Security audit

api-caller

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed REST API helper, but users should be careful with its optional local learning log and any API data or tokens they provide.

Install only if you want an agent-assisted REST API command helper. Provide API tokens through named environment variables, review the destination URL and payload before calls, avoid saving sensitive responses unless needed, and either skip the learner module or keep secrets, PII, tokens, and private endpoint details out of its notes/preferences.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly describes capabilities that access environment variables, perform network requests, and write files, yet no explicit permission declaration is present. That mismatch weakens reviewability and can cause the skill to be invoked with broader operational behavior than users or platform policy expect, especially because it handles secrets and persists outputs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as an API-calling helper, but it also includes a separate learner/insight/reflect system that records usage history and error patterns persistently. That undocumented telemetry-like behavior expands the data handling surface beyond the stated purpose and could collect or retain sensitive operational context without clear user consent.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Embedding self-evolution/learning commands inside an API helper introduces functionality unrelated to making HTTP requests and encourages persistent recording of task history. In this context, the extra subsystem is more dangerous because the skill already processes tokens, endpoints, response bodies, and error details that may contain sensitive data.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documented learner capability is not justified by the stated purpose of an API request helper, creating unnecessary persistence and behavioral expansion. Unjustified capability creep is risky because users may authorize a networking tool without expecting long-term storage or post-hoc profiling of failures, preferences, or usage patterns.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file implements a generic cross-skill learning/telemetry component that is unrelated to the declared purpose of an API-calling helper. In this ecosystem, that mismatch is dangerous because it creates a hidden persistence and profiling capability that can be invoked across skills, increasing the chance of unauthorized collection of user behavior and expansion of the skill’s effective scope beyond what users expect.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code persistently stores user preferences, capability usage history, notes, and recurring error patterns in learned_patterns.json. Even though it is local, this creates behavior profiling and data retention unrelated to the API-caller’s stated function, and free-form notes may capture sensitive tokens, prompts, endpoint details, or personal information that later becomes accessible to other components or users on the same system.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrasing is broad enough to match common requests such as '写个请求脚本' or '对接某开放平台', which can cause accidental invocation. Because the skill performs network access, reads secrets from environment variables, and writes outputs, over-broad activation increases the chance of unintended external requests or data handling.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The documentation explains operational details but does not prominently warn users that the skill may send data over the network and save responses to disk. In a networked skill that handles tokens and potentially sensitive API payloads, missing disclosure can lead to unsafe user assumptions and unintentional exposure.

Static analysis

No suspicious patterns detected.