public-api-finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.5.11

Overview

This skill mostly matches its stated API-search purpose, but it needs Review because it runs mutable npm code and encourages external storage of research notes without clear user approval.

Review before installing. Prefer the bundled local fallback or a pinned, reviewed npm version, run it without unnecessary credentials in the environment, and do not enable or use the Vaultline upload unless you explicitly want the shown research content stored with that third-party service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:28
• Finding: Unpinned npm Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 28-31 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ```bash npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "weather forecast" --no-auth --https npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "crypto prices" --category Cryptocurrency --limit 5 npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "jobs" --json npx --yes --package=@builtbyecho/public-api-finder -- public-api-finder "payments" --openapi ``` ### Technical Analysis The documented primary workflow uses `npx --yes` to retrieve and execute `@builtbyecho/public-api-finder` without specifying an exact reviewed version or integrity hash. The `--yes` option suppresses the interactive installation prompt. Consequently, the code executed during a future invocation may differ from the code present when this Skill was audited. A compromised npm publisher account, malicious package update, or supply-chain compromise could introduce arbitrary executable behavior. The bundled Python fallback does not require this mutable package and therefore represents a lower-privilege alternative. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another component in the package dependency chain. 2. The attacker publishes a malicious version under the existing package name. 3. An Agent follows the commands in `SKILL.md`. 4. `npx --yes` downloads the current package version without requesting confirmation or verifying a reviewed version. 5. Package lifecycle hooks, dependency code, or the CLI entry point executes with the permissions of the Agent process. 6. Malicious code can access data and resources available to that process. ### Impact Assessment Successful exploitation can result in arbitrary code execution with the invoking user's privileges. Depending on the ...[truncated 339 chars]
• Remediation: ## Remediation Suggestions - Pin the package to an exact, reviewed version, such as `@builtbyecho/public-api-finder@0.5.11`. - Use a lockfile and npm integrity metadata where installation is managed as part of a project. - Avoid `npx --yes` for automatic execution of packages that are not already installed and verified. - Prefer the bundled, audited fallback script when its functionality is sufficient. - Verify package provenance, publisher controls, signatures, and release checks before upgrading. - Review transitive dependencies and package lifecycle scripts. - Run the CLI in a restricted environment without unnecessary credentials, sensitive files, or write privileges.

other

Warning

• Location: SKILL.md:72
• Finding: API Research Is Encouraged to Be Persisted to an External Service## Vulnerability Details **File Location**: `SKILL.md`, lines 72-91 **Vulnerability Type**: Unnecessary external data persistence **Risk Level**: Medium ```bash node -e ' const { Vaultline } = require("@builtbyecho/vaultline-sdk"); const content = JSON.stringify({ query: "weather forecast", pickedApis: [ { name: "Open-Meteo", url: "https://open-meteo.com/" } ], notes: "No auth, HTTPS, good for quick prototype." }, null, 2); const vault = new Vaultline({ apiKey: process.env.VAULTLINE_API_KEY }); vault.files.upload({ path: `api-research/${Date.now()}-weather-apis.json`, content, contentType: "application/json" }).then(r => console.log("Vaultline fileId:", r.fileId)); ' ``` ### Technical Analysis The Skill recommends storing reusable API research in Vaultline through `vault.files.upload`. This sends the generated query, selected APIs, and associated notes to a third-party service and retains them beyond the current interaction. External persistence is not required for the core declared functionality of searching and evaluating public APIs. Research notes may contain confidential project requirements, internal architecture details, customer context, or other information derived from a user's request. The example authenticates using `VAULTLINE_API_KEY`; it does not directly upload or print that key. The principal concern is the uploaded artifact itself and its external retention. ### Attack Path 1. A user provides project-specific requirements for API research. 2. The Agent generates a shortlist containing the query, selected services, and implementation notes. 3. The Agent follows the documented Vaultline integration without obtaining explicit, informed user approval. 4. The Vaultline SDK transmits the artifact to an external service using the configured API key. 5. The research remains externally stored and becomes subject to that service's access controls, retention policy, account ...[truncated 641 chars]
• Remediation: ## Remediation Suggestions - Make Vaultline storage strictly optional and disabled by default. - Obtain explicit user confirmation immediately before transmitting any artifact. - Clearly identify the destination service, uploaded fields, retention implications, and expected access controls. - Redact secrets, customer identifiers, internal hostnames, proprietary requirements, and unnecessary project context. - Prefer local storage unless durable third-party persistence is specifically requested. - Provide a preview of the exact content before upload. - Apply least-privilege access to the Vaultline API key and destination account. - Document deletion, sharing, retention, and data-residency controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Ae1

High

• Category: analysis-evasion

Content

Resolve the fallback script path relative to this `SKILL.md`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares executable installation and command usage, plus fallback scripts and credentialed integrations, but does not define any explicit tool or permission boundaries. That makes it easier for an agent runtime to over-grant network, filesystem, and environment access beyond what is necessary for API discovery, increasing the blast radius if the skill is invoked automatically or combined with other instructions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The Vaultline section extends the skill from API discovery into durable data exfiltration/storage by uploading research artifacts using an environment-sourced API key. This is outside the stated purpose of simply finding public APIs and could cause sensitive prompts, project context, or internal research notes to be persisted to a third-party service without clear user consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example reads a credential from process.env and uploads content to a third-party service without any explicit warning, consent flow, or sensitivity check. In agent contexts, users may not realize that research output, project details, or other contextual data could be transmitted off-platform and retained externally.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

Options:
  --category <name>  Filter by category substring
  --no-auth          Only APIs with Auth = No
  --https            Only HTTPS APIs
  --cors <value>     Filter by CORS: Yes, No, Unknown
  --limit <n>        Max results (default: 8)

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Vague Triggers

Low

• Confidence: 94% confidence
• Finding: The instruction 'Use this skill when a task needs a public API candidate' is very broad and could overlap with many ordinary requests involving projects, research, demos, or integrations. The file does not provide explicit trigger phrases, exclusions, or negative examples clarifying when this skill should not be invoked.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The production x402 endpoint is unrelated to the core function of selecting public APIs and introduces an external service endpoint and account identity into the skill. Even without direct exploit code, this broadens the operational surface and can steer agents toward unnecessary network interactions with a production system not required for the advertised task.

Static analysis

No suspicious patterns detected.