Security audit

api-scaffold-gen

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it gives broad write, execute, deployment, and API-related guidance without clearly scoping side effects or data handling.

Install only if you are comfortable with an agent creating and modifying project files, running scaffold/deploy commands, and using configured APIs. Keep it limited to a test or approved project directory, review generated files and commands before execution, do not provide secrets or proprietary source unless your agent and LLM data policies allow it, and require explicit confirmation before CI/CD, kubectl, Docker, Git commits, or template-login actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description at L011-L012 scopes the skill to generating API scaffolds, templates, ORM/migrations, deployment configs, and related project bootstrapping assets. However, L041-L043 claim capabilities for static analysis, dependency vulnerability detection, and batch code review/report generation, which are qualitatively different from scaffold generation and not presented as generated outputs or implementation details of scaffolding.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says users can '在AI Agent对话中调用本技能' without specifying the exact phrases, commands, or contexts that should activate the skill. In a markdown skill description, this ambiguity can cause unintended invocation because there is no constrained trigger scope or negative examples.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes generating files, deploying artifacts, executing commands, and modifying project state without a clear user-facing warning about those side effects. In a skill with read/exec/write permissions, ambiguous or under-disclosed system-modifying behavior can cause unauthorized file creation, command execution, dependency installation, or deployment actions that exceed user expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is described throughout the manifest as a project/code scaffold generator driven by commands like rest, ddd, microservice, and openapi reverse. But the declared input fields (content, mode, style) and generic output payload (处理结果, word_count, template_used) match a text-processing or reviewer workflow, not scaffold generation outputs such as files, project structure, or generated templates.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill claims code generation runs locally and does not upload code, while also requiring an external LLM API and acknowledging network/API failure modes. This creates a meaningful data-handling transparency issue: users may provide proprietary source, specs, or secrets under a false assumption that nothing leaves the host, leading to inadvertent data disclosure to third-party services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The display name, summary, and main description are presented only in Chinese, and the document does not indicate that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale limitation is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.