API文档生成器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:31 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent API documentation generator, but users should verify generated network and install commands before running them.

Install is acceptable for normal use. Before using generated output, do not blindly run generated cURL, SDK, DELETE, npm, or pip commands against production systems; confirm URLs, tokens, package publishers, and target resource IDs, and prefer test environments for examples.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:427

Finding

Unverified and Unpinned Third-Party Package Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 427–428 and line 511
Vulnerability Type: Supply-chain exposure through ambiguous, unpinned package installation
Risk Level: Medium

Vulnerable Code

Lines 427–428:

bash

pip install example-api-sdk    # Python
npm install example-api-sdk   # JavaScript

Line 511:

bash

npm install -g mock-server

Technical Analysis

The Skill requires generated documentation to include installation commands for packages that are not pinned to exact versions and are not associated with a verified publisher, integrity hash, lockfile, or trusted registry. The name example-api-sdk appears to be a placeholder, but the generated command is directly executable. If that name exists or is later registered in a public package registry, a user could unintentionally install an unrelated or malicious package.

The mock-server command creates additional risk because it requests a global installation. Package installation can execute lifecycle hooks under the privileges of the invoking user. A compromised, attacker-controlled, or dependency-confused package could therefore run arbitrary code during installation.

These installations are not required to perform the Skill's declared core function of generating API documentation and examples. Mandating them in generated output exceeds the minimum dependency privileges necessary for that function.

Attack Path

1. The Skill generates API documentation using its prescribed quick-start or mock-server template.
2. The generated documentation presents an unpinned pip install or npm install command as an expected setup step.
3. A user copies and executes the command without separately verifying the package owner or contents.
4. The package manager resolves the name from a public or otherwise configured registry.
5. An attacker-controlled, compromised, or incorrectly resolved package is downloaded.
6. Pa ...[truncated 945 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove executable installation commands for placeholder packages such as example-api-sdk.
2. Generate installation commands only when the package name and publisher are derived from user-confirmed project metadata.
3. Pin dependencies to reviewed exact versions rather than allowing unconstrained resolution.
4. Where supported, provide lockfiles or cryptographic integrity hashes.
5. Require packages to come from an explicitly trusted registry and document how users can verify the publisher.
6. Replace npm install -g mock-server with a project-local, version-pinned development dependency from a verified source.
7. Recommend isolated environments, such as Python virtual environments or disposable containers.
8. Clearly label all sample commands as templates and require explicit user confirmation before any package installation.
9. Prefer generating mock-server code that uses dependencies already present in the target project rather than introducing a mandatory package.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (23)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/details.md (reported line 128)May include surrounding context.

md

res.json({ id: userId, name, email, updated: true });
});

// 删除用户 DELETE /api/users/:id
app.delete('/api/users/:id', (req, res) => {
  const userId = parseInt(req.params.id);
  res.json({ id: userId, deleted: true });

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/details.md (reported line 492)May include surrounding context.

md

✅ GET /api/users/123      # 获取指定用户
✅ POST /api/users         # 创建用户
✅ PUT /api/users/123      # 更新用户
✅ DELETE /api/users/123   # 删除用户

❌ GET /api/getUser?id=123
❌ POST /api/user/create

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly accepts a user-provided URL as input and even gives a live URL example, but it does not warn that processing such input may require fetching remote content. In an agent setting, this creates SSRF and unintended data exfiltration risk because users may induce the agent to contact internal services, cloud metadata endpoints, or attacker-controlled hosts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 236)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 443)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 447)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 453)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 459)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 500)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 501)May include surrounding context.

md

version: 版本号
  description: API描述
servers:
  - url: https://api.example.com/v1
    description: 生产环境
  - url: https://api-staging.example.com/v1
    description: 测试环境

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

cURL示例：

bash

# 获取用户列表
curl -X GET "https://api.example.com/v1/users?page=1&size=10" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Unlike the placeholder examples, this section explicitly says a URL link can be used as input and gives a real third-party API URL as an example output source. In the context of a skill that processes user-provided URLs, this reinforces a behavior where the agent may fetch arbitrary remote resources, increasing SSRF, prompt injection via remote content, and data leakage risk.

Content

Scanner excerpt · SKILL.md (reported line 555)May include surrounding context.

示例2：URL链接解析生成文档

text

**输入**：https://api.github.com/users/{username}

**输出**：
- GitHub用户API完整文档

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file explicitly fixes the output language to Chinese ('中文文档') rather than offering a language choice. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 352)May include surrounding context.

md

def create_user(self, name: str, email: str) -> dict:
        """创建用户"""
        response = requests.post(
            f'{self.base_url}/api/users',
            headers=self.headers,
            json={'name': name, 'email': email}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 362)May include surrounding context.

md

def update_user(self, user_id: int, **kwargs) -> dict:
        """更新用户"""
        response = requests.put(
            f'{self.base_url}/api/users/{user_id}',
            headers=self.headers,
            json=kwargs

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/details.md (reported line 440)May include surrounding context.

console.log(用户名: ${user.name});

text

### cURL 示例
```bash
# 获取用户
curl -X GET "https://api.example.com/api/users/123" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes a cURL example for deleting a user resource, but it does not warn that the operation is destructive and may permanently remove data. Under the markdown-specific SQP-2 criteria, user-facing documentation should disclose behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.