Smoke Test Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:51 AM UTC
• Version: 1.0.0

Overview

This skill is a live API smoke-test runner that can authenticate and trigger product-specific, state-changing workflows despite being presented as a generic smoke-test generator.

Review before installing or running. Use only against a disposable local or test environment unless you intentionally want the script to log in, create or cache content, and exercise live integration endpoints. Replace the hard-coded demo credentials with scoped test credentials and add an explicit opt-in for mutating or billable tests.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is described as a generic smoke test generator, but the included pattern is a hard-coded executor for specific endpoints like /login, /api/items, and /api/pipeline. This mismatch is dangerous because users may trust it as a safe, generic template while it actually encourages execution of product-specific requests that can authenticate, create records, and trigger integration workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares outbound network capability in metadata but does not define an explicit tool scope such as permissions or allowed-tools. That omission can cause the runtime or reviewer to underestimate what the skill is allowed to do, reducing transparency and increasing the chance of unintended HTTP access when the skill is invoked.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill promotes live HTTP smoke tests but does not clearly warn that several sample tests are state-changing, such as login attempts, item creation, and pipeline execution. In this context, that makes the skill more dangerous because 'smoke test' sounds low risk, yet running it against production or shared environments could modify data, consume external integrations, or trigger unintended workflows.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a skill that generates comprehensive smoke test suites for any HTTP API, but this file is a hard-coded executable smoke test for one specific application ('Sandman Tales') and its bespoke endpoints. The code validates domain-specific behaviors like story generation, audio assets, concierge chat, and named agents instead of generating reusable categorized tests from arbitrary API inputs.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script contains hard-coded credentials for a demo account and automatically submits them to the target service. Embedded credentials are dangerous because they may grant unauthorized access if reused elsewhere, encourage credential leakage through source control, and can be abused by anyone running the script against reachable environments.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The smoke test triggers state-changing content-generation workflows, including repeated orchestration calls and chat endpoints, instead of limiting itself to low-impact health verification. In a CI, shared, or production-like environment, this can consume paid third-party credits, create persistent data, and unintentionally exercise expensive or sensitive backend actions, making it more dangerous in the context of a reusable skill.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code sends data over the network to several application endpoints, including child-related prompt content and a family-related chat message, but the file contains no explicit warning or disclosure about transmitting that content to the target service. The surrounding comments describe test purpose, but they do not warn operators that sample prompt/chat data will be sent during execution.

Static analysis

No suspicious patterns detected.