other
Error
- Location
SKILL.md:50- Finding
Sensitive Provider API Keys Transmitted to an Unverified Third-Party Relay
- Content
View full analysis
- Remediation
View remediation
Security audit
BYOK Relay Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it asks apps to send and store users' paid AI API keys with an external relay by default, so it needs careful review before use.
Use the managed relay only if you are comfortable with its operator holding encrypted provider keys and processing prompts. For production, sensitive users, or organization-wide keys, prefer a self-hosted or app-controlled backend pinned to an audited release, use scoped and budget-limited provider keys, disclose relay operator/privacy/retention terms to users, and keep shared relay tokens out of browsers.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:67- Finding
Unpinned Remote Repository and Dependency Installation
- Content
View full analysis
.env echo "ALLOWED_ORIGINS=https://your-app.com" >> .env npm start ``` A similar Docker installation path appears at lines 78–81: ```bash git clone https://github.com/avikalpg/byok-relay.git cd byok-relay cp .env.example .env # edit ENCRYPTION_SECRET and ALLOWED_ORIGINS docker compose up -d ``` ### Technical Analysis The setup instructions clone the mutable default branch of a remote repository without pinning a reviewed commit, signed tag, release archive, or cryptographic checksum. They then execute `npm install` and `npm start`, or launch the repository's Docker Compose configuration. This means the effective code executed by users can change after the Skill has been reviewed. The audited artifact does not contain the referenced repository's server source, package manifest, lockfile, lifecycle scripts, container definitions, or dependency tree. Those components therefore cannot be validated as part of this audit. `npm install` may execute package lifecycle scripts, while `npm start` executes repository-controlled application code. The launched service is especially sensitive because it may have access to the relay encryption secret, stored provider credentials, relay tokens, network access, and its backing database. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, a package dependency, or a transitive dependency. 2. The attacker modifies the default branch, dependency declarations, lifecycle scripts, startup command, or Docker configuration. 3. A user follows the Skill and clones the current default branch. 4. `npm install` downloads the changed dependency graph an ...[truncated 1139 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:91- Finding
Long-Lived Relay Bearer Token Persisted in Browser localStorage
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash git clone https://github.com/avikalpg/byok-relay.git cd byok-relay && npm install echo "ENCRYPTION_SECRET=$(openssl rand -hex 32)" > .env echo "ALLOWED_ORIGINS=https://your-app.com" >> .env npm start
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash git clone https://github.com/avikalpg/byok-relay.git cd byok-relay && npm install echo "ENCRYPTION_SECRET=$(openssl rand -hex 32)" > .env echo "ALLOWED_ORIGINS=https://your-app.com" >> .env npm start
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash git clone https://github.com/avikalpg/byok-relay.git cd byok-relay && npm install echo "ENCRYPTION_SECRET=$(openssl rand -hex 32)" > .env echo "ALLOWED_ORIGINS=https://your-app.com" >> .env npm start
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - Show "Rotating…" state; confirm success or failure clearly - Recommended cadence: every 90 days or on any suspected compromise **Deletion (`DELETE /keys/:provider`):** - Immediate effect — all in-flight requests using that key will fail - Prompt the user to confirm before deleting - After deletion, set UI state to `disconnected` and hide key actions
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - Prompt the user to confirm before deleting - After deletion, set UI state to `disconnected` and hide key actions **Account erasure (`DELETE /users`):** - Deletes all stored keys and the relay token (GDPR Art. 17) - Include in account-deletion or data-export flows - Irreversible — warn the user explicitly
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md When integrating byok-relay, always generate a styled API key input component that matches the app's existing design system. This is a required part of the integration — the relay is useless without a UI for users to enter their keys. **Never prefill the input with a stored key value.** The relay never returns stored key material. If a key is already stored, show a masked placeholder (e.g. `sk-...••••••••`) or a "Key already saved" badge — never the actual key. **What to generate:** - A settings panel or modal with a password-type `<input>` for the API key
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest and early documentation emphasize a client-side, zero-backend relay for frontend applications. However, the organization flow explicitly requires an app backend to create relay users server-side, proxy relay requests, and withhold relay tokens from browsers, which materially exceeds the advertised 'no dedicated backend' usage model for that documented integration path.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The stated purpose is helping client-side apps use a BYOK relay for multi-provider LLM access. This section introduces relay-side traffic attribution via logged User-Agent values and GET /stats observability, which is ancillary operator analytics behavior not surfaced in the manifest description.
- Content
Static analysis
No suspicious patterns detected.