Saas Gateway

• Outcome: Review
• Latest audit: May 28, 2026 · 9:53 AM UTC
• Version: 1.0.0

Overview

This SaaS gateway is coherent and not deceptive, but it gives broad control over connected third-party accounts and sensitive gateway resources with incomplete per-action guardrails.

Install only if you trust AISA with the SaaS accounts and credentials you connect. Use least-privilege accounts/scopes, avoid pasting secrets into chats or logs, prefer OAuth and scoped tools over raw proxy requests, and require explicit confirmation before any write, delete, webhook, MCP URL/session, file upload/download/delete, project config, or key-rotation action.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README describes very broad usage triggers such as connecting third-party accounts, running tools, managing MCP servers, triggers, webhooks, and usage checks without defining scope limits, approval requirements, or trust boundaries. In an agent setting, this can cause over-invocation on common requests and lead the skill to handle sensitive OAuth, cross-SaaS actions, or webhook/server management in contexts where the user did not intend such powerful operations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section documents sending raw third-party credentials such as API keys, bearer tokens, and BASIC auth passwords to the gateway, but it lacks explicit warnings about secret handling, storage, minimization, redaction, and user consent. In a skill whose purpose is SaaS account connection, this increases the chance that an agent or operator will collect and transmit highly sensitive credentials without adequate safeguards.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The proxy execution endpoint explicitly allows arbitrary raw HTTP requests to third-party APIs using connected-account credentials, but unlike the normal tool execution section it does not require or even warn about explicit user confirmation. In an agent setting, this creates a high-risk confused-deputy capability: the agent could perform unintended reads, writes, or destructive actions directly against integrated SaaS APIs while bypassing the safer schema-bound tool layer.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The session proxy execution endpoint provides the same arbitrary authenticated request capability inside persistent sessions, again without a user-facing warning or confirmation step. Because sessions can persist context and credentials across multiple operations, this increases the chance of stealthy or repeated unauthorized API actions against connected services.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The file deletion example documents a destructive operation with no warning that it permanently removes data or should be confirmed by the user first. In agent-driven workflows, omission of that caution can normalize unsafe execution of destructive actions and lead to accidental data loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation describes generation of personalized MCP connection URLs tied to specific users but does not warn that these URLs may function as sensitive bearer-style access artifacts or expose user-linked access context. In a gateway skill that manages third-party SaaS integrations, omission of handling, sharing, expiry, and disclosure guidance increases the risk of accidental leakage or misuse of per-user access URLs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The project creation section states that setting should_create_api_key=true returns an API key in the response, but it does not clearly label that returned value as a secret requiring immediate secure handling. This can lead agents or users to print, store, or transmit the key insecurely, resulting in compromise of project-wide API access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The delete-trigger example documents a destructive production operation without an adjacent explicit confirmation warning, even though the file's own safety model says POST/PATCH/DELETE can change production automations. In an agent skill, omission of a strong confirm-before-delete requirement increases the chance of accidental trigger removal and automation outages.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The webhook endpoint configuration examples include sensitive credentials such as signing secrets and bot tokens but do not clearly warn that these values are secrets that must not be logged, echoed, or stored insecurely. In agent-driven environments, example secrets often get copied into transcripts, logs, or tool arguments, creating credential exposure risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Deleting a webhook endpoint can break inbound event delivery for dependent integrations, but the example lacks a direct destructive-action warning. Without a clear confirmation requirement, an agent or operator may remove active receivers and silently disrupt webhook processing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Webhook subscription creation and updates transmit event payloads to an external URL, but the documentation does not warn about privacy, data egress, or the need to trust and validate the destination. This can lead to accidental forwarding of operational or user-linked event data to unintended third parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Deleting a webhook subscription stops event delivery, but the example does not explicitly warn about service interruption. In automation contexts, this can disable monitoring, trigger handling, or re-authentication alerts without the operator realizing the downstream impact.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The secret-rotation endpoint immediately invalidates the old secret, yet the documentation does not require explicit confirmation or a coordinated cutover warning. An unplanned rotation can instantly break signature verification and webhook ingestion until downstream consumers are updated.

External Transmission

Medium

• Category: Data Exfiltration

Content

For non-OAuth toolkits that use API keys.

```bash
curl -X POST "https://api.aisa.one/apis/v1/composio/connected_accounts" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: This duplicate finding covers the endpoint that submits direct credentials to the gateway. Because the documented payload includes API keys and passwords, the external transmission is meaningfully sensitive and under-documented from a secure-handling perspective.

External Transmission

Medium

• Category: Data Exfiltration

Content

For non-OAuth toolkits that use API keys.

```bash
curl -X POST "https://api.aisa.one/apis/v1/composio/connected_accounts" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: This duplicate finding covers the endpoint that submits direct credentials to the gateway. Because the documented payload includes API keys and passwords, the external transmission is meaningfully sensitive and under-documented from a secure-handling perspective.

Static analysis

No suspicious patterns detected.