Slingdata.io API Spec

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:51 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only skill for building Sling REST API extraction specs, with expected API and credential patterns but important endpoint and token-handling precautions for users.

Install only if you want help authoring Sling REST API extraction specs. Treat generated specs as network-capable configuration: use least-privilege credentials, prefer read-only scopes, verify every base URL and response-derived download URL, and confirm where OAuth tokens and sync state are stored before using it in production.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: ENDPOINTS.md:81

Finding

Unvalidated Response-Controlled URL May Enable SSRF and Credential Forwarding

Content

View full analysis

Vulnerability Details

File Location: ENDPOINTS.md, lines 81-86
Vulnerability Type: Server-Side Request Forgery and unsafe credential forwarding
Risk Level: Medium
Category: T09: Insecure Skill Coding Practices

The documented export workflow extracts a download URL directly from an HTTP response and subsequently requests that URL without validating its scheme, host, port, or resolved network address.

yaml

          - expression: response.json.download_url
            output: state.data_url

    # Main request uses URL from setup
    request:
      url: "{state.data_url}"
      method: "GET"

Technical Analysis

response.json.download_url is remote input controlled by the API that provides the export-status response. It is copied into state.data_url and used as the complete destination of a subsequent HTTP request.

No documented control requires the destination to:

• Use HTTPS.
• Match the original API origin.
• Belong to an explicit host allowlist.
• Resolve to a public, non-loopback address.
• Avoid private, link-local, or cloud metadata networks.
• Exclude embedded user information or unusual ports.

ENDPOINTS.md also states that endpoints inherit their settings from defaults and may inherit connection-level authentication. Therefore, if Sling preserves authentication or default headers when requesting state.data_url, an origin change could forward bearer tokens, API keys, cookies, or other sensitive headers to an attacker-controlled server. Whether credentials are forwarded depends on the underlying Sling runtime, but the documentation does not require them to be removed.

This behavior is unnecessary for the minimum privilege needed by a GET-only extraction workflow unless response-provided download destinations are constrained to trusted export hosts.

Attack Path

1. A threat actor compromises, impersonates, or manipulates the API that returns the export-s ...[truncated 1462 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate the download URL before making the request:

   • Permit only https.
   • Require an explicit allowlist of trusted export hosts.
   • Reject URLs containing user information.
   • Restrict ports to approved values.
   • Normalize and parse the URL with a standards-compliant parser before comparison.

2. Apply network-level SSRF defenses:

   • Resolve the hostname and reject loopback, private, link-local, multicast, and reserved addresses.
   • Revalidate every redirect destination and DNS resolution result.
   • Block cloud metadata ranges, including link-local metadata services.
   • Use an egress proxy or firewall allowlist for export downloads.

3. Prevent credential forwarding:

   • Explicitly disable inherited endpoint authentication for cross-origin downloads.
   • Remove Authorization, Cookie, proxy authorization, and API-key headers.
   • Attach credentials only when the validated destination matches the expected trusted origin.
   • Do not automatically restore sensitive headers after redirects.

4. Prefer a fixed trusted origin:

   • Accept only a relative download path or opaque export identifier from the API.
   • Construct the final URL using a statically configured, trusted base URL.
   • Reject absolute URLs when cross-origin downloads are not required.

5. Update the documentation with a secure example and a warning that response-derived URLs are untrusted input.

A safer conceptual pattern is:

yaml

# Treat the response as an identifier or relative path, not a complete URL.
- expression: response.json.download_path
  output: state.download_path

request:
  url: "{state.trusted_export_base_url}/{state.download_path}"
  method: "GET"
  authentication: null

The runtime must still normalize and validate state.download_path to prevent traversal, scheme-relative URLs, and authority replacement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 42)May include surrounding context.

Client Credentials Flow (Server-to-Server)

Most common for API integrations. Gets access token using client credentials:

yaml

authentication:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 92)May include surrounding context.

Client Credentials Flow (Server-to-Server)

Most common for API integrations. Gets access token using client credentials:

yaml

authentication:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that a device-code OAuth token is stored automatically, but it does not warn about credential persistence, storage location, retention, or access controls. In a skill focused on authentication setup, omission of these details can lead operators to persist sensitive tokens insecurely or without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 50)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 66)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 67)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 86)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 101)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 188)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AUTHENTICATION.md (reported line 200)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · DYNAMIC.md (reported line 60)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ENDPOINTS.md (reported line 12)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

# The key 'users' is the endpoint name
  users:
    description: "Retrieve users from the API"
    docs: "https://api.example.com/docs/users"  # Optional
    disabled: false  # Optional
    depends_on: []  # Optional, auto-inferred from queue usage

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly encourages storing record-derived values in environment variables and notes they are available in hooks, but it provides no warning about secrets, PII, log exposure, or unintended reuse across later requests. In an API-spec authoring skill, this is risky because extracted data may include tokens, identifiers, or customer data that could be propagated beyond the immediate record-processing context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes outbound API requests including an Authorization header and user-specific fields such as user_id and user_email, which can transmit sensitive or identifying data to external endpoints. The document explains configuration mechanics but does not include any warning about privacy, credential handling, or the effects of sending data to remote systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes generating endpoints from discovery/catalog APIs and later retrieving data from discovered resources, but it does not warn users that the process may enumerate account-specific resources and fetch potentially sensitive user-created data. Under the markdown criteria for missing user warnings, behaviors affecting privacy or user data should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This markdown file documents reading env.OVERRIDE_START_DATE and instructs the user to run the tool with that environment variable set, but it does not warn that environment-provided values will directly affect data selection and persisted sync behavior. Under the markdown variant of SQP-2, behavior that can affect user data should be disclosed so users understand the operational impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The queue example shows propagating record values to other endpoints without warning that this creates cross-endpoint data flow and may spread sensitive or unvalidated identifiers. In a system designed for endpoint chaining and data extraction, this can cause over-collection, unintended access patterns, or leakage into downstream requests if users enqueue more than non-sensitive IDs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The section on output: "record" describes full-record replacement, a potentially destructive transformation, but does not warn that unspecified fields will be lost. For markdown files, destructive behavior affecting user data should be disclosed clearly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The 'When to Use' section narrows the skill to 'GET endpoints only', but the rest of the document describes setup/teardown sequences, multi-step custom auth, OAuth flows, HMAC signing, retries, and dynamic endpoint generation, which imply broader API interaction capabilities. This is an internal documentation contradiction about the intended operational scope, even though no executable code is present in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.