T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/main.py:48- Finding
Unrestricted Access to Internal, Private, and Cloud Metadata Endpoints
- Content
View full analysis
- Remediation
View remediation
Security audit
API Endpoint Tester
Security checks for vulnerabilities and agentic risk
Overview
This is a real API testing skill, but it gives broad outbound request and file-write capability with weak scoping and safety guidance.
Review this before installing. Use it only with URLs you control or are authorized to test, avoid private/internal/metadata endpoints, do not paste live tokens or sensitive data into command-line headers or bodies, and avoid the output-file option until path containment and overwrite behavior are fixed. Pin the requests dependency for reproducible installs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:138- Finding
Output Path Validation Bypass Allows Files Outside the Skill Directory to Be Overwritten
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:7- Finding
Unpinned Third-Party Dependency Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: ``` The actual version and hashes should be selected from reviewed artifacts rather than copied from an unverified source. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/main.py run --url "https://api.example.com/users" --method GET
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/main.py run --url "https://api.example.com/users" --method GET
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/main.py run --url "https://api.example.com/users" --method GET
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/main.py run --url "https://api.example.com/users" --method GET
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/main.py run --url "https://api.example.com/users" --method GET
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python3 scripts/main.py run --url "https://jsonplaceholder.typicode.com/posts" --method POST --body '{"title": "test", "body": "content"}'
With custom headers
python3 scripts/main.py run --url "https://api.example.com/data" --method GET --headers '{"Authorization": "Bearer token123", "User-Agent": "MyApp"}'
text ## Command Reference
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python3 scripts/main.py run --url "https://jsonplaceholder.typicode.com/posts" --method POST --body '{"title": "test", "body": "content"}'
With custom headers
python3 scripts/main.py run --url "https://api.example.com/data" --method GET --headers '{"Authorization": "Bearer token123", "User-Agent": "MyApp"}'
text ## Command Reference
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python3 scripts/main.py run --url "https://jsonplaceholder.typicode.com/posts" --method POST --body '{"title": "test", "body": "content"}'
With custom headers
python3 scripts/main.py run --url "https://api.example.com/data" --method GET --headers '{"Authorization": "Bearer token123", "User-Agent": "MyApp"}'
text ## Command Reference
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python3 scripts/main.py run --url "https://jsonplaceholder.typicode.com/posts" --method POST --body '{"title": "test", "body": "content"}'
With custom headers
python3 scripts/main.py run --url "https://api.example.com/data" --method GET --headers '{"Authorization": "Bearer token123", "User-Agent": "MyApp"}'
text ## Command Reference
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README encourages sending headers and bodies to arbitrary endpoints but does not warn users against transmitting secrets, production credentials, or sensitive payloads during testing. In a tool specifically designed to make outbound HTTP requests, this omission can lead to accidental disclosure of API keys, tokens, or personal data to third-party or misconfigured endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation includes a DELETE example against a user resource without any warning that the action may be irreversible or harmful in real environments. For a generic API testing tool, such examples can normalize running destructive operations against live systems and increase the risk of accidental data deletion.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The DELETE example uses a JWT-like bearer token in plaintext, which more strongly resembles real credential material and can encourage copying, reuse, or normalization of exposing tokens in docs, terminals, and logs. Because it appears in a destructive request example, the combination raises the chance of misuse against real systems.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill is documented as sending arbitrary HTTP requests and static analysis detected network and file-write capable behavior, but the manifest does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what the skill is allowed to do and weakens review and runtime guardrails, increasing the chance of unintended outbound requests or local artifact writes without clear user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description explains how to send requests, headers, and bodies to external endpoints but does not warn users that sensitive data such as API tokens, personal data, or internal URLs may be transmitted off-system. In a tool specifically designed for arbitrary endpoint testing, omission of that warning materially raises the risk of accidental credential or data disclosure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This example explicitly demonstrates sending an Authorization bearer token to an external endpoint without any warning about credential exposure. In the context of a skill that facilitates arbitrary outbound requests, showing secret-bearing headers in documentation can normalize unsafe usage and lead users to transmit real tokens to untrusted or mistyped destinations.
- Content
md python3 scripts/main.py run --url "https://api.example.com/users" --method POST --body '{"name": "John", "email": "john@example.com"}' With custom headers: python3 scripts/main.py run --url "https://api.example.com/users" --method GET --headers '{"Authorization": "Bearer token123"}' ## Examples
Ssd 3
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example shows an Authorization header with a bearer token value, which encourages users to paste credential material directly into shell history, logs, and command output. Even though the token is illustrative, this pattern promotes insecure handling of secrets in a tool that transmits headers over the network.
- Content
Static analysis
No suspicious patterns detected.