API Design Principles

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

The skill itself is mostly API-design documentation, but its README recommends an unpinned executable install command from a mutable GitHub branch, which users should review before installing.

Review the install path before using this skill. Prefer installing from a pinned commit, verified archive, or trusted local copy instead of running the README's unpinned `npx add` command. If you copy the FastAPI template into a real service, replace wildcard CORS with explicit allowed origins and review destructive CRUD endpoints before deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:33
• Finding: Unpinned Third-Party Installer and Mutable Repository Source<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 33 **Vulnerability Type**: Unpinned third-party dependency and mutable installation source **Risk Level**: Medium ### Vulnerable Code ```bash npx add https://github.com/wpank/ai/tree/main/skills/backend/api-design-principles ``` ### Technical Analysis The documented installation command invokes `npx`, which may download and execute the npm package named `add` if a trusted local copy is unavailable. The command does not pin that package to an audited version. The Skill content is also retrieved from a mutable branch of a personal GitHub repository rather than a full commit hash or signed, checksum-verified release. Consequently, the code and instructions installed by this command may differ from the content reviewed during this audit. This installation mechanism exceeds the minimum privileges needed for a primarily documentation-based Skill. Installation could instead use a pinned archive or an explicit local copy operation without executing a third-party installer. ### Attack Path 1. An attacker compromises the npm package used by `npx`, the associated npm maintainer account, the GitHub account, or the referenced repository. 2. The attacker publishes malicious installer behavior or changes the contents of the repository’s mutable default branch. 3. A user follows the README and executes the documented `npx add` command. 4. `npx` retrieves and executes the installer with the permissions of the current user. 5. The compromised installer can execute arbitrary commands, alter local files, steal user-accessible credentials, or install modified Skill instructions and templates. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation command. The accessible scope may include: - Files readable or writable by the current user. - Developer credentials and tokens available to the process. - Project configu ...[truncated 351 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer package to a specific, reviewed version instead of relying on the latest package resolved by `npx`. 2. Pin repository content to a full Git commit hash or immutable signed release tag. 3. Publish and verify a SHA-256 or stronger checksum for downloaded artifacts. 4. Prefer a non-executable installation procedure, such as downloading a pinned archive and copying the required files. 5. If an installer is necessary, document its package identity, version, expected behavior, and required permissions. 6. Use npm lockfiles, integrity metadata, provenance verification, and trusted registries where applicable. 7. Avoid running the installation command with elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: templates/fastapi-template.py:20
• Finding: Unrestricted CORS Configuration in a Production-Labeled API Template<![CDATA[ ## Vulnerability Details **File Location**: `templates/fastapi-template.py`, lines 20–25 **Vulnerability Type**: Overly permissive cross-origin resource sharing configuration **Risk Level**: Low ### Vulnerable Code ```python app.add_middleware( CORSMiddleware, allow_origins=["*"], # Configure for production allow_methods=["*"], allow_headers=["*"], ) ``` ### Technical Analysis The template permits every origin, HTTP method, and request header through CORS. This allows JavaScript hosted on any website to issue browser-based cross-origin requests and read responses where the browser and application authentication model permit them. Credentialed CORS is not enabled in the audited configuration, which limits immediate exploitation involving browser-managed cookies. Nevertheless, the wildcard policy unnecessarily broadens the browser-accessible attack surface. It can become security-sensitive if developers copy the “production-ready” template and later add bearer-token workflows, public sensitive endpoints, permissive authentication behavior, or other authorization mechanisms without restricting CORS. A secure template should deny cross-origin requests by default or require an explicit deployment-specific allowlist. Permitting all methods and headers also exceeds the minimum privileges necessary for the example CRUD API. ### Attack Path 1. A developer deploys an API based on this template without replacing the wildcard CORS configuration. 2. The deployment exposes endpoints whose responses should only be available to approved web applications. 3. A victim visits an attacker-controlled website. 4. JavaScript on that website sends cross-origin requests to the deployed API using methods and headers accepted by the wildcard policy. 5. If the API accepts the request under its authentication model, the attacker-controlled page can read and process the response. Exploitation involving browser-managed credentials would require additional ...[truncated 944 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove CORS middleware unless cross-origin browser access is explicitly required. 2. Replace `allow_origins=["*"]` with an environment-specific allowlist of trusted HTTPS origins. 3. Restrict `allow_methods` to the methods actually needed, such as `GET`, `POST`, `PATCH`, and `DELETE`. 4. Restrict `allow_headers` to required headers, such as `Authorization` and `Content-Type`. 5. Keep credentialed CORS disabled unless it is necessary and accompanied by explicit trusted origins. 6. Validate the `Origin` header at the application or gateway layer where additional policy enforcement is needed. 7. Add automated tests confirming that requests from unapproved origins do not receive permissive CORS response headers. 8. Replace the production-ready claim or make secure origin configuration mandatory before startup. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

GET    /api/resources/{id}     → Get one
PUT    /api/resources/{id}     → Replace
PATCH  /api/resources/{id}     → Partial update
DELETE /api/resources/{id}     → Remove

# Nested (max 1 level)
GET    /api/users/{id}/orders  → User's orders

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

|-------|-------|
| `POST /getUsers` | `GET /users` |
| `GET /createUser` | `POST /users` |
| `POST /users/delete/123` | `DELETE /users/123` |
| `/user/123` | `/users/123` (plural) |
| `/api/users/123/orders/456/items` | Max 2 levels |
| 200 for everything | Correct status codes |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/api-design-principles .cursor/skills/api-design-principles
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/api-design-principles .claude/skills/api-design-principles
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/api-design-principles ~/.claude/skills/api-design-principles
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: api-design-principles
model: reasoning
---

# API Design Principles

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This code defines a DELETE endpoint for user removal, which is a destructive and potentially irreversible action. Although the docstring states the HTTP response behavior, it does not provide any user warning, confirmation step, or explicit disclosure about the impact of deletion.

Static analysis

No suspicious patterns detected.