api-free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.3

Overview

This appears to be an API reference skill, but it asks for command/write permissions and unpinned package installs that are not needed for documentation lookup.

Review before installing. Use this only in a sandboxed environment, avoid running the listed pip installs unless independently verified, do not provide real API keys unless needed, and prefer a version limited to read-only documentation access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:268

Finding

Unverified and Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:268-272
Vulnerability Type: Supply-chain exposure through unnecessary, unpinned Python packages
Risk Level: Medium

Vulnerable Code Snippet

text

pip install requests
pip install markdown
pip install sktool
pip install skskill

Technical Analysis

The Skill directs users to install third-party Python packages without version constraints, integrity hashes, verified publisher information, or an approved package index. The generic package names sktool and skskill are particularly difficult for a user to validate from the supplied documentation.

The Skill describes itself as a documentation reference and states that it does not execute API requests. Consequently, no demonstrated functionality justifies these runtime dependencies. Installing unnecessary packages expands the supply-chain attack surface.

Python packages can execute attacker-controlled logic during installation or when imported. If one of the named packages is malicious, compromised, or replaced through dependency confusion or typosquatting, following the documented installation instructions could execute arbitrary code under the installing user's account.

Attack Path

1. A user loads the Skill and follows its dependency setup instructions.
2. The user executes one or more of the documented pip install commands.
3. pip resolves the unpinned name from its configured package repository.
4. A malicious or compromised package executes installation-time or runtime code.
5. The package accesses resources available to the user, potentially including project files, environment variables, API credentials, and local configuration.
6. If installation occurs in an elevated environment, the resulting compromise inherits those elevated privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running pip. T ...[truncated 450 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all Python dependency instructions if the Skill remains a documentation-only reference.
2. In particular, remove sktool and skskill unless their necessity and trusted ownership can be independently demonstrated.
3. If dependencies become necessary, pin each package to a reviewed version.
4. Use lock files with cryptographic hashes and install with hash verification enabled.
5. Identify the official publisher and repository for every dependency.
6. Require installation inside an isolated, non-privileged virtual environment.
7. Prohibit installation as root or administrator.
8. Periodically scan dependencies for known vulnerabilities and package-ownership changes.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:25

Finding

Excessive Execution and File-Write Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25-28
Vulnerability Type: Violation of least privilege through unnecessary tool authorization
Risk Level: Medium

Vulnerable Code Snippet

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The declared workflow only requires locating and reading API-reference documentation. Nevertheless, the Skill requests both command-execution and file-write capabilities. Neither capability is necessary for a read-only documentation lookup.

Granting exec allows commands to run with the agent process's operating-system permissions. Granting write permits modification or creation of files accessible to that process. These capabilities materially increase the effect of malformed user input, generated command errors, future instruction changes, or a compromised dependency.

The file contains general warnings about command injection, but it does not define an enforceable command allowlist, input-validation procedure, path restriction, sandbox boundary, or approval step. A prose warning does not mitigate the permissions granted by the tool declaration.

Attack Path

1. The Skill is loaded with read, exec, and write permissions.
2. A user supplies attacker-controlled service names, endpoint values, paths, headers, or other parameters.
3. A future or altered workflow interpolates that input into a shell command or output path without sufficient validation.
4. The exec capability runs an unintended command, or the write capability modifies an unintended file.
5. The action inherits the permissions of the agent process and can affect all files and commands available to that account.

The audited file does not contain a concrete command-injection payload, so this is a capability and least-privilege flaw rather than evidence that exploitation has already occurred.

Impact Assessment

If abused, exec can provide arbitrary command ex ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the tool declaration to the minimum required capability:

   yaml

   tools:
     - read
   

2. Do not invoke shell utilities to inspect documentation when the platform's read operation can perform the task.
3. Remove file-write access unless a specific, documented output artifact is required.
4. If command execution later becomes essential, use fixed command templates and argument arrays rather than shell-string concatenation.
5. Validate service names and paths against strict allowlists.
6. Restrict file access to the Skill directory and reject traversal sequences, absolute paths, and symbolic-link escapes.
7. Run the Skill in a sandbox under a dedicated, non-privileged account.
8. Require explicit user approval before any command execution or filesystem modification.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly frames the skill as documentation-only and says it will not execute user requests, yet it declares both exec and write capabilities and later instructs use of shell commands like head and sed. This mismatch can mislead users and orchestrators into granting a broader trust level than warranted, increasing the chance of unintended command execution or file modification in a context that should be read-only.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation guidance is broad enough to encourage use whenever API integration or system connection is mentioned, without clearly constraining safe operations. In a skill that also has exec and write, vague routing language increases the chance the agent applies an over-privileged skill in contexts where a narrower read-only skill would be safer.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Broad shell execution is excessive for simple document retrieval and enables far more than reading bundled markdown files. Even if the examples mention head and sed, granting generic exec permits arbitrary command invocation, which could expose secrets, alter the environment, or chain with other capabilities depending on the agent runtime.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Broad shell execution is excessive for simple document retrieval and enables far more than reading bundled markdown files. Even if the examples mention head and sed, granting generic exec permits arbitrary command invocation, which could expose secrets, alter the environment, or chain with other capabilities depending on the agent runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest presents the display name, summary, and main description primarily in Chinese while also embedding English fragments like 'Use when,' but it does not state whether the skill will respond in Chinese, English, or adapt to the user's preference. This can amount to an implicit language policy without opt-in or explicit user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description explicitly recommends using the skill for 'Webhook配置'. But later capability boundaries state the free version has no webhook verification content, which is a key part of secure webhook configuration; this creates an intent-level contradiction about what webhook support actually means in the free edition.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The '能力边界' section states the free version has no X-RateLimit-Remaining and no 429 handling plan. Later FAQ and troubleshooting content recommends waiting, adjusting request frequency, and even enabling retry backoff for 429 errors, which contradicts the earlier boundary claim rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.