API文档生成器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.5.1

Overview

This is a documentation-generation skill with some unsafe example commands users should review, but no hidden execution, persistence, or data theft behavior in the artifacts.

Before using generated examples, replace placeholder package names and URLs with verified official packages/endpoints, avoid global installs when possible, pin versions, and do not paste real bearer tokens into docs, logs, shell history, or shared files. Confirm DELETE examples target test resources before running them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:427

Finding

Unpinned Placeholder SDK Packages Create Dependency-Confusion Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 427–428
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install example-api-sdk    # Python
npm install example-api-sdk   # JavaScript

Technical Analysis

The Skill's generated quick-start template instructs users to install example-api-sdk directly from public package registries. The apparent placeholder package name is presented as an executable command without an exact version, integrity verification, lockfile, provenance validation, or warning that it must be replaced with a verified package.

The API-document generation function does not require installing an SDK. Including these commands therefore exceeds the minimum privileges and dependencies needed for the declared functionality.

Package installation can execute attacker-controlled setup or lifecycle scripts. If an attacker publishes, takes over, or compromises a package matching this generic name, users following the generated documentation may execute malicious code. The audit did not establish that the referenced packages are currently malicious; the vulnerability is the unsafe installation pattern and resulting dependency-confusion exposure.

Attack Path

1. An attacker publishes or compromises a package named example-api-sdk in the relevant Python or npm registry.
2. The Skill generates documentation containing the installation commands.
3. A user copies and executes one of the commands without independently verifying the package.
4. The package manager downloads the attacker-controlled package and executes any applicable installation or lifecycle hooks.
5. The malicious package runs with the installing user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation may provide arbitrary code execution under the user's account. Depending on the en ...[truncated 437 chars]

Remediation

View remediation

Remediation Suggestions

• Remove executable installation commands for placeholder packages.
• Do not require SDK installation for the core documentation-generation workflow.
• Replace placeholders only after identifying and validating the API provider's official package.
• Pin dependencies to reviewed exact versions rather than allowing automatic selection of the latest release.
• Use lockfiles and registry-supported integrity verification where available.
• Clearly label illustrative package names as non-executable placeholders.
• Require explicit user confirmation before recommending any third-party installation.
• Prefer generated standalone examples that use an already approved HTTP client instead of introducing a new SDK dependency.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:511

Finding

Unpinned Global npm Installation Exposes Users to Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 511
Vulnerability Type: Unpinned global third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g mock-server
mock-server start --port 3000 --spec ./api_doc.yaml

Technical Analysis

The output template directs users to install mock-server globally from the npm registry and then execute its command. No exact version, integrity control, package provenance check, or publisher verification is specified.

A global installation modifies the user's broader tool environment rather than keeping the dependency isolated to the generated project. This is unnecessary for merely generating API documentation and exceeds the minimum dependency scope required by the Skill.

npm packages may run lifecycle scripts during installation. The installed executable is then invoked directly, creating a second execution opportunity. If the package, one of its transitive dependencies, or the resolved release is compromised, attacker-controlled code may execute under the installing user's privileges. The audit did not determine that mock-server is currently malicious; the confirmed issue is the unsafe, unpinned, global installation instruction.

Attack Path

1. An attacker compromises the selected package release or a transitive dependency, or obtains control of the referenced package.
2. The Skill generates the global installation instruction as part of its standard output.
3. A user executes npm install -g mock-server.
4. npm downloads the package and may execute attacker-controlled lifecycle scripts.
5. The user subsequently runs mock-server, executing the installed package's code.
6. The compromised code operates with the user's privileges and can access the user's files, credentials, network, and globally installed tool locations.

Impact Assessment

Successful exploitation may lead to arbitrary code execution ...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the global installation command from the generated template.
• Use a reviewed project-local development dependency rather than npm install -g.
• Pin the package to an approved exact version and commit a lockfile with integrity metadata.
• Verify package ownership, provenance, maintenance status, and transitive dependencies before recommending it.
• Run Mock tooling with least privilege in an isolated development environment or container.
• Require explicit user approval before installing or executing third-party tools.
• Prefer generating Mock-server source code that users can review and run with their existing approved dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (23)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/details.md (reported line 128)May include surrounding context.

md

res.json({ id: userId, name, email, updated: true });
});

// 删除用户 DELETE /api/users/:id
app.delete('/api/users/:id', (req, res) => {
  const userId = parseInt(req.params.id);
  res.json({ id: userId, deleted: true });

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/details.md (reported line 492)May include surrounding context.

md

✅ GET /api/users/123      # 获取指定用户
✅ POST /api/users         # 创建用户
✅ PUT /api/users/123      # 更新用户
✅ DELETE /api/users/123   # 删除用户

❌ GET /api/getUser?id=123
❌ POST /api/user/create

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 236)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 443)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 447)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 453)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 459)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 500)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 501)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

cURL示例：

bash

# 获取用户列表
curl -X GET "https://api.example.com/v1/users?page=1&size=10" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 555)May include surrounding context.

示例2：URL链接解析生成文档

text

**输入**：https://api.github.com/users/{username}

**输出**：
- GitHub用户API完整文档

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill hard-codes '中文文档' as the output language without presenting it as a default or allowing user override. This reduces user control and can cause the agent to ignore explicit user preferences or system locale, which is a policy/compliance issue even though it is not a direct code-execution or data-exfiltration flaw.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents DELETE endpoints and client delete methods, including concrete deletion examples, but does not include any warning that these operations are destructive or may permanently remove user data. Under the markdown criteria, behaviors affecting user data should be accompanied by warnings about data or system impact.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 352)May include surrounding context.

md

def create_user(self, name: str, email: str) -> dict:
        """创建用户"""
        response = requests.post(
            f'{self.base_url}/api/users',
            headers=self.headers,
            json={'name': name, 'email': email}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 362)May include surrounding context.

md

def update_user(self, user_id: int, **kwargs) -> dict:
        """更新用户"""
        response = requests.put(
            f'{self.base_url}/api/users/{user_id}',
            headers=self.headers,
            json=kwargs

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 440)May include surrounding context.

console.log(用户名: ${user.name});

text

### cURL 示例
```bash
# 获取用户
curl -X GET "https://api.example.com/api/users/123" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The SDK and cURL sections show transmission of bearer tokens and user profile data over HTTP requests, but the markdown does not warn users to protect tokens, avoid exposing them in logs/history, or use trusted HTTPS endpoints. For markdown files, omissions of warnings about behaviors affecting privacy or system integrity should be flagged when such operations are demonstrated.

Content

No source excerpt is available for this finding.