Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Overwing API helper for text safety checks, bot/site lookups, and gated business-system actions, with some high-impact options users should handle carefully.
Install only if you are comfortable sending checked text and context to Overwing. Use --no-store for sensitive checks, prefer narrowly scoped evaluate keys, do not use wallet payment or Tower actions unless a human explicitly authorizes them, and avoid the optional unpinned npx MCP command unless you pin or verify the package.
Referenced artifact was not completely inspected
ent (for example `x402-fetch` in Node) and resend with the `X-PAYMENT` header. `scripts/overwing.sh terms` shows the current prices, network and receiving addre
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
[ -n "$body" ] && args+=(-H "Content-Type: application/json" --data-binary "$body")
tmp=$(mktemp)
code=$(curl "${args[@]}" -o "$tmp" -w '%{http_code}')
if [ "${code:0:1}" = "2" ]; then cat "$tmp"; echo; rm -f "$tmp"; return 0; fi
case " $ACCEPT " in *" $code "*) cat "$tmp"; echo; rm -f "$tmp"; return 0 ;; esac
cat "$tmp" >&2; echo >&2; rm -f "$tmp"; return 1
}
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
[ -n "$body" ] && args+=(-H "Content-Type: application/json" --data-binary "$body")
tmp=$(mktemp)
code=$(curl "${args[@]}" -o "$tmp" -w '%{http_code}')
if [ "${code:0:1}" = "2" ]; then cat "$tmp"; echo; rm -f "$tmp"; return 0; fi
case " $ACCEPT " in *" $code "*) cat "$tmp"; echo; rm -f "$tmp"; return 0 ;; esac
cat "$tmp" >&2; echo >&2; rm -f "$tmp"; return 1
}
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
[ -n "$body" ] && args+=(-H "Content-Type: application/json" --data-binary "$body")
tmp=$(mktemp)
code=$(curl "${args[@]}" -o "$tmp" -w '%{http_code}')
if [ "${code:0:1}" = "2" ]; then cat "$tmp"; echo; rm -f "$tmp"; return 0; fi
case " $ACCEPT " in *" $code "*) cat "$tmp"; echo; rm -f "$tmp"; return 0 ;; esac
cat "$tmp" >&2; echo >&2; rm -f "$tmp"; return 1
}
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
call POST /api/v1/tower/agents "{\"name\":$(printf '%s' "$1" | json_escape),\"scopes\":[${scopes%,}]}"
;;
agents) require_key; call GET /api/v1/tower/agents ;;
agent-revoke) require_key; [ $# -ge 1 ] || usage; call DELETE "/api/v1/tower/agents/$(printf '%s' "$1" | urlencode)" ;;
capabilities) require_agent_key; TOKEN="$OVERWING_AGENT_KEY" call GET /api/v1/tower/capabilities ;;
decide)
require_agent_key
The skill advertises and instructs use of shell and network capabilities (curl, shell scripts, remote APIs, signup flows, account/domain actions) but does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization gap where a host agent may grant broader execution than intended, increasing the chance of unexpected outbound requests, account changes, or command execution driven by untrusted prompts.
Using npx -y overwing-mcp without a pinned version allows whatever package version is current at execution time to be downloaded and run. If the package is compromised, a malicious version is published, or a breaking update introduces unsafe behavior, the agent could execute attacker-controlled code with the agent's local privileges and network access.
The script's signup command can send user credentials to a remote service via HTTP requests, including email and password in the request body. While the file documents usage, it does not provide an explicit user-facing warning at the point of execution about transmitting credentials over the network.
The claim command sends an email and password to the remote API, which is a safety-relevant network operation involving credentials. The code performs the request directly without a confirmation prompt or explicit runtime disclosure, and the usage text does not warn that credentials are transmitted.