Security audit

Code Documenter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent documentation helper, but some interactive API documentation templates normalize risky credential persistence, credentialed browser requests, mutable remote scripts, and unpinned package execution without enough warning or scoping.

Install only if you are comfortable reviewing generated documentation-site and interactive API portal configs before use. Pin package and CDN versions, avoid mutable latest URLs, disable persisted API authorization unless there is a controlled need, avoid sending browser credentials from try-it consoles by default, and add clear notices before collecting search analytics, uploading files, or logging account data.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T08 · Insecure Dependencies

Warning

Location: references/documentation-systems.md:7
Finding: Execution of an Unpinned Docusaurus Package
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/coverage-reports.md:104
Finding: Unpinned Documentation Tool Installation Commands
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/documentation-systems.md:187
Finding: Mutable Third-Party JavaScript Loaded into Documentation Pages
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/interactive-api-docs.md:162
Finding: Unpinned Redoc Runtime Loaded from a Remote CDN
Content: View full analysis
API Documentation ``` ### Technical Analysis The Redoc script explicitly uses the mutable `latest` path and has no Subresource Integrity metadata. Every page load therefore retrieves code whose contents can change independently of the audited Skill and deployed documentation source. Loading Redoc is functionally relevant to interactive API documentation, but using an unpinned remote executable asset exceeds the minimum trust necessary. The external font stylesheet also introduces a third-party request, although the executable JavaScript is the primary security concern. ### Attack Path 1. The generated API portal uses the supplied Redoc template. 2. A visitor loads the portal. 3. The browser retrieves `redoc.standalone.js` from the remote `latest` URL. 4. The CDN or upstream release is compromised or replaced. 5. The modified script runs in the portal's browser context. 6. It can alter the API specification display, capture user interactions, access origin-visible data, or send requests to attacker-controlled services. ### Impact Assessment A successful compromise affects visitors to the generated API portal. Potential impact includes documentation tamp ...[truncated 249 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/interactive-api-docs.md:137
Finding: Persistent Storage of Interactive API Authorization Credentials
Content: View full analysis
{ req.headers['X-Custom-Header'] = 'value'; return req; }, }, }; ``` ### Technical Analysis Enabling `persistAuthorization` causes Swagger UI authorization data to survive page reloads through browser-side storage. This lengthens the lifetime of API keys or bearer tokens beyond the immediate interactive session. Persistence is not required for the core purpose of displaying or testing API documentation. It increases exposure on shared systems and compounds the impact of cross-site scripting, compromised remote scripts, malicious browser extensions, or other code capable of reading relevant browser storage. The Skill does not contain code that directly exfiltrates these credentials. The vulnerability is the unsafe default configuration recommended for generated portals. ### Attack Path 1. A user enters an API key or bearer token into Swagger UI. 2. Swagger UI persists the authorization value in browser storage. 3. The user reloads or leaves the documentation portal, but the authorization state remains. 4. An attacker gains script execution in the portal, compromises a loaded dependency, uses a malicious extension, or accesses the same shared browser profile. 5. The attacker retrieves or reuses the stored authorization value. 6. The token is used against API operations permitted by its assigned scope. ### Impact Assessment The obtainable privileges are those granted to the persisted API credential. With a production o ...[truncated 243 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/user-guides-tutorials.md (reported line 284)May include surrounding context.
const tokens = await client.oauth.exchangeCode(code);

text
3. Use the access token: ```typescript const client = new Client({ accessToken: tokens.access_token });

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list contains very broad terms such as 'documentation', 'comments', and 'tutorials', which can cause the skill to be invoked in many unrelated contexts. Over-broad invocation increases the chance that a documentation-writing skill is selected when a more appropriate or safer skill should handle the task, leading to unintended actions or context misuse.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
- Generate coverage report ### MUST NOT DO - Assume docstring format without asking - Apply wrong API doc strategy for framework - Write inaccurate or untested documentation - Skip error documentation

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The custom analytics example captures documentation search queries, result counts, and timestamps without any accompanying notice about telemetry, retention, or consent expectations. Search queries can contain sensitive internal terms, error strings, names, or secrets pasted by users, so normalizing this pattern in a documentation skill can lead to privacy and compliance issues when adopted verbatim.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/interactive-api-docs.md (reported line 85)May include surrounding context.
md
type: oauth2 flows: authorizationCode: authorizationUrl: https://api.example.com/oauth/authorize tokenUrl: https://api.example.com/oauth/token scopes: read:users: Read user data

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/interactive-api-docs.md (reported line 86)May include surrounding context.
md
type: oauth2 flows: authorizationCode: authorizationUrl: https://api.example.com/oauth/authorize tokenUrl: https://api.example.com/oauth/token scopes: read:users: Read user data

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Swagger UI example explicitly enables persistAuthorization: true, which causes auth tokens to remain stored in the browser across page reloads/sessions. In interactive API docs this increases the chance of credential leakage on shared workstations or accidental reuse of privileged tokens, especially because the documentation does not warn users about retained auth state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The Stoplight Elements example sets tryItCredentialsPolicy="include", which can cause browser/session credentials such as cookies or HTTP auth to be sent with interactive requests. Without an explicit warning, users may unknowingly execute authenticated actions against real environments, increasing risk of CSRF-like misuse, unintended state changes, or exposure of privileged session context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The how-to guide instructs readers to select a file from the local system and upload it with client.files.upload(formData), but it does not explicitly warn that the file contents will be transmitted to the service and stored remotely. In markdown guidance, behaviors affecting user data or privacy should be clearly disclosed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file includes a quick-start example that calls client.users.list() and instructs the user to print and inspect returned user data, but it does not warn that the response may contain real account data. For markdown files, user-facing descriptions should disclose behaviors that can affect privacy or user data handling.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/user-guides-tutorials.md:286