfavIcon: "/favicon.ico", swaggerOptions: { persistAuthorization: true, displayRequestDuration: true, filter: true, tryItOutEnabled: true, requestInterceptor: (req) => { req.headers['X-Custom-Header'] = 'value'; return req; }, }, }; ``` ### Technical Analysis Enabling `persistAuthorization` causes Swagger UI authorization data to survive page reloads through browser-side storage. This lengthens the lifetime of API keys or bearer tokens beyond the immediate interactive session. Persistence is not required for the core purpose of displaying or testing API documentation. It increases exposure on shared systems and compounds the impact of cross-site scripting, compromised remote scripts, malicious browser extensions, or other code capable of reading relevant browser storage. The Skill does not contain code that directly exfiltrates these credentials. The vulnerability is the unsafe default configuration recommended for generated portals. ### Attack Path 1. A user enters an API key or bearer token into Swagger UI. 2. Swagger UI persists the authorization value in browser storage. 3. The user reloads or leaves the documentation portal, but the authorization state remains. 4. An attacker gains script execution in the portal, compromises a loaded dependency, uses a malicious extension, or accesses the same shared browser profile. 5. The attacker retrieves or reuses the stored authorization value. 6. The token is used against API operations permitted by its assigned scope. ### Impact Assessment The obtainable privileges are those granted to the persisted API credential. With a production o ...[truncated 243 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Set `persistAuthorization: false` by default. - Clearly warn users not to enter production or broadly privileged credentials into documentation portals. - Use short-lived, revocable, least-privilege test tokens for interactive documentation. - Automatically clear authorization state on logout, timeout, and page closure where feasible. - Isolate the portal from production application origins and third-party executable scripts. - Enforce strong Content Security Policy controls and routinely test the portal for cross-site scripting. - Configure server-side token expiration, audience restrictions, and narrowly scoped permissions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

const tokens = await client.oauth.exchangeCode(code);
```

3. Use the access token:
```typescript
const client = new Client({ accessToken: tokens.access_token });
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list contains very broad terms such as 'documentation', 'comments', and 'tutorials', which can cause the skill to be invoked in many unrelated contexts. Over-broad invocation increases the chance that a documentation-writing skill is selected when a more appropriate or safer skill should handle the task, leading to unintended actions or context misuse.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Generate coverage report

### MUST NOT DO
- Assume docstring format without asking
- Apply wrong API doc strategy for framework
- Write inaccurate or untested documentation
- Skip error documentation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The custom analytics example captures documentation search queries, result counts, and timestamps without any accompanying notice about telemetry, retention, or consent expectations. Search queries can contain sensitive internal terms, error strings, names, or secrets pasted by users, so normalizing this pattern in a documentation skill can lead to privacy and compliance issues when adopted verbatim.

External Transmission

Medium

• Category: Data Exfiltration

Content

type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://api.example.com/oauth/authorize
          tokenUrl: https://api.example.com/oauth/token
          scopes:
            read:users: Read user data

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://api.example.com/oauth/authorize
          tokenUrl: https://api.example.com/oauth/token
          scopes:
            read:users: Read user data

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Swagger UI example explicitly enables `persistAuthorization: true`, which causes auth tokens to remain stored in the browser across page reloads/sessions. In interactive API docs this increases the chance of credential leakage on shared workstations or accidental reuse of privileged tokens, especially because the documentation does not warn users about retained auth state.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The Stoplight Elements example sets `tryItCredentialsPolicy="include"`, which can cause browser/session credentials such as cookies or HTTP auth to be sent with interactive requests. Without an explicit warning, users may unknowingly execute authenticated actions against real environments, increasing risk of CSRF-like misuse, unintended state changes, or exposure of privileged session context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The how-to guide instructs readers to select a file from the local system and upload it with `client.files.upload(formData)`, but it does not explicitly warn that the file contents will be transmitted to the service and stored remotely. In markdown guidance, behaviors affecting user data or privacy should be clearly disclosed.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file includes a quick-start example that calls `client.users.list()` and instructs the user to print and inspect returned user data, but it does not warn that the response may contain real account data. For markdown files, user-facing descriptions should disclose behaviors that can affect privacy or user data handling.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/user-guides-tutorials.md:286