One API Calling GenAI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:45 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for using a GenAI CLI/SDK, but it repeatedly tells users to run an unpinned remote package while using provider credentials and MCP workflows.

Review this before installing in a sensitive environment. The main issue is supply-chain control: pin `genai-calling` to a reviewed version, avoid `--upgrade` for routine use, and run it with only the provider keys and files needed for the current task. Keep shared env files narrow, protect API keys, and set MCP bearer-token auth before exposing the server beyond local testing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-49; equivalent unpinned uvx --from genai-calling commands recur throughout the document.
Vulnerability Type: Supply-chain risk caused by retrieving and executing an unpinned package
Risk Level: Medium

Complete Code Snippet:

bash

# 3) Text
(cd "<SKILL_BASE_DIR>" && uvx --from genai-calling genai --model openai:gpt-4o-mini --prompt "Hello")

# 4) See what you can use (requires at least one provider key configured)
(cd "<SKILL_BASE_DIR>" && uvx --from genai-calling genai model available --all)

bash

python -m pip install --upgrade genai-calling
(cd "<SKILL_BASE_DIR>" && genai --model openai:gpt-4o-mini --prompt "Hello")

Technical Analysis

The documented commands do not pin genai-calling to an audited version and do not verify a package hash or signature. The uvx --from genai-calling workflow can retrieve and immediately execute the version currently selected by the external package registry. Similarly, pip install --upgrade genai-calling explicitly permits replacing an installed version with a newer, unreviewed release.

The repository contains only SKILL.md; it does not include the downloaded package's source, a lock file, package hashes, or signature-verification instructions. Consequently, the effective executable payload can change after this Skill has been reviewed. This is particularly sensitive because the resulting process is expected to receive provider API keys through process environment variables or .env files.

This finding does not establish that the current published package is malicious. The vulnerability is the absence of controls preventing a compromised registry account, compromised maintainer, malicious future release, or package-resolution attack from introducing unreviewed executable code.

Attack Path

1. An attacker compromises the package publishe ...[truncated 1754 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every executable package reference to an exact reviewed version, for example:

   bash

   uvx --from "genai-calling==X.Y.Z" genai ...
   python -m pip install "genai-calling==X.Y.Z"
   

2. Publish and verify cryptographic hashes for approved distributions. Prefer installation through a locked requirements file with --require-hashes.
3. Remove --upgrade from normal usage instructions. Upgrades should occur only through an explicit review and validation process.
4. Use a lock file or controlled internal package mirror so package resolution is reproducible.
5. Verify release signatures or attestations where supported and document the expected publisher identity.
6. Execute the package in a constrained environment with only the credentials and filesystem paths required for the requested operation.
7. Recommend restrictive permissions for credential files, such as:

   bash

   chmod 600 ~/.genai-calling/.env
   

8. Avoid placing credentials for unrelated projects or providers in the shared user-wide file. Prefer narrowly scoped, project-specific credentials and short-lived tokens where available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

bash

# 1) Create `.env.local` in this skill directory
(cd "<SKILL_BASE_DIR>" && { test -f .env.local || touch .env.local; })

# 2) Edit `<SKILL_BASE_DIR>/.env.local` and set at least one provider key (see "Configuration Templates" and "Supported Environment Variables").
# Example (OpenAI):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

bash

# 1) Create `.env.local` in this skill directory
(cd "<SKILL_BASE_DIR>" && { test -f .env.local || touch .env.local; })

# 2) Edit `<SKILL_BASE_DIR>/.env.local` and set at least one provider key (see "Configuration Templates" and "Supported Environment Variables").
# Example (OpenAI):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

When env files are used, SDK/CLI/MCP loads them automatically with priority (high -> low):

- `.env.local > .env.production > .env.development > .env.test > ~/.genai-calling/.env`

Process env vars override file-based config.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

When env files are used, SDK/CLI/MCP loads them automatically with priority (high -> low):

- `.env.local > .env.production > .env.development > .env.test > ~/.genai-calling/.env`

Process env vars override file-based config.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill repeatedly instructs users to execute uvx --from genai-calling ... without pinning a specific package version. That means each run may resolve and execute whatever package version is current at the time, creating a supply-chain risk where a compromised or malicious upstream release could run code locally with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command again fetches and executes the latest genai-calling package via uvx without version pinning. In a skill that launches provider-connected tooling and an MCP server, unpinned execution materially increases supply-chain exposure because arbitrary new code can be introduced at invocation time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

(cd "<SKILL_BASE_DIR>" && uvx --from genai-calling genai model available --all)

text

For user-wide defaults shared across projects, create `~/.genai-calling/.env`
and put provider credentials there. Project-local `.env.*` files still win.

If `uvx` is unavailable, install once and use `genai` directly:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The runtime example executes genai-calling from the package index without a pinned version. Because users are encouraged to pass credentials and run in directories with env files, any compromised upstream package version could access sensitive tokens or local data during installation or execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

VOLCENGINE_OAI_BASE_URL=https://ark.cn-beijing.volces.com/api/v3

TUZI_BASE_URL=https://api.tu-zi.com
# TUZI_OAI_BASE_URL=https://api.tu-zi.com/v1
# TUZI_GOOGLE_BASE_URL=https://api.tu-zi.com
# TUZI_ANTHROPIC_BASE_URL=https://api.tu-zi.com
TUZI_WEB_API_KEY=

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This model-listing example still uses unpinned uvx --from genai-calling, preserving the same supply-chain risk. Even informational commands can execute package code and dependency hooks locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The image-understanding example pulls and runs the latest package version at execution time. Since the tool may process local files and provider credentials, a malicious upstream update could exfiltrate data or alter outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The image-generation example uses an unpinned package reference, exposing users to execution of unreviewed upstream code. Because the command also writes to local disk, compromise could lead to broader local side effects beyond model invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The speech-to-text example invokes an unpinned remote package. Any package compromise would be especially sensitive here because the command processes local audio inputs and may access tokens from env files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This text-to-speech example repeats the unpinned uvx pattern, which allows silent package drift over time. In practice this can become arbitrary code execution through the package supply chain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The SDK-curated model list command also executes the package without version pinning. The fact that it appears read-only does not reduce the risk because package resolution and CLI startup still run code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Starting genai-mcp-server from an unpinned uvx package is especially risky because it launches a long-running local service. A malicious or compromised upstream version could expose tools, intercept prompts, or weaken authentication defaults.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP CLI debug command uses an unpinned package reference, so troubleshooting instructions also create supply-chain execution risk. This is relevant because debug commands may reveal configuration and auth state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This tools debug example is another unpinned package execution path. Since MCP tooling may enumerate capabilities and auth-protected functions, compromised package code could gather sensitive metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The call list_providers MCP CLI example runs unpinned package code, again exposing users to upstream package compromise. The skill context makes this more dangerous because provider/account configuration is central to the workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The call generate example executes a credentialed MCP request through an unpinned uvx package. This combines supply-chain risk with live access to model requests, prompts, and tokens, increasing the practical blast radius.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill documentation includes examples that write outputs to local files using --output-path for image generation and text-to-speech. While the examples show the behavior, they do not include any warning that these commands create or may overwrite files on disk, which is a user-data-affecting action under the markdown warning criteria.

Content

No source excerpt is available for this finding.