EzyHost

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:18 PM UTC
• Version: 1.0.3

Overview

The skill is a coherent EzyHost API helper, but it under-declares credential use and exposes many destructive account actions without clear confirmation guidance.

Install only if you trust EzyHost with the API key and are comfortable with an agent managing hosted projects, files, domains, teams, captured emails, and API keys. Require explicit confirmation before any delete, rollback, domain, team, email export, or API-key action, and treat EZYHOST_API_KEY as a secret despite the manifest saying credentials are not sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:7
• Finding: API Credential Access Incorrectly Declared as Non-Sensitive<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 7–20; related credential transmission instructions at lines 31–39 **Vulnerability Type**: Sensitive credential metadata misconfiguration **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: emoji: "🚀" requires: env: - EZYHOST_API_KEY primaryEnv: EZYHOST_API_KEY permissions: version: 1 declared_purpose: "Deploy and manage static websites on EzyHost. Upload files, run SEO analysis, track analytics, generate sites with AI, configure custom domains, manage versions, teams, QR codes, and email capture." network: - "ezyhost.io" env: - "EZYHOST_API_KEY" filesystem: [] exec: [] sensitive_data: credentials: false ``` The same file explicitly instructs the agent to use this environment variable as an authentication credential: ```text All API requests require an API key passed as a header: x-api-key: $EZYHOST_API_KEY The key is loaded from the `EZYHOST_API_KEY` environment variable. ``` ### Technical Analysis The Skill requires access to `EZYHOST_API_KEY`, designates it as its primary environment variable, and transmits its value as an HTTP authentication header. Despite this behavior, the permissions metadata declares `sensitive_data.credentials: false`. An API key is credential material regardless of whether it is stored in an environment variable or sent only to the intended service. This contradictory declaration can cause runtimes, security scanners, consent interfaces, or logging systems that rely on the manifest to omit credential-specific safeguards. The file does not contain a hardcoded key or direct evidence that the key is intentionally sent to an unrelated destination. The vulnerability is therefore a security metadata and handling defect rather than confirmed credential theft. ### Attack Path 1. A user installs or invokes the Skill and provides `EZYHOST_API_KE ...[truncated 1403 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Correct the manifest so that credential use is explicitly declared: ```yaml sensitive_data: credentials: true ``` 2. Preserve the existing network allowlist and ensure the API key can be transmitted only to the exact approved HTTPS origin, `https://ezyhost.io`, rather than arbitrary hosts or redirects. 3. Prevent the API key and complete authentication headers from appearing in: - Agent responses - HTTP debug output - Error messages - Telemetry - Execution transcripts - Persistent memory or generated files 4. Apply automatic redaction to `EZYHOST_API_KEY`, `x-api-key`, and equivalent authorization fields. 5. Provide the credential only to the specific request process that needs it instead of exposing it broadly to unrelated tools or subprocesses. 6. Require explicit user confirmation before destructive or security-sensitive operations, including project deletion, bulk file deletion, domain removal, team changes, API-key generation, and API-key revocation. 7. Support immediate key revocation and rotation, and document the response procedure for suspected disclosure. 8. If supported by EzyHost, use scoped, short-lived, or project-specific credentials instead of an account-wide long-lived API key. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Project
```
DELETE /api/projects/:id
```
Deletes the project and all associated files from storage. This cannot be undone.

• Confidence: 94% confidence
• Finding: The documented `DELETE /api/projects/:id` operation is inherently dangerous because a parameterized destructive endpoint can be invoked on the wrong project if an agent mis-resolves or is prompted with a malicious ID. The context increases risk because deletion is irreversible and removes all associated files from storage.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a File
```
DELETE /api/upload/:projectId/files/:fileId
```

#### Bulk Delete Files

• Confidence: 90% confidence
• Finding: Deleting files by `projectId` and `fileId` is a legitimate feature, but parameterized destructive actions are susceptible to accidental or malicious misuse if an agent accepts untrusted identifiers. Without guidance to validate object ownership and confirm targets, important site assets could be removed unexpectedly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Captured Email
```
DELETE /api/emails/:projectId/:emailId
```

---

• Confidence: 87% confidence
• Finding: Deleting captured emails is a destructive action against potentially business-relevant records and privacy-related data. An agent could be induced to delete the wrong record or erase audit-relevant entries if it accepts arbitrary IDs without verification.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Remove Team Member
```
DELETE /api/teams/:teamId/members/:memberId
```

#### Leave Team

• Confidence: 88% confidence
• Finding: Removing a team member is a permission-affecting destructive action that can disrupt collaboration or revoke access from the wrong person if identifiers are mishandled. In agent workflows, free-form parameter use makes this endpoint prone to abuse or mistakes.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Team
```
DELETE /api/teams/:teamId
```

---

• Confidence: 92% confidence
• Finding: Deleting a team is a high-impact destructive operation that can remove a collaboration structure and potentially disrupt access and administration for multiple users. The skill does not add any safety guidance around confirmation or target verification, increasing the risk of agent misuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Remove Domain
```
DELETE /api/domains/:projectId
```

---

• Confidence: 86% confidence
• Finding: Removing a custom domain can cause service disruption, broken links, and loss of expected routing if done on the wrong project. Because this is a parameterized destructive action with operational impact, agent misuse or prompt-injected IDs could produce an outage-like effect.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

GET    /api/aibuilder/templates/:id       — get template details
POST   /api/aibuilder/templates           — save new template
PATCH  /api/aibuilder/templates/:id       — update template
DELETE /api/aibuilder/templates/:id       — delete template
```

Template body: `{ "name": "My Template", "description": "...", "messages": [...], "files": [...] }`

• Confidence: 83% confidence
• Finding: Deleting AI builder templates is a legitimate management action, but it is still a destructive parameterized endpoint that can remove reusable assets if an agent is tricked into using the wrong template ID. The risk is lower than project deletion but still real in an automated setting.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Revoke Key
```
DELETE /api/apikey
```

---

• Confidence: 95% confidence
• Finding: Revoking the current API key is a high-impact security and availability action because it immediately invalidates access for the skill and any dependent automation. An agent tricked into calling this endpoint could cause denial of service for legitimate workflows and force emergency key rotation.

Scope Creep

Medium

• Confidence: 98% confidence
• Finding: The manifest declares `sensitive_data.credentials: false` even though the skill explicitly requires and uses `EZYHOST_API_KEY` for authenticated API calls. This can cause downstream policy engines or users to underestimate the sensitivity of the environment variable and permit unsafe handling, logging, or exposure of the key.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes an irreversible project deletion endpoint but does not instruct the agent to obtain explicit confirmation before invoking it. In an agentic workflow, lack of a confirmation guard materially raises the risk of accidental destructive actions and permanent data loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents exporting captured emails as CSV without any warning that this data is personally identifiable information. In an agent context, omission of privacy handling guidance increases the chance that user email lists are exported, stored, or shared without appropriate consent, minimization, or access controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. Check subdomain availability
curl https://ezyhost.io/api/projects/check-subdomain/my-site \
  -H "x-api-key: $EZYHOST_API_KEY"

# 2. Create a project

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.