Java Api Extractor

• Outcome: Review
• Latest audit: Jun 17, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

This skill mostly does what it claims, but it can persist extracted API data outside the chosen output path and documents external publishing workflows without enough safeguards.

Install only if you are comfortable letting it scan the specified Java project and generate API metadata. Use local-only extraction first, disable backups with --no-backup, review the JSON before sharing it, and do not use --push or the CI/Git hook examples unless you have confirmed the destination, authorization, and data classification rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation exposes capabilities to read local project files, write output files, and invoke shell-based scripts, yet no explicit permissions are declared. This creates a trust gap where an agent or user may underestimate the skill’s access and side effects, especially since the examples include writing artifacts and invoking helper scripts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is simple API extraction, but the documented behavior includes reading local templates, writing backups to fixed locations, and invoking external push scripts to transmit extracted data. That mismatch is dangerous because users may provide access expecting passive analysis while the skill can persist data locally and send project-derived interface metadata to external systems.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is described as a Java API extractor, but the usage docs extend it to directly push extracted API definitions to an external product platform. That creates a data egress path for potentially sensitive internal API metadata without making the scope expansion explicit, increasing the risk that users invoke publication when they only intended local extraction.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The natural-language example normalizes 'extract and push' as a routine request even though the skill's stated purpose is only extracting Java API definitions. This mismatch can mislead operators into authorizing external publication of internal interface information without realizing they are crossing a trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The workflow examples embed the extractor in automated Git hooks and CI/CD pipelines that publish API definitions to an external platform. This makes external dissemination unattended and repeatable, so internal API structure may be exposed whenever code changes occur, even if reviewers did not intend publication for a given repository.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script silently writes a second copy of extracted API definitions to a fixed external backup directory by default, even when the user only asked for extraction or provided a different output path. This creates unintended persistent storage of potentially sensitive internal API metadata and violates least surprise, which is especially risky in developer tooling that may process proprietary source code.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The hard-coded paths introduce an unjustified write sink to a location unrelated to the analyzed project, allowing the tool to persist extracted data to a developer workstation directory without contextual authorization. Because the extracted content describes controller endpoints and DTO schemas, this may leak sensitive internal service structure into an uncontrolled location.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims to extract Java Controller API definitions to JSON, but it also performs automatic backup writes to a fixed local directory and can trigger downstream data push behavior. Those side effects expand the trust boundary and can cause unintended data persistence or disclosure of extracted API metadata beyond the user-requested extraction task.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The subprocess-based push feature is unrelated to the narrowly stated purpose of local API extraction and introduces an outbound publication path for potentially sensitive internal API definitions. In a skill context, this is dangerous because users may invoke what appears to be a local analysis tool but unintentionally send inventory of internal endpoints to another platform.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The 'just tell me your requirement' natural-language guidance is overly broad for a skill that can scan projects, write files, and optionally trigger data-push workflows. Broad invocation language increases the chance of accidental activation or ambiguous requests being interpreted as permission to access local codebases and generate or transmit derived data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly mentions directly pushing extracted API definitions to an external product platform, but it does not clearly warn that internal project structure, endpoint paths, and parameter schemas may leave the local environment. For enterprise codebases, this metadata can be sensitive and may expose internal services or unreleased features.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The '--push' usage examples demonstrate direct upload behavior without any adjacent safety notice, confirmation requirement, or explanation of what data is sent. Example commands strongly shape user behavior, so omission of warnings makes inadvertent disclosure of project-derived API metadata more likely.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The natural-language triggers are broad and underspecified, such as asking to 'look at what interfaces the project has' or 'extract and push' without defining boundaries, allowed destinations, or sensitivity constraints. In an agent context, vague prompts can cause over-broad file access or unintended execution of higher-risk actions like external transmission.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation presents a '--push' mode but does not warn users that extracted API definitions may contain sensitive internal endpoint names, paths, and schema details that will be transmitted externally. Omitting that warning weakens informed consent and makes accidental disclosure more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The automated Git hook and CI/CD examples publish extracted API data without any user-facing warning about unattended external disclosure. In practice, this can turn every qualifying code push into an automatic metadata exfiltration event, which is more dangerous because it scales silently across commits and contributors.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.