Security audit
Security checks for vulnerabilities and agentic risk
This API-development skill is mostly purpose-aligned, but it requests broad read, write, command-execution, and external API authority without tight scoping or clear user confirmation boundaries.
Review this skill before installing if you do not want a broadly scoped API-development helper that can read and write files, call external services, and run local commands. Use it only in projects where those actions are acceptable, and require explicit review of endpoints, file paths, generated changes, and commands before execution.
The activation guidance is overly broad and may cause the skill to trigger on almost any API-related request, even when the user did not intend file writes, network access, or command execution. Over-broad auto-selection increases the chance that a high-privilege skill is invoked unnecessarily, expanding the attack surface for prompt injection or accidental misuse.
The skill advertises premium-only restrictions in documentation, but the manifest still exposes powerful generic tools like exec and write with no visible technical enforcement boundary. This can mislead users or downstream agents into assuming certain risky capabilities are unavailable when they are actually callable, increasing the chance of unauthorized or unsafe operations.
The skill describes assembling requests, sending HTTP traffic, parsing results, and handling execution flows without a clear upfront warning that it may perform external calls, write files, or execute commands. Users and orchestrators may therefore treat it as a harmless planning tool when it actually has side-effecting capabilities, which increases the risk of unintended data egress or system changes.
The manifest presents the skill as a scoped API-development orchestrator, but the body expands that scope into broad file processing, external API access, and command execution. This scope drift weakens least-privilege expectations and can cause agents or users to invoke the skill in situations where it has far more operational power than its top-level description suggests.
Advertising generic system command execution is dangerous because exec enables arbitrary local actions that are much more powerful than ordinary API orchestration. In this context, the command-execution capability is not clearly justified or constrained, so prompt-driven misuse could lead to filesystem changes, data exposure, or execution of harmful commands.
No suspicious patterns detected.
