Security audit

API文档一键生成规范器

Security checks for vulnerabilities and agentic risk

Overview

This API documentation skill is mostly documentation-oriented, but it asks for command execution authority that is not clearly needed or bounded for its stated purpose.

Review this skill before installing in environments where command execution is sensitive. It appears intended for API documentation, but it should not need broad exec access unless the publisher adds clear command scope, user approval requirements, and callback privacy guidance.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill is presented as a documentation-writing assistant, but it declares `exec` capability without a clear functional need or strong safety boundaries. That mismatch expands the attack surface: a user or downstream prompt injection could cause command execution in a context where users reasonably expect only text generation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation claims the skill only generates documentation, yet the manifest also exposes command-execution capability and operational guidance. This inconsistency can mislead users and host agents into granting more trust than warranted, increasing the risk of unintended command execution.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The usage constraints assert 'pure document generation only,' but the skill still advertises broader execution capability. This contradiction creates a deceptive safety posture that may cause operators to enable the skill in environments where command execution is not acceptable.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill exposes `write` and `exec` capabilities but does not prominently warn users that it may modify files or run commands. Without clear disclosure, users may provide inputs assuming a read-only documentation helper, which raises the chance of unsafe or surprising side effects.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documented `callback_url` parameter enables outbound data transmission, but the skill provides no warning about privacy, SSRF-like risks, or what data may be sent externally. In agent environments, an attacker could steer outputs or metadata to untrusted endpoints if URL handling is later implemented unsafely.

Static analysis

No suspicious patterns detected.