eSIMPal API Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:24 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent API-integration guidance, but its base-URL override can expose a powerful eSIMPal bearer key to an untrusted endpoint.

Review before installing. Use only the fixed trusted eSIMPal API endpoint or a strictly allowlisted non-production endpoint with separate test credentials. Do not use production ESIMPAL_API_KEY with arbitrary base URL overrides, and ensure clients do not forward Authorization headers across cross-origin redirects.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:49

Finding

User-Controlled API Base URL Can Expose the Bearer Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-51
Vulnerability Type: Credential disclosure through an untrusted API endpoint
Risk Level: High

Vulnerable Code Snippet

markdown

- **Base URL**: `https://getesimpal.com/api` (or the env override the user provides, always ending in `/api`).
- **Full example**: `GET https://getesimpal.com/api/v1/plans?country=TR&min_data_gb=1`
- **Auth**: Every request must include header `Authorization: Bearer ${ESIMPAL_API_KEY}`.

Technical Analysis

The skill permits a user-provided base URL while also requiring every API request to include the secret ESIMPAL_API_KEY as a bearer token. Requiring the URL to end in /api only constrains its path; it does not establish that the scheme, hostname, port, or server belongs to eSIMPal.

Consequently, an attacker can provide an HTTPS URL under their control, such as https://attacker.example/api. If the agent follows the documented override behavior, it will attach Authorization: Bearer ${ESIMPAL_API_KEY} to a request sent directly to the attacker.

Redirect handling presents a related risk. Even if the initial origin is trusted, an HTTP client that forwards the authorization header across an origin-changing redirect could expose the credential unless redirects and header propagation are explicitly restricted.

Attack Path

1. An attacker or untrusted user instructs the agent to use https://attacker.example/api as the environment-provided base URL.
2. The supplied URL passes the documented requirement because its path ends in /api.
3. The agent makes an otherwise legitimate API request, such as a plan lookup.
4. Following the authentication requirement, the agent includes: Authorization: Bearer ${ESIMPAL_API_KEY}.
5. The attacker-controlled server records the bearer credential.
6. The attacker reuses the credential against the legitimate eSIMPal API within the scopes assigned to the key.

Impact Assessment

Successful exploi ...[truncated 607 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove support for user-controlled API origins and use the fixed trusted endpoint https://getesimpal.com/api.
2. If endpoint overrides are operationally necessary, enforce an explicit allowlist of trusted origins rather than checking only the path suffix.
3. Parse and validate the URL structurally:
   • Require HTTPS.
   • Match an approved hostname exactly.
   • Restrict the effective port to approved values.
   • Reject embedded credentials, ambiguous host syntax, and unexpected URL components.
   • Normalize and validate the path separately.
4. Resolve the final request destination before attaching the authorization header. Reject cross-origin redirects and never forward credentials when the scheme, hostname, or port changes.
5. Prefer separate restricted credentials for approved non-production environments instead of sending a production key to an overridden endpoint.
6. Add tests confirming that attacker-controlled hosts ending in /api, deceptive subdomains, nonstandard ports, and cross-origin redirects cannot receive the bearer token.
7. Rotate the API key immediately if it may already have been sent to an untrusted endpoint, and review associated order activity for unauthorized operations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.