Expanso keyword-extract

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:56 PM UTC
• Version: 1.0.0

Overview

The skill performs the advertised keyword extraction, but its network-facing mode can expose an unauthenticated OpenAI-backed endpoint using the operator's API key.

Review this skill before installing or running it. Use it only with non-sensitive text unless your organization permits sending that content to OpenAI, bind the HTTP mode to localhost or put it behind authentication, and use a restricted OpenAI key with spending limits if you run the server mode.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: pipeline-mcp.yaml:11

Finding

Unauthenticated Externally Bound LLM Endpoint

Content

View full analysis

Vulnerability Details

File Location: pipeline-mcp.yaml, lines 11-19
Vulnerability Type: Unauthenticated network service and unrestricted paid API access
Risk Level: High

Vulnerable Code

yaml

config:
  http:
    enabled: true
    address: "0.0.0.0:${PORT:-8080}"

  input:
    http_server:
      path: /extract
      allowed_verbs: [POST]
      timeout: 60s

Requests accepted by this endpoint are subsequently sent to OpenAI:

yaml

      - openai_chat_completion:
          api_key: "${OPENAI_API_KEY}"
          model: gpt-4o-mini

Technical Analysis

The HTTP service listens on 0.0.0.0, making it available through every network interface permitted by the host and surrounding network controls. The pipeline does not define authentication or authorization for the /extract endpoint.

Every accepted request reaches the openai_chat_completion processor and uses the operator-provided OPENAI_API_KEY. Consequently, any client capable of reaching the service can trigger a paid third-party API operation under the operator's account. The HTTP input also lacks an explicit request-body size limit, rate limit, concurrency limit, and validated upper bound for the client-controlled max_keywords value.

Attack Path

1. An attacker discovers or otherwise reaches the host's exposed port, which defaults to TCP port 8080.
2. The attacker submits unauthenticated POST requests to /extract containing arbitrary text.
3. The pipeline incorporates the attacker-controlled text and max_keywords value into an OpenAI request.
4. The openai_chat_completion processor authenticates to OpenAI using the operator's OPENAI_API_KEY.
5. The attacker repeats requests, or submits large request bodies, to consume API quota and local processing capacity.
6. Costs and resource consumption accrue to the service operator without the attacker needing access to the API key itself.

Im

...[truncated 510 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind the service to loopback by default, such as 127.0.0.1:${PORT:-8080}, unless remote access is explicitly required.
2. Require authentication and authorization before allowing requests to reach the pipeline. Use short-lived credentials or securely managed API tokens.
3. If public exposure is necessary, place the service behind a TLS-enabled reverse proxy or API gateway with authentication, network access controls, and request auditing.
4. Add per-client and global rate limits, concurrency limits, request timeouts, and usage quotas.
5. Configure a strict HTTP request-body size limit appropriate for the intended workload.
6. Validate text as a bounded string and constrain max_keywords to a safe integer range, such as 1 through a documented maximum.
7. Apply OpenAI account-level spending limits, usage alerts, and restricted project credentials to limit financial impact.
8. Avoid exposing detailed credentials or sensitive request content in logs, and monitor for abnormal request volume and API spending.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README shows users supplying arbitrary text to the skill and configuring an OPENAI_API_KEY, but it does not clearly warn that submitted content may be transmitted to an external AI service. This can lead users to send sensitive, proprietary, or regulated data under the mistaken assumption processing is purely local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

bash

PORT=8080 expanso-edge run pipeline-mcp.yaml &
curl -X POST http://localhost:8080/extract \
  -H "Content-Type: application/json" \
  -d '{"text": "Machine learning is transforming...", "max_keywords": 10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · pipeline-mcp.yaml (reported line 6)May include surrounding context.

yaml

#
# Usage:
#   PORT=8080 expanso-edge run pipeline-mcp.yaml &
#   curl -X POST http://localhost:8080/extract -d '{"text": "..."}'

name: "keyword-extract-mcp"
type: pipeline

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

User-supplied text is forwarded directly to the OpenAI API, which sends potentially sensitive input to an external third party. In a skill context, this is dangerous because users or operators may assume local processing, and the file contains no consent, warning, filtering, or policy controls to prevent accidental disclosure of secrets, personal data, or proprietary content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest declares an OpenAI remote backend and an OpenAI API key, which means user-supplied text may be sent to a third-party service, but it does not disclose that off-box transmission may occur. This creates a real privacy and data-handling risk because users may provide sensitive text under the assumption that processing is local, especially since the skill also advertises a local Ollama backend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file comment says this is "keyword-extract (MCP mode)" and the skill name also suggests MCP usage, which implies a model-context-protocol style integration. However, the configuration explicitly enables an HTTP server bound to 0.0.0.0 and exposes a POST /extract endpoint, which is a different interface surface than the comment suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.