api-docs-gen
3 findings (1 critical, 1 high, 1 medium), mainly data exfiltration, social engineering, unauthorized tool use. Most recent scan 2026-02-05.
This skill presents CRITICAL security risks due to undisclosed external data transmission. While marketed as a simple local documentation generator ('Zero config. Just works'), it actually sends user code to OpenAI's API, potentially exposing proprietary business logic, API implementations, and hardcoded credentials. The description is deceptive through omission, failing to disclose the OPENAI_API_KEY requirement and external data transmission. Additional concerns include unverified npm package execution via npx without version pinning, and the high likelihood of credential exposure from route files. The skill requires significant transparency improvements and user consent mechanisms before it can be considered safe for use with sensitive codebases.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Generate API documentation from route files. Use when you need markdown or OpenAPI specs fast.
- Package
- 7 files, 52 KB
- SKILL.md
- 319 words, 12+ sections
- Code
- TypeScript (2)
SKILL.md covers: API Docs Generator · Quick Start · What It Does · Usage Examples · Generate markdown docs · → API_DOCS.md · Generate OpenAPI spec · Custom output path · Scan multiple directories · Best Practices · When to Use This · Part of the LXGIC Dev Toolkit
Findings
CRITICAL Hardcoded External API Dependency with Required Credentials Data Exfiltrationllm
The skill requires an OPENAI_API_KEY environment variable to function, which means it will access and potentially transmit user code to OpenAI's external servers. The skill reads user route files containing potentially sensitive business logic, API structures, and implementation details, then sends this data to a third-party service (OpenAI) without explicit user consent or disclosure in the description. This constitutes data exfiltration of proprietary code to external servers.
SKILL.md
Requirements section states: 'Needs OPENAI_API_KEY environment variable' and 'How It Works' section reveals: 'uses GPT-4o-mini to infer request/response shapes'. The tool reads user's route files and sends them to OpenAI's API.HIGH Deceptive Description Omits Critical External Dependency Social Engineeringllm
The skill description claims 'One command. Zero config. Just works' and 'No install needed. Just run with npx', but fails to disclose that it requires an OPENAI_API_KEY environment variable and sends user code to external servers. This is social engineering through omission - the description makes it sound like a simple local tool when it actually transmits potentially sensitive code to third-party services. Users may unknowingly expose proprietary API implementations.
SKILL.md
Description: 'Generate API documentation from route files. Use when you need markdown or OpenAPI specs fast.' vs Reality (line 45): 'Needs OPENAI_API_KEY environment variable' and sends code to OpenAI API. The marketing language 'Zero config. Just works' contradicts the requirement for API key configuration.MEDIUM Uncontrolled External Tool Execution via npx Unauthorized Tool Usellm
The skill instructs the agent to execute 'npx ai-api-docs' which downloads and runs arbitrary code from npm registries without version pinning or integrity verification. This creates a supply chain attack vector where a compromised or malicious npm package could execute arbitrary code on the user's system. The tool name 'ai-api-docs' is not a well-known package and could be subject to typosquatting or package takeover.
SKILL.md
All examples use 'npx ai-api-docs' without version specification: 'npx ai-api-docs ./src/routes/', 'npx ai-api-docs ./src/routes/ --format openapi', etc. No package verification, no version pinning, no integrity checks.What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 467 B |
SKILL.md | doc | 2.2 KB |
package-lock.json | config | 46 KB |
package.json | config | 625 B |
tsconfig.json | config | 217 B |
src/cli.ts | script | 1.2 KB |
src/index.ts | script | 1.4 KB |
External hosts referenced
registry.npmjs.org github.com feross.org www.patreon.com lxgicstudios.com lxgicstudios.substack.com paypal.me x.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/api-docs-gen
- Raw scan result: api-docs-generator-scan.json
- Badge for your README:
- Request a re-scan