ClawHub
Back to skill

Security audit

API文档生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation generator that uses provided API code, URLs, or interface descriptions to produce OpenAPI docs, SDK examples, mock server examples, and tests.

Before installing, expect the skill to generate API docs and runnable-looking SDK, curl, mock server, and test examples. Review any generated commands or code before running them against real services, especially examples involving tokens, POST/PUT/DELETE requests, or live API URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill explicitly requires Chinese output regardless of the user's preference, which overrides user autonomy and can cause the agent to ignore system/user language expectations. While not a direct code-execution or data-exfiltration issue, it is an instruction-quality and policy-compliance problem that can lead to misuse or degraded safety behavior in multilingual contexts.

Static analysis

No suspicious patterns detected.