OSINT Information

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 1.0.9

Overview

This skill is a disclosed OSINT API wrapper; it sends API queries, including domains, usernames, emails, and a bearer key, to one hosted service without hidden local persistence or destructive behavior.

Install only if you are comfortable sending OSINT targets and your OSINT_API_KEY to osint.ahsan-tariq-ai.xyz. Avoid submitting sensitive or third-party email addresses unless you have authorization, and consider rotating the API key if the service ever behaves unexpectedly or redirects requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/osint_api.py:37

Finding

Bearer API Key May Be Forwarded During Cross-Origin Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/osint_api.py, lines 37–49
Vulnerability Type: Authorization credential exposure through unrestricted redirects
Risk Level: Medium

python

def make_request(method, path, data=None):
    """Make an authenticated HTTPS request to the OSINT API."""
    url = f"{BASE_URL}{path}"
    body = None
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {API_KEY}",
    }

    if data:
        body = json.dumps(data).encode("utf-8")

    req = Request(url, data=body, headers=headers, method=method)

    try:
        with urlopen(req, timeout=30) as resp:

Technical Analysis

The request attaches OSINT_API_KEY as a bearer credential and passes the request to Python's urllib.request.urlopen. The standard URL opener automatically processes HTTP redirects, but this implementation does not validate each redirect destination, enforce the documented hostname on the final URL, or explicitly remove the Authorization header when an origin changes.

Consequently, a redirect issued by the configured API service could cause the client to forward the authenticated request to an unintended host. Exploitation requires control or compromise of the API service, its redirect-producing infrastructure, or an equivalent trusted TLS termination point. Ordinary network interception is constrained by HTTPS certificate validation.

This behavior exceeds the documented network boundary that requests and credentials are sent only to osint.ahsan-tariq-ai.xyz.

Attack Path

1. A user configures a valid OSINT_API_KEY and invokes the helper.
2. The helper sends an authenticated request to the declared API host.
3. An attacker who controls or has compromised the API endpoint returns an HTTP redirect to an attacker-controlled HTTPS origin.
4. The client automatically follows the redirect without checking that the hostname remains ...[truncated 705 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic redirect handling for authenticated requests, or use a custom HTTPRedirectHandler.
• Before following a redirect, parse and normalize the destination URL and require:
  • The scheme to be exactly https.
  • The hostname to be exactly osint.ahsan-tariq-ai.xyz.
  • The port to be the expected HTTPS port.
• Remove the Authorization header whenever the scheme, hostname, or port changes.
• Apply a small redirect limit to prevent redirect loops.
• Consider rejecting redirects entirely because the API has one fixed, documented origin.
• Add automated tests covering same-origin redirects, cross-origin redirects, scheme downgrades, and credential-header removal.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/osint_api.py:87

Finding

Email Address Exposed Through Breach-Check URL Path

Content

View full analysis

Vulnerability Details

File Location: scripts/osint_api.py, lines 87–88
Vulnerability Type: Sensitive personal data placed in a request URL
Risk Level: Low

python

    elif args.command == "breach":
        result = make_request("GET", f"/breach/{quote(args.email)}")

Technical Analysis

The breach-check operation embeds the supplied email address directly into the URL path. URL encoding changes the representation of reserved characters but does not make the value confidential.

HTTPS protects the request path while it is in transit between the client and TLS endpoint. It does not prevent the complete URL from being recorded by API gateways, reverse proxies, CDN infrastructure, web-server access logs, observability systems, or monitoring platforms. This can give an email address broader retention and access than data carried in a request body.

Sending the email to the service is necessary for the declared breach-check functionality, but placing it in the URL is not the minimum-exposure design.

Attack Path

1. A user invokes breach --email [e-mail].
2. The helper constructs a request path containing the encoded email address.
3. The request passes through the service's gateway, proxy, CDN, web server, or monitoring infrastructure.
4. One or more components record the complete request URL.
5. An unauthorized operator, compromised logging account, or attacker with access to retained logs retrieves the email address and associates it with a breach-check request.

Impact Assessment

Exploitation does not grant local or API privileges. The primary impact is privacy loss through disclosure and retention of personally identifiable information. Exposure may reveal that a particular address was submitted for breach investigation and may increase phishing, profiling, or account-targeting risk.

The precise server-side exposure depends on the hosted service's logging and retention configu ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the URL-path API with an authenticated POST endpoint.
• Send the email in a JSON request body, for example {"email": "[e-mail]"}.
• Configure gateways, servers, and observability systems not to log sensitive request bodies.
• Apply explicit access controls, encryption, redaction, and short retention periods to operational logs.
• Document that the email is transmitted to the hosted service and explain its retention and deletion policy.
• If the remote API cannot be changed, redact the breach endpoint path from all server-side logs and monitoring telemetry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/osint_api.py (reported line 49)May include surrounding context.

python

req = Request(url, data=body, headers=headers, method=method)

    try:
        with urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except HTTPError as e:
        print(f"Error: HTTP {e.code} — {e.read().decode()}", file=sys.stderr)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose understates or omits sensitive behaviors, notably social username lookups and breach checks against email addresses, while also claiming capabilities like RSS aggregation and feed health monitoring that are not evidenced here. This mismatch is dangerous because it can mislead users and automated policy systems about what data is being sent to the external service, causing accidental transmission of sensitive personal identifiers to a third-party API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises breach checks, social lookups, and domain reconnaissance but does not clearly warn that the supplied email addresses, usernames, and domains are transmitted to a third-party OSINT API. This creates a privacy and operational security risk because users may unknowingly submit sensitive investigative targets, personal identifiers, or proprietary domains to an external service, potentially exposing their interests or data to logging, retention, or misuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly requires an API key and documents multiple external API calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance and review gap: an agent or reviewer cannot reliably determine from policy metadata that the skill needs network and environment access, increasing the risk of unintended secret exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest advertises a /breach/{email} endpoint that enables querying breach information by email address, which extends beyond the skill’s stated purpose of OSINT feed reporting and domain recon. Exposing a direct breach-lookup capability can facilitate privacy-invasive enumeration of individuals, especially if the skill is broadly accessible and lacks clear authorization, rate limiting, or abuse controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/osint_api.py (reported line 31)May include surrounding context.

python

if not API_KEY:
    print("Error: OSINT_API_KEY environment variable is required.", file=sys.stderr)
    print("Get a key: curl -X POST https://osint.ahsan-tariq-ai.xyz/api/v1/signup -d 'email=[e-mail]'", file=sys.stderr)
    sys.exit(1)

def make_request(method, path, data=None):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The breach-check command sends an email address, which is sensitive personal data, to a third-party external service without any explicit privacy warning, consent step, or minimization control. In an agent skill context, this increases the chance that a user or downstream automation submits another person's email address to an external provider without understanding the disclosure implications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring states 'OSINT_API_KEY (optional, for authenticated endpoints)', implying the skill can operate at least partially without the key. In practice, the script unconditionally reads OSINT_API_KEY and exits immediately if it is absent, so all commands require authentication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.