Zyla API Hub Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:10 AM UTC
• Version: 1.0.7

Overview

This is a coherent Zyla API Hub integration, but it handles API keys and configurable network destinations in ways users should review before installing.

Install only if you are comfortable giving this skill a Zyla API key for paid third-party API calls. Review the configured hub URL before use, avoid sharing sensitive personal or financial data unless needed, rotate the key if it appears in chat or logs, and prefer a protected secret store over plaintext config where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/config.ts:9

Finding

Bearer API Credential Can Be Redirected to an Arbitrary Host

Content

View full analysis

[k, String(v)]) ).toString(); if (qs) url += `?${qs}`; } else if (args.params) { (fetchOptions.headers as Record)["Content-Type"] = "application/json"; fetchOptions.body = JSON.stringify(args.params); } const res = await fetch(url, fetchOptions); ``` ```ts // plugin/index.ts:285-289 const res = await fetch(`${hubUrl}/api/openclaw/health`, { headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json", }, }); ``` ### Technical Analysis Both the CLI and plugin obtain a bearer credential and attach it to requests whose origin is controlled by configuration. The CLI trusts `ZYLA_HUB_URL`, while the plugin exposes `hubUrl` as an unrestricted string in its public configuration schema. ...[truncated 1788 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: plugin/index.ts:42

Finding

Unbound Local Authentication Callback Permits Token Replacement and Chat Disclosure

Content

View full analysis

{ const url = new URL(req.url || "/", `http://127.0.0.1`); if (url.pathname === "/auth/callback") { const token = url.searchParams.get("token"); if (token) { res.writeHead(200, { "Content-Type": "text/html" }); res.end(` Connected!

Connected!

Your Zyla API Hub account is linked to OpenClaw.

You can close this tab.

`); resolveToken(token); } else { res.writeHead(400, { "Content-Type": "text/plain" }); res.end("Missing token parameter"); rejectToken(new Error("No token received in callback")); } } else { res.writeHead(404, { "Content-Type": "text/plain" }); res.end("Not found"); } }); ``` ```ts // plugin/index.ts:123-127 api.registerCommand({ name: "zyla", description: "Connect to Zyla API Hub or check status. Usage: /zyla connect | /zyla status", acceptsArgs: true, requireAuth: false, ``` ```ts // plugin/index.ts:223-270 const callbackUrl = `http://127.0.0.1:${port}/auth/callback`; const connectUrl = `${hubUrl}/openclaw/connect?callback=${encodeU ...[truncated 3445 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/generate-popular.ts:104

Finding

Untrusted Catalog Content Can Be Converted into Persistent Skill Instructions

Content

View full analysis

` ); lines.push(``); lines.push(""); for (const api of apis) { const keywords = generateKeywords(api); const apiSlug = slugify(api.name); lines.push(`### ${api.name} (ID: ${api.id})`); lines.push(`- **Use when**: ${keywords}`); if (api.category) { lines.push(`- **Category**: ${api.category}`); } for (const ep of api.endpoints.slice(0, 3)) { const epSlug = slugify(ep.name); const requiredParams = ep.parameters.filter((p) => p.required); const paramStr = requiredParams .map((p) => `${p.key} (${p.type}, required)`) .join(", "); const optionalParams = ep.parameters.filter((p) => !p.required); const optParamStr = optionalParams.length > 0 ? ` + optional: ${optionalParams.map((p) => p.key).join(", ")}` : ""; lines.push( `- **${ep.method}** \`${ep.name}\` (ID: ${ep.id}): ` + `${paramStr || "no required params"}${optParamStr}` ); const exampleParams = Object.fromEntries( requiredParams.map((p) => [p.key, p.example || `<${p.type}>`]) ); lines.push( ` - Example: \`npx tsx {ba ...[truncated 3170 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a runtime skill that powers an AI agent with access to many external APIs. However, this code chunk does not expose or invoke those APIs for agent use. Its primary function is build/documentation tooling: it requests the catalog endpoint, processes the returned metadata, and emits markdown to stdout for insertion into SKILL.md. While this is related to Zyla API Hub, it is materially different from the declared purpose of turning the agent into a 'real-world operator' with broad API access. The network access shown is only to retrieve catalog metadata, not to perform weather/finance/translation/etc. operations. Therefore the code’s actual behavior is narrower and different enough to count as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description suggests a skill that enables an AI agent to operate using Zyla's large API marketplace across many real-world functions. However, the supplied code only queries a public catalog endpoint and returns metadata about available APIs and their endpoints. Its commands are limited to search, list, and endpoint inspection. There is no implementation for calling weather, finance, translation, or other production APIs, no authentication flow for using such APIs, and no agent-facing trigger/integration behavior. This is a materially narrower and different primary purpose than the declared skill description.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

<!-- This section is auto-generated by: npx tsx scripts/generate-popular.ts -->

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says the browser-based flow captures the user's API key automatically and saves it to config, but provides no warning about where the credential is stored, whether it is encrypted, or how to revoke it. In an agent skill context, silent credential capture and persistence increases the chance of unintended disclosure through logs, filesystem compromise, over-broad file access by other tools, or user misunderstanding about secret handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README explicitly instructs users to place a live API key in plaintext within ~/.openclaw/openclaw.json and even duplicates it in an env field, increasing secret sprawl. In a local agent ecosystem, plaintext credentials in predictable paths are at elevated risk from accidental commits, backups, local malware, permissive file permissions, diagnostic output, and access by other plugins or processes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs use of environment/configured secrets and outbound network access, but it does not declare any explicit tool scope or allowed tools. That weakens least-privilege controls and can let an agent use broader capabilities than users or the platform may expect, especially when the skill is framed as a general API gateway.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill promotes sending inputs like email addresses, geolocation, finance, and other potentially sensitive data to third-party APIs without a clear privacy/data-sharing warning. In this context, omission matters because users may unknowingly disclose personal or regulated data to external services.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

2. Or run `/zyla connect` if the plugin is installed (opens browser automatically)
3. Add the key to `~/.openclaw/openclaw.json` under `skills.entries.zyla-api-hub-skill.apiKey`

Never ask the user to paste their API key in chat. Ask them to set it via the config and confirm when ready.

## Quick Start — Popular APIs

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill repeatedly tells the agent to run npx tsx, which resolves and executes packages from the npm ecosystem without a pinned version in the instruction itself. That creates a supply-chain risk: a compromised or changed package version could alter behavior or execute malicious code at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This invocation again relies on unpinned npx tsx, exposing execution to package substitution or upstream changes. Because the skill is designed to be run by an agent, even documentation examples can become operational instructions that trigger unsafe dependency fetching.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned npx tsx pattern remains a real supply-chain weakness here. If the package or a transitive dependency is hijacked, the agent may execute attacker-controlled code with access to local files, config, and API credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This is another instance of runtime execution through unpinned npx tsx, which is unsafe in an agent context. Repeated insecure invocation patterns increase the chance that the skill will be used exactly as written, normalizing remote code execution from mutable package sources.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The same supply-chain risk applies to this helper command. In a skill that manages third-party API access and secrets, executing unpinned package-manager-resolved tooling materially increases compromise impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This catalog search example still depends on unpinned npx tsx, making it a genuine supply-chain exposure. Even seemingly harmless metadata retrieval commands can be an entry point for malicious package execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command repeats the same unsafe package-resolution pattern. Since an agent may execute documentation examples directly, the risk is operational rather than merely theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using unpinned npx tsx for endpoint discovery is still a true vulnerability because the package source is mutable. Compromise of the toolchain could expose API keys, alter requests, or tamper with catalog data shown to the user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The basic call example routes through unpinned npx tsx, so a package compromise could directly intercept or manipulate live API calls. In this skill context, that is more dangerous because it combines code execution with authenticated outbound requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This POST example carries the same supply-chain risk, with added sensitivity because POST requests may submit user data to third parties. A compromised runtime could exfiltrate request bodies or modify them before transmission.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Fetching API info through unpinned npx tsx remains a real vulnerability due to mutable external dependency resolution. The repeated pattern indicates weak release hygiene rather than an isolated documentation typo.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The health-check command also uses unpinned npx tsx, which could expose billing or quota information and any loaded credentials if the runtime is compromised. Health endpoints are often run frequently, increasing execution opportunities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The billing section still directs users to an unpinned npx tsx command, extending the same supply-chain issue into operational monitoring. Because this skill encourages paid API use, compromised tooling could also induce unexpected charges or conceal abusive usage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.