cloudbypass

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:39 AM UTC
• Version: 0.0.5

Overview

The skill largely does what it says, but it can send sensitive request data, API keys, and proxy credentials through a bypass service without strong guardrails.

Install only if you intentionally need a third-party anti-bot bypass service and are authorized to retrieve the target pages. Do not send cookies, authorization headers, personal data, internal URLs, or sensitive request bodies through this skill unless you have reviewed the data-sharing and billing implications. Avoid using custom apiBaseUrl values with real credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cloudbypass_request.js:25

Finding

Caller-Controlled API Endpoint Enables Credential and Request-Data Disclosure

Content

View full analysis

Vulnerability Details

File Location: scripts/cloudbypass_request.js:25, scripts/cloudbypass_request.js:81-141, and scripts/cloudbypass_request.js:279-345
Vulnerability Type: Arbitrary outbound destination and sensitive-data disclosure
Risk Level: High

The Cloudbypass API endpoint can be replaced through config.apiBaseUrl. The replacement endpoint is not restricted to the legitimate Cloudbypass origin and is not required to use HTTPS. Both the normal request and download paths send sensitive headers to the resulting destination.

Vulnerable Code

js

// API base address
this.apiBaseUrl = config.apiBaseUrl || 'https://api.cloudbypass.com';

Normal request path:

js

// Build Cloudbypass API URL
const apiUrl = new URL(this.apiBaseUrl);
apiUrl.pathname = targetUrl.pathname;
apiUrl.search = targetUrl.search;

// Build request headers
const requestHeaders = {
    'x-cb-apikey': this.apiKey,
    'x-cb-host': targetUrl.hostname,
    ...headers
};

// Protocol type
if (protocol || targetUrl.protocol === 'http:') {
    requestHeaders['x-cb-protocol'] = protocol || 'http';
}

// V2 mode configuration
if (mode === 'v2' || mode === 'v2s') {
    requestHeaders['x-cb-version'] = mode === 'v2s' ? '2s' : '2';

    if (!proxy) {
        throw new Error('Proxy is required for V2 mode. Please set proxy in config or CLOUDBYPASS_PROXY environment variable.');
    }
    requestHeaders['x-cb-proxy'] = proxy;

    if (part) {
        requestHeaders['x-cb-part'] = part;
    }

    if (sitekey) {
        requestHeaders['x-cb-sitekey'] = sitekey;
    }
}

// Extra options
if (extraOptions) {
    requestHeaders['x-cb-options'] = extraOptions;
}

// Process request body and set Content-Type
let requestBody = null;
if (body) {
    if (typeof body === 'object') {
        requestBody = JSON.stringify(body);
        if (!requestHeaders['Content-Type']) {
       
...[truncated 4084 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove production endpoint configurability and always use the fixed endpoint:

   js

   this.apiBaseUrl = 'https://api.cloudbypass.com';
   

2. If endpoint configurability is required for testing, validate the complete origin rather than only parsing the URL:

   js

   const apiUrl = new URL(config.apiBaseUrl || 'https://api.cloudbypass.com');
   
   if (
       apiUrl.protocol !== 'https:' ||
       apiUrl.hostname !== 'api.cloudbypass.com' ||
       (apiUrl.port && apiUrl.port !== '443') ||
       apiUrl.username ||
       apiUrl.password
   ) {
       throw new Error('Untrusted Cloudbypass API endpoint');
   }
   
   this.apiBaseUrl = apiUrl.origin;
   

3. Keep test endpoints behind an explicit development-only flag and never attach real credentials when using them.

4. Reject plaintext HTTP and unexpected URL schemes, ports, user information, and hosts. If redirect handling is added later, revalidate every redirect destination before forwarding sensitive headers.

5. Prevent caller headers from overriding service-control headers. Filter reserved x-cb-* names or construct protected headers after merging caller headers:

   js

   const requestHeaders = {
       ...sanitizedCallerHeaders,
       'x-cb-apikey': this.apiKey,
       'x-cb-host': targetUrl.hostname
   };
   

6. Explicitly allowlist caller headers that may be forwarded. Treat Authorization, Cookie, proxy authorization, and other credential-bearing headers as sensitive.

7. Document that target paths, query strings, headers, bodies, and proxy configuration are transmitted to the Cloudbypass provider. Require callers to avoid sending data that is unnecessary for retrieval.

8. Add tests confirming that HTTP endpoints, non-Cloudbypass hosts, unexpected ports, userinfo-bearing URLs, and reserved-header overrides are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill accesses sensitive environment variables such as CLOUDBYPASS_APIKEY and proxy configuration, but it does not declare an explicit tool scope like permissions or allowed-tools. This creates an unnecessary trust gap: callers and reviewers cannot easily tell that the skill requires secret material and network-capable behavior tied to a third-party anti-bot bypass service. In this context, the risk is elevated because the skill is specifically designed to bypass access protections and send requests plus credentials to an external service that may incur billing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code forwards user-supplied target URLs, request headers, cookies, and optional request bodies to a third-party anti-bot bypass service by design. That creates a real data exfiltration and compliance risk because sensitive session tokens, personal data, internal endpoints, or proprietary content may be transmitted off-platform without any built-in consent gate, allowlist, redaction, or warning. The skill context makes this more dangerous, not less, because it is explicitly intended to bypass access controls on protected pages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language text in the file, including the top-level description and method comments, is exclusively in Chinese. Under the policy, forcing a specific language without opt-in or justification is a language/locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code accesses CLOUDBYPASS_APIKEY from the environment, which is a sensitive credential source. There is no warning or explanatory note about how this credential will be used or that it will be attached to outbound requests as an authentication header.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.