Security checks for vulnerabilities and agentic risk
Overview
This API testing skill is mostly purpose-aligned, but it under-discloses network and credential risks and can generate unsafe HTML reports from untrusted API responses.
Install only if you are comfortable with a local API testing helper that sends exactly the URLs, headers, and bodies you provide. Use test credentials where possible, avoid production secrets, be cautious with redirects, and do not open or share generated HTML reports from untrusted endpoints until report escaping/redaction is fixed.
{json.dumps(r.get("body_json") or r.get("body",""), indent=2)[:2000]}
' for r in results if r.get("body_json") or r.get("body"))}
```
### Technical Analysis
The report generator interpolates the requested URL and remote API response body directly into an HTML document without HTML escaping. Both values can contain attacker-controlled markup.
Although JSON responses are passed through `json.dumps`, JSON serialization does not safely encode HTML metacharacters such as `<` and `>`. A response containing a value such as `` can terminate the intended HTML element and inject an active element with an event handler.
The same issue affects the requested URL, which is inserted into both a table cell and a heading. Consequently, malicious input can become executable content when the generated report is opened in a web browser.
### Attack Path
1. An attacker operates or compromises an API endpoint.
2. The attacker configures the endpoint to return a response containing malicious HTML or JavaScript markup.
3. A user tests that endpoint with the `--report` option.
4. `generate_html_report` inserts the response body into the report without escaping it.
5. The user opens the generated HTML report in a browser.
6. The injected active content executes in the report’s browser context.
A malicious URL supplied directly or
...[truncated 765 chars]
Remediation
View remediation
```
3. Avoid inline scripts and event handlers in the report template.
4. Add regression tests using payloads containing closing tags, event handlers, and SVG elements.
5. Treat API responses, URLs, status reasons, headers, and specification-derived values as untrusted data.
]]>
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/api_tester.py:24
Finding
Sensitive Request Headers May Be Forwarded Across Redirects
The skill documentation describes capabilities that perform outbound network requests and generate HTML reports, but the metadata does not declare any tool scope such as network or file-write permissions. This creates a transparency and policy-enforcement gap: users and orchestrators may not realize the skill can transmit data externally or write files locally.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
bash
# Test a single endpoint
python3 skills/api-tester/scripts/api_tester.py --url https://api.github.com/repos/openclaw/openclaw
# POST with JSON body
python3 skills/api-tester/scripts/api_tester.py \
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The documentation includes examples with Authorization headers and request bodies but does not warn that these secrets and payloads will be transmitted to external systems. In practice, this can lead users to paste real bearer tokens or sensitive data into example commands without understanding the exposure risk.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding
This example demonstrates sending an Authorization header to an external endpoint, which materially increases the security risk compared with a generic URL example. Without a warning, users may reuse real tokens and unintentionally exfiltrate credentials to third-party or mistyped endpoints.
Content
Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
The statement 'No external API calls' is contradicted by the rest of the skill, which is explicitly built to send HTTP requests to user-specified endpoints. Misrepresenting network behavior can mislead users into providing sensitive URLs, headers, or payloads under a false assumption that no external transmission occurs.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · scripts/api_tester.py (reported line 5)May include surrounding context.
Verbose mode prints response bodies to stdout, which may expose tokens, credentials, personal data, or internal error details in terminal scrollback, shell history capture tools, CI logs, and agent transcripts. Because this tool is designed to inspect APIs, responses are especially likely to contain sensitive content.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
When --report is used, the tool writes API response content directly to a local HTML file without any user-facing warning that secrets or sensitive business data may be persisted. This can leak data into developer machines, CI artifacts, shared folders, or support attachments, especially because API testing often involves authenticated endpoints.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Low
Category
Not specified by scanner
Confidence
90% confidence
Finding
The report generator embeds full request URLs and response bodies into an HTML artifact, which can retain API tokens, PII, or other sensitive server responses on disk beyond the active test session. In the context of an API testing tool this behavior is functional, but it increases data exposure and retention risk if reports are shared, stored insecurely, or collected by other local tooling.
` can terminate the intended HTML element and inject an active element with an event handler. The same issue affects the requested URL, which is inserted into both a table cell and a heading. Consequently, malicious input can become executable content when the generated report is opened in a web browser. ### Attack Path 1. An attacker operates or compromises an API endpoint. 2. The attacker configures the endpoint to return a response containing malicious HTML or JavaScript markup. 3. A user tests that endpoint with the `--report` option. 4. `generate_html_report` inserts the response body into the report without escaping it. 5. The user opens the generated HTML report in a browser. 6. The injected active content executes in the report’s browser context. A malicious URL supplied directly or ...[truncated 765 chars]