Api Doc Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

The skill’s API documentation workflow is mostly coherent, but it asks for broad execution/write authority and includes unsafe guidance around stored tokens and administrator execution.

Review this skill before installing. Use it only on repositories you intend to scan, confirm exact output paths before generation/export, avoid running it as administrator, and store collaboration tokens in a protected secret manager or tightly permissioned credential file rather than relying on a gitignored directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:273

Finding

Inadequately Protected Persistent Token Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 273-277
Vulnerability Type: Plaintext or insufficiently protected credential storage
Risk Level: Medium

Relevant snippet translated into English:

markdown

### API Key Configuration
- The team collaboration workspace requires a team token: `api-doc collab login`
- Code scanning is performed locally and does not upload source code
- All tokens are configured through environment variables; hardcoding is prohibited
- It is recommended to store tokens in the `~/.api-doc/credentials/` directory (gitignored)

Technical Analysis

The Skill recommends persistently storing authentication tokens under ~/.api-doc/credentials/, but it does not define filesystem permissions, encryption, ownership validation, atomic file creation, log-redaction requirements, token expiration, or secure deletion.

The claim that the directory is gitignored does not protect its contents from other local users, compromised processes, backup software, archive operations, or accidental disclosure outside Git. The guidance is also internally ambiguous because it requires environment-variable configuration while separately recommending filesystem persistence.

This storage behavior is not necessary for the core API-document generation and source-scanning functions. If collaboration authentication requires persistence, an operating-system credential manager or another protected secret store should be used.

Attack Path

1. A user runs api-doc collab login and supplies a valid team token.
2. The Agent or CLI follows the documented recommendation and persists the token under ~/.api-doc/credentials/.
3. The credential file is created with default or otherwise permissive access because the Skill defines no restrictive permissions.
4. Another local user, compromised process, backup reader, or archive recipient obtains the stored token.
5. The attacker uses the token to i ...[truncated 644 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace filesystem token persistence with the operating system's credential manager, such as Keychain, Credential Manager, or Secret Service.
2. If file storage is unavoidable:
   • Create the credential directory with mode 0700.
   • Create credential files with mode 0600.
   • Validate that the directory and files are owned by the current user.
   • Reject symbolic links and unsafe pre-existing files.
   • Use atomic file creation to reduce race-condition risks.
   • Encrypt credentials at rest using a key not stored beside the token.
3. Ensure authentication tokens never appear in generated documentation, command output, error messages, telemetry, or logs.
4. Implement token expiration, rotation, revocation, and secure deletion during logout.
5. Clarify whether environment variables or protected persistent storage is the authoritative authentication mechanism.
6. Remove the suggestion that being gitignored constitutes adequate credential protection.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:414

Finding

Unbounded Recommendation to Execute with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 414-419; duplicated at lines 433-438
Vulnerability Type: Excessive privilege recommendation
Risk Level: Medium

Relevant snippet translated into English:

markdown

| Error Type | Cause Analysis | Resolution |
| API authentication failure (401) | API key is incorrect or expired | Check the key configuration and regenerate the token |
| API rate limit (429) | Request frequency exceeds the limit | Reduce the request rate and enable retry backoff |
| Response timeout (504) | Network latency or excessive server load | Increase the timeout and check the network connection |
| File does not exist | The path is incorrect or the file was not created | Check the path and confirm that the file was generated |
| Unsupported file format | The extension is not supported | Convert it to a supported format and retry |
| Insufficient permissions | The current user lacks read or write permission | Check file permissions and run as administrator |

Technical Analysis

The troubleshooting guidance recommends running as administrator whenever the current user lacks read or write permission. It does not identify the protected resource, determine whether access is legitimately required, limit elevation to a specific operation, or require a sandbox.

The Skill declares command-execution capability and describes processing repository files, custom templates, Git remotes, generated output, and Mock-server commands. Elevating the entire workflow would cause all such processing to occur with administrator privileges. This exceeds the minimum permissions required for API-document generation, which should ordinarily require only read access to the selected repository and write access to a designated workspace directory.

Although no bundled executable implementation or confirmed command-injection flaw was found, this instruction creates a dangerous escalation path if the CLI, ...[truncated 1384 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the generic instruction to run the workflow as an administrator.
2. Require only:
   • Read access to the explicitly selected source repository.
   • Write access to a dedicated output directory owned by the current user.
   • Network access only for explicitly requested collaboration or Git operations.
3. When a permission failure occurs, report the exact inaccessible path and required operation instead of recommending broad elevation.
4. Instruct users to correct ownership or permissions only for the specific project directory when doing so is appropriate.
5. Refuse to read from or write to paths outside approved workspace boundaries unless the user explicitly authorizes the exact path.
6. Run repository scanning, template rendering, document export, and Mock services in a sandbox or unprivileged container.
7. Restrict command execution to documented api-doc and Git subcommands, validate all arguments, and avoid shell-string interpolation.
8. Apply the correction to both duplicated troubleshooting sections at lines 414-419 and 433-438.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

• response.data.phone: type string → string|null (允许空)
  • response.data.avatar: NEW FIELD [DEPRECATED] GET /api/v1/users/legacy - 将在v2.0移除 [REMOVED] DELETE /api/v1/users/batch - 批量删除接口已下线

text

- 异常时参考错误处理章节进行恢复
- 关键参数: `功能3：文档版本管理与diff` 选项

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says it should be used whenever the user needs functionality related to the API documentation generator, which is an overly broad activation condition. In an agent environment with read/exec/write tools, this can cause the skill to trigger in situations where the user did not clearly request repository scanning, file generation, or other side-effecting operations, increasing the chance of unintended workspace changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown introduces repository scanning and file-generation commands that create or modify artifacts like openapi.yaml, reports, HTML, PDF, and Swagger UI output, but it does not provide an upfront warning that the workspace will be changed. In a tool-enabled agent, this can lead to silent file creation or modification and unexpected processing of local source repositories without sufficiently informed user consent.

Content

No source excerpt is available for this finding.