T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:341- Finding
API Tokens May Be Persisted in an Unprotected Plaintext Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
api-toolkit
Security checks for vulnerabilities and agentic risk
Overview
This API testing skill is mostly coherent, but it gives broad execution, network, credential, load-testing, sharing, scheduling, and privilege guidance without enough safeguards.
Review before installing. Use only against systems you own or are authorized to test, avoid production and third-party load testing unless explicitly approved, redact recordings/reports before sharing, do not store tokens in plaintext credential folders, and do not run the agent or toolkit as administrator for routine API testing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:626- Finding
Unpinned Dependency Installation From an Implicit Package Source
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:493- Finding
Generic Troubleshooting Guidance Encourages Administrator Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages recording and replaying real API traffic without clearly warning that requests and responses may contain credentials, tokens, PII, session identifiers, or proprietary payloads. In an API-testing skill with read/write/exec capabilities, this is dangerous because captured artifacts can persist locally, be checked into repos, or be reused in unsafe contexts, creating a realistic secret and data-leak path.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The load-testing section provides concrete instructions for stressing target services, including third-party endpoints, but omits a clear warning that such actions can degrade service, trigger abuse controls, incur costs, or violate acceptable-use policies. In context, this is especially risky because the skill is operational and exec-enabled, making harmful testing against production or external systems more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The display name, summaries, and the body of the document are written in Chinese, while the skill is otherwise presented as a general-purpose development tool rather than a clearly China-only or Chinese-only tool. There is no indication that users may choose another language or that the locale restriction is required for compliance or regional use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill should be used when there is a need for "代码生成、编程辅助、调试测试、开发部署", which is much broader than the API-testing scope implied elsewhere. These generic trigger conditions overlap with everyday developer requests and do not clearly define when this skill should activate versus more specialized skills.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Load Test Report - 2026-07-18 ================================ Target: https://api.example.com/v1/users Duration: 300s | Total Requests: 150,000 # ... Concurrency | QPS | P95(ms) | P99(ms) | Error%
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The collaboration features describe cloud/shared repositories, result diffs, change notifications, and webhooks without clearly warning that test assets and reports may include request bodies, tokens, headers, error payloads, or tenant data. This is dangerous because collaborative distribution expands the blast radius of any sensitive API artifacts beyond a single operator to teammates and external integrations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The documented on-failure webhook posts data to an external endpoint, which creates an external transmission path. Even though the example only sends a short fixed message, in context this pattern normalizes outbound notifications from an exec-enabled skill and could easily be adapted to include sensitive test names, environment details, or failure artifacts without adequate review.
- Content
与监控告警集成
bash api-toolkit test run ./tests/smoke.yaml --schedule "*/5 * * * *" \ --on-failure "curl -X POST $ALERT_WEBHOOK -d 'API冒烟测试失败'"热门问题
Q1: 本技能的适用范围是什么?
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L387 states '本地运行，不支持多设备同步', which directly conflicts with earlier documented capabilities such as '团队协作空间' with cloud repositories, role management, webhook notifications, and uploads/notifications to Slack/钉钉/飞书/Confluence/Notion in L140-L148 and L362-L373. This is not just incomplete documentation; it actively contradicts the described behavior of the skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description focuses on API testing/debugging, regression, local mock server, load testing, contract validation, error-code dictionaries, and team collaboration. In contrast, L542-L873 describes much broader product behavior including API directory management, monitoring/alerting, API generation/editing, authentication/authorization frameworks, anti-abuse defenses, deployment management, and API publishing/management-platform functions, which materially expands the represented scope.
- Content
Static analysis
No suspicious patterns detected.