public-api-finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.5.11

Overview

This skill mostly matches its stated API-search purpose, but it needs Review because it runs mutable npm code and encourages external storage of research notes without clear user approval.

Review before installing. Prefer the bundled local fallback or a pinned, reviewed npm version, run it without unnecessary credentials in the environment, and do not enable or use the Vaultline upload unless you explicitly want the shown research content stored with that third-party service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:28

Finding

Unpinned npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-31
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

bash

npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "weather forecast" --no-auth --https
npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "crypto prices" --category Cryptocurrency --limit 5
npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "jobs" --json
npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "payments" --openapi

Technical Analysis

The documented primary workflow uses npx --yes to retrieve and execute @builtbyecho/public-api-finder without specifying an exact reviewed version or integrity hash. The --yes option suppresses the interactive installation prompt.

Consequently, the code executed during a future invocation may differ from the code present when this Skill was audited. A compromised npm publisher account, malicious package update, or supply-chain compromise could introduce arbitrary executable behavior. The bundled Python fallback does not require this mutable package and therefore represents a lower-privilege alternative.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another component in the package dependency chain.
2. The attacker publishes a malicious version under the existing package name.
3. An Agent follows the commands in SKILL.md.
4. npx --yes downloads the current package version without requesting confirmation or verifying a reviewed version.
5. Package lifecycle hooks, dependency code, or the CLI entry point executes with the permissions of the Agent process.
6. Malicious code can access data and resources available to that process.

Impact Assessment

Successful exploitation can result in arbitrary code execution with the invoking user's privileges. Depending on the ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact, reviewed version, such as @builtbyecho/public-api-finder@0.5.11.
• Use a lockfile and npm integrity metadata where installation is managed as part of a project.
• Avoid npx --yes for automatic execution of packages that are not already installed and verified.
• Prefer the bundled, audited fallback script when its functionality is sufficient.
• Verify package provenance, publisher controls, signatures, and release checks before upgrading.
• Review transitive dependencies and package lifecycle scripts.
• Run the CLI in a restricted environment without unnecessary credentials, sensitive files, or write privileges.

other

Warning

• Location: SKILL.md:72

Finding

API Research Is Encouraged to Be Persisted to an External Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72-91
Vulnerability Type: Unnecessary external data persistence
Risk Level: Medium

bash

node -e '
const { Vaultline } = require("@builtbyecho/vaultline-sdk");
const content = JSON.stringify({
  query: "weather forecast",
  pickedApis: [
    { name: "Open-Meteo", url: "https://open-meteo.com/" }
  ],
  notes: "No auth, HTTPS, good for quick prototype."
}, null, 2);
const vault = new Vaultline({ apiKey: process.env.VAULTLINE_API_KEY });
vault.files.upload({
  path: `api-research/${Date.now()}-weather-apis.json`,
  content,
  contentType: "application/json"
}).then(r => console.log("Vaultline fileId:", r.fileId));
'

Technical Analysis

The Skill recommends storing reusable API research in Vaultline through vault.files.upload. This sends the generated query, selected APIs, and associated notes to a third-party service and retains them beyond the current interaction.

External persistence is not required for the core declared functionality of searching and evaluating public APIs. Research notes may contain confidential project requirements, internal architecture details, customer context, or other information derived from a user's request. The example authenticates using VAULTLINE_API_KEY; it does not directly upload or print that key. The principal concern is the uploaded artifact itself and its external retention.

Attack Path

1. A user provides project-specific requirements for API research.
2. The Agent generates a shortlist containing the query, selected services, and implementation notes.
3. The Agent follows the documented Vaultline integration without obtaining explicit, informed user approval.
4. The Vaultline SDK transmits the artifact to an external service using the configured API key.
5. The research remains externally stored and becomes subject to that service's access controls, retention policy, account ...[truncated 641 chars]

Remediation

View remediation

Remediation Suggestions

• Make Vaultline storage strictly optional and disabled by default.
• Obtain explicit user confirmation immediately before transmitting any artifact.
• Clearly identify the destination service, uploaded fields, retention implications, and expected access controls.
• Redact secrets, customer identifiers, internal hostnames, proprietary requirements, and unnecessary project context.
• Prefer local storage unless durable third-party persistence is specifically requested.
• Provide a preview of the exact content before upload.
• Apply least-privilege access to the Vaultline API key and destination account.
• Document deletion, sharing, retention, and data-residency controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

Resolve the fallback script path relative to this `SKILL.md`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares executable installation and command usage, plus fallback scripts and credentialed integrations, but does not define any explicit tool or permission boundaries. That makes it easier for an agent runtime to over-grant network, filesystem, and environment access beyond what is necessary for API discovery, increasing the blast radius if the skill is invoked automatically or combined with other instructions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Vaultline section extends the skill from API discovery into durable data exfiltration/storage by uploading research artifacts using an environment-sourced API key. This is outside the stated purpose of simply finding public APIs and could cause sensitive prompts, project context, or internal research notes to be persisted to a third-party service without clear user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example reads a credential from process.env and uploads content to a third-party service without any explicit warning, consent flow, or sensitivity check. In agent contexts, users may not realize that research output, project details, or other contextual data could be transmitted off-platform and retained externally.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/public-api-finder.js (reported line 18)May include surrounding context.

js

Options:
  --category <name>  Filter by category substring
  --no-auth          Only APIs with Auth = No
  --https            Only HTTPS APIs
  --cors <value>     Filter by CORS: Yes, No, Unknown
  --limit <n>        Max results (default: 8)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction 'Use this skill when a task needs a public API candidate' is very broad and could overlap with many ordinary requests involving projects, research, demos, or integrations. The file does not provide explicit trigger phrases, exclusions, or negative examples clarifying when this skill should not be invoked.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The production x402 endpoint is unrelated to the core function of selecting public APIs and introduces an external service endpoint and account identity into the skill. Even without direct exploit code, this broadens the operational surface and can steer agents toward unnecessary network interactions with a production system not required for the advertised task.

Content

No source excerpt is available for this finding.