api-development

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:31 PM UTC
• Version: 1.0.0

Overview

This is mostly API workflow guidance, but its install instructions and deployment step deserve review before use.

Review the install path before using this skill. Prefer a pinned, verified install method instead of the README's unpinned `npx add` command, and only allow its deployment step after confirming the target environment, credentials, approvals, tests, and rollback plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Unpinned Third-Party Installer Execution Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md, line 23
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

npx add https://github.com/wpank/ai/tree/main/skills/api/api-development

Technical Analysis

The installation instructions invoke npx add without pinning the npm package named add to a reviewed version or verifying its integrity. If the package is absent locally, npx can retrieve and execute it from the configured npm registry.

The GitHub source argument also references a mutable repository branch path rather than an immutable commit. The code ultimately processed or installed by this command can therefore change after the Skill has been audited.

This behavior is unnecessary for a documentation-only Skill whose files can be installed through a non-executing copy or verified download operation. There is no evidence in the audited repository that the referenced package or repository is currently malicious; the vulnerability is the unsafe trust and execution model.

Attack Path

1. An attacker compromises the npm account or package resolved as add, influences the configured package registry, or compromises the mutable upstream GitHub repository.
2. The attacker publishes a modified installer or changes the content referenced by the repository branch.
3. A user follows the documented npx add ... installation command.
4. npx downloads and executes the unreviewed package with the user's current permissions.
5. Malicious installer code can read accessible files and environment variables, alter projects or user-owned files, establish network connections, or install additional payloads.

Impact Assessment

Exploitation would execute attacker-controlled code with the privileges of the user running the installation command. Potentially exposed resources include source code, environment variables, development credentials, API to ...[truncated 340 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace npx add with a trusted installation mechanism that does not execute an arbitrary package merely to copy this documentation-only Skill.
2. If an installer is necessary, pin it to an exact reviewed version rather than resolving the latest registry release.
3. Pin the upstream repository content to a full immutable commit hash instead of a mutable branch path.
4. Verify downloaded content using a cryptographic digest or trusted package-lock integrity metadata before processing it.
5. Prefer downloading reviewed files from a fixed commit and copying them into the destination directory with standard filesystem commands.
6. Document the expected files and checksums so users can independently validate the installed content.
7. Run installation without elevated privileges and in an environment that does not expose production credentials or unrelated sensitive files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/api/api-development .cursor/skills/api-development

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/api/api-development .claude/skills/api-development

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/api/api-development ~/.claude/skills/api-development

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: api-development
model: reasoning
description: Meta-skill that orchestrates the full API development lifecycle — from design through documentation — by coordinating specialized skills, agents, and commands into a seamless build workflow.
---

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes a full API development lifecycle that explicitly includes deployment, but it does not provide any caution that deployment can affect production systems, availability, or user data. Under the markdown-specific warning criterion, user-facing documentation should disclose potentially impactful operations when they are part of the skill behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.