uctoo-api-skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 0.0.1

Overview

This is a real UCTOO API connector, but it can make authenticated changes or deletions from broad natural-language triggers without clear confirmation safeguards.

Install only if you trust the UCTOO backend and will use a limited-permission account. Require the agent to show the exact endpoint, request body, and target record before any create, update, delete, bulk, or force-delete action, and avoid entering production credentials unless your environment protects chat logs and tool output.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The README gives contradictory security guidance: earlier sections describe session-level automatic token capture and header injection by the runtime, while later notes say the model will save and carry the access token itself. In an agent skill, this ambiguity can lead to insecure implementations where the model exposes, stores, or mishandles bearer tokens, increasing the chance of credential leakage or unauthorized API use.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The document advertises a fully functional API integration skill, but the shown implementation only logs inputs and returns a success placeholder. This mismatch can mislead operators into believing real controls, authentication flows, or API actions exist when they do not, which is a security-relevant integrity issue in an agent skill because users may rely on nonexistent behavior and safeguards.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The comment claims API calls will be performed by the model via instructions in SKILL.md, but the provided implementation never invokes that script. In agent systems, delegating execution assumptions to prompt text without code-level enforcement creates a dangerous gap where sensitive operations appear supported but are uncontrolled, unverifiable, or silently skipped.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script performs a real login using hardcoded credentials and then processes the resulting token. Even if the account is only a demo account, embedding credentials in source code encourages credential leakage, accidental reuse, and unsafe operational practices; in the context of an agent skill, this is more concerning because the skill is designed to trigger real backend interaction.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The activation criteria are broad keyword triggers such as mentioning 'uctoo', '登录', or '用户管理', which can cause the skill to activate in contexts where the user is discussing rather than authorizing real backend actions. In a skill that performs live HTTP requests against user, product, and order APIs, ambiguous activation increases the risk of unintended network access or state-changing operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README documents automatic login-response token capture and Authorization header injection but does not clearly warn users that credentials and session tokens will be stored and reused across requests within a session. Because these are bearer credentials for backend APIs, silent reuse can surprise users, broaden access beyond what they intended, and increase privacy and account-compromise risk if responses, logs, or session boundaries are mishandled.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes automatic token capture, session storage, and later header injection without clearly warning users that authentication artifacts are retained and replayed across subsequent requests. In an agent skill context, this can surprise users, expand the blast radius of a single login action, and increase the chance of unauthorized or unintended authenticated operations if session boundaries or prompting are misunderstood.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation encourages users to provide real credentials for login flows but does not clearly disclose that those credentials will be transmitted to a backend service and that related authentication data may be stored or logged for debugging. In an AI-agent-mediated workflow, that omission can cause credential exposure through logs, telemetry, or unintended backend use beyond what the user expects.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The plan explicitly instructs the skill to trigger on broad natural-language keywords such as “产品”, “订单”, “登录”, and “认证”, and elsewhere says the agent should directly issue real API requests when these are mentioned. In an autonomous skill context, overly broad triggers can cause unintended invocation and side-effecting backend actions from ambiguous or routine conversation, especially because the skill supports create/update/delete operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section documents authentication, token handling, and destructive actions like deleting users/orders, but the workflow does not require explicit user confirmation, authorization checks, or risk disclosure before executing them. In this skill’s context, the danger is elevated because the stated design is to translate natural language directly into live backend API calls, so ambiguous prompts could lead to account actions or irreversible data modification.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad keywords like '登录', '产品', and '认证', which can overlap with ordinary conversation and cause unintended activation of a network-capable skill. In this context that is more dangerous because the skill is designed to transform natural language directly into backend API calls, so accidental invocation could expose data or initiate actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The design instructs handling usernames, passwords, and bearer tokens but provides no warning, consent flow, storage limits, or redaction guidance. Because this skill targets real backend authentication and may encourage users to paste credentials into chat or command examples, the lack of credential-handling safeguards materially increases the risk of secret exposure and account compromise.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CRUD reference includes delete operations but does not warn about destructive impact or require confirmation. In an agent skill that converts natural language into backend API calls, omission of safeguards around deletion materially raises the chance of accidental or unauthorized destructive actions against production data.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation scope is broad: common terms like '产品', '订单', '登录', and '认证' can appear in ordinary conversation unrelated to this backend. That increases the chance the skill activates unexpectedly and sends requests to a live API without the user intending to use this integration.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The description tells the agent to directly issue real HTTP requests whenever certain keywords are mentioned, without requiring informed consent, preview, or warning about data transmission and side effects. Because the skill supports login, edit, and delete style operations with automatic authentication, this can lead to unintended disclosure of user data or unauthorized state-changing actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples normalize destructive deletion of users without any confirmation, authorization, or warning about irreversible data loss. In a skill designed to directly translate natural language into live backend API calls, this increases the chance that users or downstream agents execute destructive actions unintentionally or without proper review.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The login workflow includes plaintext example credentials and no warning about secure credential handling, storage, or redaction. In this skill context, where the agent is instructed to make real HTTP requests for authentication, such examples can encourage insecure practices, accidental credential exposure in logs, prompts, or documentation, and misuse of default/demo credentials.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This workflow includes deleting a user as part of a normal operational sequence without warning about verification, scope, or rollback. Because the skill is intended to convert conversational requests into actual backend mutations, the example makes unsafe destructive behavior seem routine and can lead to accidental or unauthorized deletion of real records.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly enables destructive deletion, including permanent deletion via `force=1`, but provides no warning, confirmation requirements, or safety guidance. In this skill's context, the agent is instructed to directly translate natural-language requests into real backend API calls, which makes accidental or prompt-induced irreversible data loss significantly more likely.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client allows its base URL to be overridden via the BACKEND_URL environment variable and will use plain HTTP when that URL starts with http://. Because this same client handles username/password login and bearer-token authenticated requests, a misconfiguration or malicious deployment environment could send credentials and tokens in cleartext, enabling interception or redirection to an attacker-controlled backend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends login credentials to a remote backend as part of a test run without any meaningful operator warning, confirmation, or safeguard. In this skill context, which is meant to translate user prompts into live API calls, silently normalizing credential transmission increases the chance of unintended real-world authentication attempts against production-like infrastructure.

External Transmission

Medium

• Category: Data Exfiltration

Content

if method.upper() == "GET":
            response = requests.get(url, headers=headers, params=data)
        elif method.upper() == "POST":
            response = requests.post(url, headers=headers, json=data)
        else:
            return json.dumps({"error": f"Unsupported method: {method}"})

• Confidence: 90% confidence
• Finding: requests.post(url, headers=headers, json=

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.