T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:15- Finding
Unnecessary Shell Execution Permission for a Documentation-Only Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
Api Doc Generator Free
Security checks for vulnerabilities and agentic risk
Overview
This API documentation skill is mostly coherent, but it asks for shell execution and gives vague command/network troubleshooting instructions that are broader than needed for generating docs.
Review before installing. The skill does not show malicious payloads or persistence, but users should disable or tightly gate exec if possible, treat pasted curl/code as untrusted documentation input, and avoid setting API_KEY unless a specific trusted workflow actually requires it.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation wording is broad enough to match many ordinary API-related requests, which can cause the skill to trigger when the user did not explicitly intend to use it. Because the skill has write and exec capabilities, overbroad invocation expands the chance of unintended file generation or command execution in unrelated workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description also omits a warning that exec may be used, which is important because command execution materially increases risk compared with a pure text-generation skill. Even if intended only for benign helper commands, undisclosed exec capability can surprise users and lead to unsafe command runs in the local environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description also omits a warning that exec may be used, which is important because command execution materially increases risk compared with a pure text-generation skill. Even if intended only for benign helper commands, undisclosed exec capability can surprise users and lead to unsafe command runs in the local environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md |:------|------:|:------| | 自然语言描述 | "写一个分页查询用户的接口" | 快速起草 | | 代码函数签名 | `def get_user(user_id: int) -> User:` | 老项目反推文档 | | 现有curl命令 | `curl -X POST ... -d '{"a":1}'` | 接口已存在，补文档 | **Agent执行规则**：
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The keyword coverage list declares an excessively wide set of scenario terms, effectively encouraging the skill to self-activate for many generic development conversations. In context, this is risky because the skill advertises powerful tools and could take action in situations where the user only wanted discussion or analysis.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The dependency section states that the tool itself does not require an API key, but a later line explicitly instructs users to export an API key in an environment variable. This is an active contradiction in the skill's own documentation about whether credentials are required.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The license section explicitly states the skill was 'completely Chinese-localized,' and the overall skill content is presented as Chinese-only, while multilingual output is listed as a paid limitation later. This indicates a fixed language experience without an explicit user opt-in or choice, which is a natural-language locale policy concern.
- Content