mila

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.2

Overview

The skill matches its Mila integration purpose, but it should be reviewed because it enables permanent deletion and broad editing of collaborative content without explicit confirmation guidance.

Install only if you trust Mila with the documents, sheets, slide content, and server metadata accessible to your API key. Use the narrowest API scopes available, avoid putting broad team keys into MCP configs, and require explicit confirmation before any delete or full-content replacement operation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (53)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

The skill exposes a destructive delete operation that accepts only a document ID, with no mention of confirmation, scoping safeguards, soft-delete, or other anti-abuse controls. In an agent setting, a prompt-injected or mistaken instruction could cause irreversible deletion of arbitrary accessible documents, making this more dangerous than ordinary API docs because the action may be executed autonomously by tools.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 236)May include surrounding context.

REST API:

text

DELETE /v1/documents/:id

Permanently deletes the document.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill exposes a high-impact destructive endpoint that permanently deletes an entire workbook and all tabs based only on an ID parameter. In an agent setting, parameter confusion, prompt injection, or insufficient confirmation can turn this capability into irreversible user-data destruction at scale.

Content

Scanner excerpt · references/SHEETS.md (reported line 230)May include surrounding context.

REST API:

text

DELETE /v1/sheets/:id

Deletes the workbook and all of its tabs. This is permanent.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The documented tab-deletion operation allows permanent removal of spreadsheet content via supplied identifiers, creating a clear abuse path if an agent is induced to target the wrong tab. While narrower than deleting a whole workbook, it still enables irreversible data loss and can be triggered by parameter mistakes or hostile prompt steering.

Content

Scanner excerpt · references/SHEETS.md (reported line 384)May include surrounding context.

REST API:

text

DELETE /v1/sheets/:id/tabs/:tabId

Delete a tab from the workbook. You cannot delete the last tab -- every workbook must have at least one tab.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill exposes a powerful destructive tool parameter (id for DELETE /v1/slides/:id) with no documented constraints, confirmation flow, or authorization-scope guidance. In an agent setting, an attacker or ambiguous prompt could induce deletion of arbitrary accessible presentations, making parameter abuse materially dangerous because it results in irreversible data loss.

Content

Scanner excerpt · references/SLIDES.md (reported line 278)May include surrounding context.

REST API:

text

DELETE /v1/slides/:id

Permanently deletes the presentation and all its slides.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

Create a document

bash

curl -X POST https://api.mila.gg/v1/documents \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"title": "Meeting Notes", "content": "<h1>Meeting Notes</h1><p>Discussed roadmap.</p>"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes multiple delete operations such as delete_document, delete_sheet, delete_sheet_tab, and delete_slide_presentation, including one that deletes a workbook and all tabs, but provides no warning about data loss or irreversible effects. Under the markdown-specific missing-warning rule, skills should disclose behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 116)May include surrounding context.

The content field accepts HTML. You can use any standard HTML elements: headings, paragraphs, lists, tables, images, links. <script> tags are automatically stripped for security.

bash

curl -X POST https://api.mila.gg/v1/documents \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 179)May include surrounding context.

| content | string | New HTML content (replaces entire document body) |

bash

curl -X PUT https://api.mila.gg/v1/documents/aB3kQ9xZwm \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"title": "Renamed Document"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 212)May include surrounding context.

<script> tags are stripped from the appended content.

bash

curl -X POST https://api.mila.gg/v1/documents/aB3kQ9xZwm/append \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 24)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 64)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 116)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 179)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 212)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/DOCUMENTS.md (reported line 242)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/SERVERS.md (reported line 16)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/SERVERS.md (reported line 71)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/SERVERS.md (reported line 75)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/SERVERS.md (reported line 79)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/SERVERS.md (reported line 90)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/SHEETS.md (reported line 64)May include surrounding context.

No query parameters. Returns all servers accessible to your API key. No specific scope required.

bash

curl https://api.mila.gg/v1/servers \
  -H "Authorization: Bearer mila_sk_your_key_here"

Static analysis

No suspicious patterns detected.