API开发工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.4

Overview

This API-development skill is not overtly malicious, but it requests command execution for broad development and deployment tasks without clear enough limits or user-control requirements.

Install only if you are comfortable with an API-development assistant that may read project files and run shell commands. Use it in a disposable or least-privileged workspace, review every command before execution, avoid giving it production credentials, and pin or verify any optional dependencies before installing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:125
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install requests

Technical Analysis

The setup instructions install requests without specifying an exact version, lockfile, or package integrity hash. Consequently, the package version and transitive dependency graph are resolved from the configured package index at installation time and may differ from the versions originally reviewed.

The supplied Python example does not import or use requests, so this installation also introduces unnecessary supply-chain exposure for the documented example. The instruction does not itself prove that the package is malicious; the weakness is that it permits mutable, unverified dependency resolution.

Attack Path

1. An attacker compromises a future package release, a transitive dependency, a package maintainer account, or the package source configured in the user's environment.
2. A user follows the skill's environment-preparation instructions and runs pip install requests.
3. pip resolves and downloads the current package and dependency versions without enforcing reviewed versions or integrity hashes.
4. Malicious package code executes during installation or later when the installed component is imported.
5. The payload operates with the permissions of the user or automation account running the installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's privileges. Depending on that account's access, the attacker could read or modify source code, steal environment variables and development credentials, tamper with generated API artifacts, or compromise build outputs. The scope is limited by the permissions and isolation controls of the Python installation environment.

Remediation

View remediation

Remediation Suggestions

• Remove requests from the setup instructions unless the skill genuinely requires it.
• If required, pin an exact, reviewed version rather than resolving the latest available release.
• Maintain a lockfile or requirements file containing hashes, and install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
• Review and pin transitive dependencies where practical.
• Use a trusted, explicitly configured package index and restrict fallback to untrusted sources.
• Run dependency installation in an isolated virtual environment or disposable sandbox with minimal privileges and no unnecessary credentials.
• Add automated dependency vulnerability and provenance checks to the release process.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:216

Finding

Unpinned Optional npm CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:216
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

text

| OpenAPI tool | CLI | Optional | npm install @redocly/cli |

The source document presents the same instruction using Chinese table labels:

text

| OpenAPI工具 | CLI | 可选 | npm install @redocly/cli |

Technical Analysis

The documented command installs @redocly/cli without an exact version, lockfile, or recorded integrity value. npm therefore resolves a mutable package version and its transitive dependencies at installation time. npm packages can also define lifecycle scripts that execute during installation, increasing the potential impact of a compromised package or dependency.

The tool is marked optional, but users who enable it receive no guidance for verifying its version, provenance, or integrity. The instruction does not demonstrate an active malicious package; it creates an avoidable supply-chain trust boundary.

Attack Path

1. An attacker compromises the package, one of its transitive dependencies, a maintainer account, or the npm registry/source used by the victim.
2. A user installs the optional tool by running npm install @redocly/cli.
3. npm selects the currently matching package and dependency versions without enforcing a previously reviewed dependency graph.
4. A malicious lifecycle script may execute during installation, or malicious package logic may run when the CLI is invoked.
5. The payload gains the permissions and accessible resources of the user or CI account that performed the installation.

Impact Assessment

Successful exploitation could result in arbitrary code execution in a developer workstation or CI environment. Exposed assets may include repository contents, npm configuration, environment variables, API credentials, generated documentation, and build artifacts. If installati ...[truncated 227 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @redocly/cli to an exact, reviewed version.
• Commit and enforce an npm lockfile with integrity metadata.
• Use npm ci for reproducible installations instead of unconstrained dependency resolution.
• Configure an approved registry and prevent unintended fallback to public or user-controlled package sources.
• Review package lifecycle scripts and consider disabling them during installation with --ignore-scripts when they are unnecessary.
• Install the CLI in an isolated, least-privileged environment without production credentials.
• Run software-composition analysis and provenance checks before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level description uses very broad activation language covering code generation, programming help, debugging, testing, and deployment. Overbroad routing criteria can cause this exec-capable skill to activate for common development requests outside its intended bounds, expanding exposure to filesystem reads and shell execution without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description explicitly states '支持中文交互', and the document is written entirely in Chinese without indicating that other languages are available on user request. This creates a language/locale constraint that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example trigger phrase '构建一个用户管理API' is broad and likely to match many ordinary development conversations. In combination with allowed exec and read tools, an unconstrained trigger increases the likelihood of unnecessary or premature skill activation for tasks that may not require system-impacting actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file says no additional API key is required, yet elsewhere discusses API-key handling through environment variables. This inconsistency can mislead users and operators about whether secrets are needed, which may result in unsafe ad hoc credential entry, confusion during setup, or accidental exposure when the skill later requests external-service access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as an API-development orchestrator, but later expands its claimed capabilities to generic file handling, external API access, command execution, and information retrieval. This scope drift can cause the agent to invoke the skill for broader tasks than users expect, increasing the chance of unintended command execution or data access under an apparently narrow, trusted label.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation advertises file handling, external API integration, and command execution, but the warnings are not prominent relative to those potentially impactful capabilities. Users may treat the skill as routine developer assistance and miss that it can read files, invoke external services, or run commands, creating risk of unintended system changes, data disclosure, or network egress.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The core-feature line repeats that the skill provides Chinese interaction but does not mention multilingual support or user choice. This reinforces a fixed-language behavior rather than an opt-in locale preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.