Security audit

Apifox Exporter

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main purpose is legitimate, but it can automate an authenticated Apifox export with weak target selection and retained local artifacts that may expose the wrong or sensitive API data.

Review before installing. Use this only in an account where exporting all visible Apifox project data is acceptable, and clear the saved chrome-profile and debug screenshots after use. Avoid broad trigger phrases with untrusted text, verify the selected team/project before export, and avoid the fallback mode unless you explicitly place the intended Apifox JSON where the tool expects it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: skill.yaml:41
Finding: Shell Command Injection Through Unquoted Trigger Parameters
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: script/auto-export-playwright.js:172
Finding: Hard-Coded and Ambiguous Project Selection Can Export the Wrong Project
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: script/auto-export-playwright.js:153
Finding: Authenticated Full-Page Screenshots Are Persistently Stored Without Cleanup
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: script/auto-export.js:55
Finding: Fallback Export Processes the Newest Arbitrary JSON File in Downloads
Content: View full analysis
latestTime) { latestTime = stat.mtimeMs; latestJson = filePath; } } } } if (!latestJson) { console.error('❌ 未找到 JSON 文件'); console.log('💡 请先在 Apifox 中手动导出一次'); process.exit(1); } console.log(`✅ 找到文件：${latestJson}`); // 步骤 3: 移动到目标位置 console.log(''); console.log('📂 步骤 3: 移动文件到正确位置...'); const targetPath = path.join(SCRIPT_DIR, 'source.json'); fs.copyFileSync(latestJson, targetPath); console.log(`✅ 已复制到：${targetPath}`); ``` ### Technical Analysis The fallback script treats the most recently modified file ending in `.json` anywhere in the user's Downloads directory as the intended Apifox export. It does not verify the filename, download origin, OpenAPI version, required schema properties, creation time relative to the export operation, or user intent. Consequently, unrelated JSON data can be copied into the OpenClaw workspace. If that JSON also has compatible `paths` and schema-like fields, `export.js` may reproduce portions of it in the desktop report. Otherwise, processing may fail after the unintended copy has already occurred. ### Attack Path 1. An unrelated or sensitive JSON file becomes the newest JSON file in Downloads. 2. The user runs the fallback export mode. 3. The script selects that file solely by modification time and extension. 4. It copies the file to ...[truncated 701 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:6
Finding: Dependency Installation Is Not Reproducibly Pinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
修改 `script/auto-export-playwright.js` 开头的默认配置：

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx playwright install chromium without pinning a specific Playwright version. npx may resolve and execute whatever package version is available at install time, which weakens reproducibility and creates a supply-chain risk if an unexpected or compromised version is fetched.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrase 更新接口文档 is a common natural-language request meaning 'update API documentation,' which can easily overlap with ordinary user conversation. Overly broad triggers increase the chance of unintended skill activation, causing actions to run in contexts the user did not explicitly intend.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are very broad, including common requests like '更新接口文档' and '导出接口', which can overlap with normal user workflow language. That increases the chance of accidental invocation of a powerful browser automation skill that logs into Apifox, navigates projects, and exports potentially sensitive API data without the user explicitly intending to launch this capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill says login is 'automatically saved' but does not clearly warn that browser login state will be persistently stored locally in a reusable profile directory. In this context, persistent session artifacts for a cloud API/documentation platform may expose authenticated access to other local users, malware, backups, or later unintended automation runs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The installation instructions use npx playwright install chromium without pinning a specific package version, which can pull whatever version is current at execution time. In a skill context, this weakens supply-chain integrity and reproducibility because users may execute newer or compromised dependency code than the author originally tested.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The install script invokes npx playwright without pinning an exact package version, which allows resolution of whatever version is current in the registry or otherwise available in the environment at execution time. In a package intended to automate browser-based export tasks, this increases supply-chain risk and can lead to unexpected or vulnerable code being executed during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Playwright browser is launched with a persistent profile directory, causing authentication cookies and session state to be stored and silently reused across runs. In a script that automates access to an authenticated SaaS platform and exports potentially sensitive API documentation, this increases the risk of unintended account reuse, credential theft from local disk, and unauthorized exports by any process or user with access to that profile directory.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script invokes a second local Node.js program through child_process.execSync, which expands its capability beyond browser automation into arbitrary local code execution. In this context, the called script path is fixed rather than user-controlled, so this is not immediate command injection, but it still creates a risky execution chain because any tampering with export.js or the workspace path would run with the user's privileges and can process sensitive exported API data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script enumerates the user's Downloads directory, selects the most recently modified JSON file, and copies it into a workspace location without explicit user confirmation or strong validation that the file is actually the intended Apifox export. This can unintentionally collect unrelated sensitive JSON data from Downloads and move it into another tool-controlled directory, which is a privacy and data-handling risk even if the apparent goal is convenience automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Console messages, filenames, and inline user instructions are written in Chinese throughout the script, effectively forcing a specific language for users. The file does not provide a language selection mechanism or document that the skill is intentionally region- or locale-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script unconditionally writes the generated export to a predictable file on the user's Desktop. Because the content comes from API definitions and example payloads, it may include sensitive internal endpoints, headers, request bodies, or sample data, and placing it on the Desktop increases the chance of accidental exposure to other local users, screen sharing, backup/sync tools, or shoulder surfing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "导出接口" is very generic and can plausibly appear in ordinary conversation or broader workflow requests, causing the skill to activate unexpectedly. Because activation launches a Node.js automation script that performs browser-driven export actions, accidental invocation could expose internal API documentation or cause unintended automation against the user's Apifox account.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The parameterized triggers use broad catch-all capture groups like (.+) for team and project names, with little structural constraint on what user utterances are considered valid matches. This increases the chance of unintended activation and ambiguous parameter extraction, which is risky here because the captured values are passed into command-line arguments for an automation script that accesses and exports project data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The user-facing documentation is entirely in Chinese and does not indicate that other languages are supported or that Chinese is optional. This can violate language/locale policy when a skill effectively requires a specific language without offering user choice or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The package description is written as a definitive Chinese-language skill description ('全自动从 Apifox 导出接口数据并整理成标准格式的文档') with no indication that language is selectable or that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 86% confidence
Finding: Using a caret range for playwright permits automatic installation of newer minor/patch releases, which weakens reproducibility and can unintentionally pull in a compromised or incompatible version. In an automation tool that controls a browser and processes exported data, dependency drift raises supply-chain exposure even though the manifest does not itself contain direct malicious behavior.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
"install-playwright": "npx playwright install chromium" }, "dependencies": { "playwright": "^1.40.0" }, "keywords": [ "apifox",

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 74% confidence
Finding: The manifest depends on Playwright without an exact pin, while the package family has a cited advisory related to browser downloads lacking authenticity verification. Because this project explicitly installs Chromium via Playwright, the skill context makes the issue more relevant: installation may fetch external browser binaries, increasing exposure if an affected Playwright release is resolved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script's comments, UI selectors, and default values are written for a Chinese-language Apifox environment, including fixed Chinese team and project names. There is no natural-language indication that the skill is limited to this locale or any option for users to opt into a different language/context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: All visible console messages are in Chinese, and the file provides no option to select another language or indication that the skill is intended only for a Chinese-speaking audience. This can violate a language/locale policy when a skill imposes a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script accesses HOME/USERPROFILE/HOMEPATH to derive workspace and output locations, which is access to sensitive environment-derived user path information. There is no docstring or upfront user warning explaining that the script will inspect environment variables to locate the user's workspace and Desktop.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language content in this skill, including description and command triggers, appears to require Chinese usage without offering an alternative language or an explicit locale-specific justification. That can violate language or locale policy when users are not given a choice or informed that the skill is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: script/auto-export-playwright.js:364

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: script/auto-export.js:28