OpenAny

• Outcome: Pass
• Latest audit: Nov 11, 2026 · 5:12 AM UTC
• Version: 0.1.1

Overview

The verdict is benign with medium confidence: scanners found no AIG issues and judged the reported external-service workflow risks consistent with the skill's purpose, though coverage was partial.

Before installing, consider that using the skill may send your task and API inputs to OpenAny and the selected provider; avoid including sensitive information unless you are comfortable sharing it. The scan covered the listed components but was marked partial because a referenced local path could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

1. When the user asks what is available, call `openany_overview` first. Present data APIs by category and AI models by modality, with the counts it returns. Do not invent a model count or an API count.
2. Call `search_apis` with the user's task, or with one filter that search returned. Read the summaries. A result with `kind` = `model` is a model; `kind` = `api` is an API. Do not invent an API name or a model id.
3. Call `get_api` with the `api` value from that search. Read `input_schema`, `api_version`, and the public price. For a model, send chat completions input and use only the price fields `get_api` returned.
4. Tell the user the price `get_api` returned and wait for approval.
5. Call `run_api` only after that approval. Pass the same `api`, the `api_version` from `get_api`, and an `input` object that matches `input_schema`.

The workflow sends the user's task and API inputs to external services without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The workflow instructs the agent to submit the user's task to OpenAny through search_apis and send execution inputs through run_api. Although it discloses charges and possible side effects, it does not warn that user content will be transmitted to OpenAny and potentially the selected API provider; approval of the price does not disclose that privacy impact.

Content

No source excerpt is available for this finding.