Api Generator Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.3

Overview

This skill is an API code generator, but its install and capability instructions are inconsistent enough that users should review it before installing or running it.

Install only if you can verify the actual repository and reviewed package contents. Do not guess the missing git clone URL, avoid running npm install or npm run generate from an untrusted source, use a maintained Node.js LTS version with pinned dependencies, and do not provide API keys or auth secrets unless the skill clearly documents why they are needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unverifiable Repository and Dependency Installation Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-63
Vulnerability Type: Unverified third-party source and dependency execution
Risk Level: Medium

Vulnerable Code

bash

git clone

bash

cd api-generator-free
npm install

bash

npm run generate <name>

Technical Analysis

The documented installation procedure instructs users to clone a repository, install its dependencies, and run its generator. However, the git clone command does not identify a repository URL, and the audited project contains no implementation, package.json, package lockfile, integrity metadata, or executable generator.

Running npm install in an externally obtained repository can execute package lifecycle scripts such as preinstall, install, and postinstall. Consequently, filling the missing clone source with an untrusted or incorrectly identified repository could lead to arbitrary code execution under the installing user's account.

The command as currently written fails because it has no repository argument. The security risk arises when a user completes the undocumented source parameter and proceeds with the remaining installation instructions without a verifiable source or locked dependencies.

Attack Path

1. A user follows the skill documentation and searches for or receives a repository URL because the documented clone URL is missing.
2. An attacker supplies a malicious repository or impersonates the expected project.
3. The user clones that repository and enters its directory.
4. The user executes npm install.
5. Malicious dependency lifecycle scripts execute with the user's privileges.
6. The user runs npm run generate, potentially executing an additional attacker-controlled payload.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user running npm. Depending on those privileges and the local environme ...[truncated 396 chars]

Remediation

View remediation

Remediation Suggestions

• Provide an explicit HTTPS URL for the authoritative repository.
• Document the expected repository owner, release tag, and commit hash.
• Include the actual implementation, package.json, and lockfile in the reviewed artifact.
• Require installation from a pinned, reviewed release rather than an unspecified branch.
• Use npm ci instead of npm install for reproducible installation.
• Initially install with npm ci --ignore-scripts unless lifecycle scripts are necessary and have been reviewed.
• Publish checksums or signed release artifacts and provide instructions for verifying them.
• Ensure the generator runs as an unprivileged user in an isolated working directory.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:261

Finding

Unpinned Dependencies and Unsupported Node.js Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:261-273
Vulnerability Type: Unpinned third-party dependencies and obsolete runtime support
Risk Level: Medium

Vulnerable Code

text

Node.js >= 10.x
npm >= 6.x

bash

npm install express
npm install graphql
npm install --save-dev jest
npm install --save-dev supertest
npm install openapi-generator
npm install jwt-decode
npm install express-rate-limit

Technical Analysis

The documentation permits Node.js 10 and npm 6 while installing all listed packages without explicit versions. Node.js 10 is end-of-life and no longer receives security updates. The open-ended >= 10.x requirement also does not define a tested, supported runtime range.

Package installation commands without pinned versions resolve mutable package releases at installation time. Because the artifact contains no package.json or lockfile, dependency versions and transitive dependency integrity cannot be reproduced or audited. Future installations may therefore retrieve materially different code from the code originally reviewed.

This configuration increases exposure to compromised releases, unexpected breaking changes, vulnerable transitive packages, and unsupported runtime vulnerabilities. The available evidence does not establish that any named package is malicious; the issue is the insecure dependency-management process.

Attack Path

1. A user prepares an environment that satisfies the documented minimum, potentially using end-of-life Node.js 10.
2. The user runs the documented unversioned npm installation commands.
3. npm resolves the package versions and transitive dependency graph available at that time.
4. A compromised, vulnerable, or unexpectedly changed release is installed.
5. Package lifecycle scripts may execute during installation, or vulnerable code may later load when the generated API or tests run.
6. An attacker exploits the affected pa ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Replace Node.js 10 support with a currently maintained Node.js LTS version.
• Define and test an explicit supported runtime range.
• Pin all direct dependency versions in package.json.
• Commit a package lockfile and use npm ci in development and CI.
• Review transitive dependencies and package provenance before release.
• Enable automated dependency vulnerability scanning and controlled update workflows.
• Avoid automatic lifecycle-script execution where it is unnecessary.
• Use registry allowlists, scoped packages, and integrity verification in controlled environments.
• Rebuild and retest generated artifacts whenever dependencies or the runtime are updated.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares the write tool but later claims the free version does not support direct file writes, creating a dangerous mismatch between documented restrictions and actual available capability. If an agent trusts the prose instead of the manifest, it may expose filesystem write behavior unexpectedly, enabling unauthorized file creation or modification during code generation workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill should be used for broad situations such as code generation, programming assistance, debugging/testing, and development/deployment. These are expansive everyday development contexts rather than specific invocation triggers, which increases the chance of unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly states '支持中文交互' and the document presents the skill as Chinese-interaction oriented without offering a language choice. This can violate language/locale policy when users are not given an opt-in or alternative language option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says advanced features require the paid version, but the interface and examples still expose those advanced parameters and outputs in the free skill. This can mislead downstream systems into supplying secrets, auth configuration, or rate-limit settings to functionality that should not exist, creating confusion about trust boundaries and increasing the risk of accidental misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The core feature text again describes the skill as providing Chinese interaction, with no indication that users may choose another language. Repeating a fixed locale behavior in user-facing instructions reinforces a language policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation contradicts itself about which capabilities are available in the free version versus the paid version, including OpenAPI, auth, mock server, and rate limiting. In a code-generation skill, these contradictions can cause an agent or user to invoke unsupported or more-privileged behaviors, increasing the chance of unsafe execution paths, policy bypass, or accidental exposure of sensitive configuration such as auth secrets.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The document asserts that all data transmission uses HTTPS and that server-stored data is encrypted, and later mentions automatic network retries, yet the skill is described elsewhere as a local API code generator. These statements introduce an operational model that contradicts or at least conflicts with the described purpose and usage of a local scaffolding tool.

Content

No source excerpt is available for this finding.