AutoHeal AI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:14 AM UTC
• Version: 1.0.0

Overview

This skill matches its stated error-monitoring purpose, but its examples expose an API key in browser code and send raw error details to AutoHeal without clear privacy controls.

Install only after reviewing the AutoHeal data flow. Do not put a privileged AutoHeal API key in frontend code; use a backend proxy or a restricted public ingestion token if available. Add redaction for stack traces, messages, URLs, and user data before sending telemetry, and require explicit approval before an agent modifies production application entry points.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24

Finding

Client-Side Exposure of the AutoHeal API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-30 and SKILL.md:43-49
Vulnerability Type: Client-side credential exposure
Risk Level: High

The browser integration instructs users to include AUTOHEAL_API_KEY in requests made directly from client-side JavaScript.

javascript

headers: { "Content-Type": "application/json" },
body: JSON.stringify({
  key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY",
  message: msg,
  stack: err?.stack || "",
  source_url: source,
  browser: navigator.userAgent
})

The same credential handling is repeated for unhandled promise rejections:

javascript

headers: { "Content-Type": "application/json" },
body: JSON.stringify({
  key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY",
  message: err?.message || String(err),
  stack: err?.stack || "",
  source_url: window.location.href,
  browser: navigator.userAgent
})

Technical Analysis

Secrets cannot be securely retained in browser-side code. JavaScript build systems commonly replace environment-variable expressions during compilation, causing the resulting API key to be included in downloadable application bundles. Even if substitution does not occur, users are instructed to replace the placeholder with a usable key.

The API key is also included directly in the JSON request body. Site visitors, browser extensions, injected scripts, browser developer tools, and systems with access to captured network requests can inspect and recover it.

The project uses the same AUTOHEAL_API_KEY as a bearer token when querying error status. The documentation does not establish that browser-facing keys are short-lived, origin-restricted, ingestion-only, or otherwise separated from credentials used for authenticated API operations.

Attack Path

1. A project follows the documented browser integration and supplies its AutoHeal API key.
2. The key is embedded in a client-side bundle or exposed in ...[truncated 1097 chars]

Remediation

View remediation

Remediation Suggestions

1. Never include a privileged AutoHeal API key in browser code, build-time frontend environment variables, or browser request bodies.
2. Route browser telemetry through an application-controlled backend. The backend should hold the API key and forward only validated, sanitized fields.
3. If direct browser ingestion is required, introduce a separate public ingestion token that is:
   • Restricted to ingestion only.
   • Bound to explicitly configured origins.
   • Short-lived and easily rotated.
   • Protected by per-origin and per-client rate limits.
   • Unable to query errors, account information, or other authenticated resources.
4. Separate ingestion credentials from management and status-query credentials.
5. Add abuse controls, including payload limits, replay protection, anomaly detection, and revocation.
6. Update the Skill instructions to explain explicitly that server API keys must never be exposed to frontend applications.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

Unredacted Production Error and URL Data Sent to a Third Party

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26-31, SKILL.md:43-49, SKILL.md:64-65, and SKILL.md:75-76
Vulnerability Type: Unrestricted sensitive telemetry disclosure
Risk Level: Medium

The browser integration automatically sends exception messages, stack traces, source or current URLs, and browser identifiers to https://autohealai.com.

javascript

body: JSON.stringify({
  key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY",
  message: msg,
  stack: err?.stack || "",
  source_url: source,
  browser: navigator.userAgent
})

For rejected promises, it transmits the complete current page URL:

javascript

body: JSON.stringify({
  key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY",
  message: err?.message || String(err),
  stack: err?.stack || "",
  source_url: window.location.href,
  browser: navigator.userAgent
})

The Node.js integration also sends raw exception content:

javascript

message: err.message,
stack: err.stack || ""

The same behavior is used for unhandled rejections:

javascript

message: err.message,
stack: err.stack || ""

Technical Analysis

Exception messages and stack traces are not guaranteed to contain only diagnostic information. Depending on application behavior, they may include access tokens, request parameters, user identifiers, personal information, database details, internal filesystem paths, source structure, or values derived from rejected objects.

Sending window.location.href is especially risky because it includes the complete query string and fragment. URLs can contain OAuth authorization codes, password-reset tokens, invitation tokens, search terms, email addresses, internal record identifiers, or other sensitive information.

The global handlers transmit data automatically for every uncaught exception and unhandled rejection. The instructions provide no field allowlist, secret redaction, URL normali ...[truncated 1634 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove query strings and fragments before transmitting a URL. Prefer sending only a normalized route template or pathname.
2. Apply a strict telemetry schema and allowlist only fields required for analysis.
3. Redact credentials, authorization headers, cookies, email addresses, tokens, and known personal-data patterns from messages and stack traces.
4. Truncate messages and stack traces to bounded lengths and reject oversized payloads.
5. Avoid serializing arbitrary rejection reasons. Extract only safe fields from genuine Error objects.
6. Provide application-level filtering hooks so projects can suppress sensitive errors or fields.
7. Make production telemetry explicitly configurable and document the external destination, retention policy, access controls, and data-processing implications.
8. Disable collection in sensitive routes or environments unless explicitly enabled.
9. Add automated tests verifying that URLs, tokens, credentials, and representative personal data are redacted before transmission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to automatically send production error messages, stack traces, source URLs, and browser/user-agent context to a third-party API, but it provides no privacy warning, consent step, or data-minimization guidance. Error telemetry often contains sensitive information such as internal paths, tokens in URLs, PII, or proprietary code details, so silent transmission materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The browser example embeds process.env.AUTOHEAL_API_KEY into client-side code and even falls back to a literal placeholder, encouraging use of an API credential in the browser. Client-side secrets are exposed to end users and attackers through source inspection or runtime tooling, enabling unauthorized use of the API and possible access to associated error data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation examples are broad enough that an agent could apply the skill in situations the user did not explicitly authorize, including making code or configuration changes to an arbitrary project. In an agentic context, vague activation cues increase the chance of overreach and unintended modification, especially because the README frames setup as a general capability without clear preconditions or consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup description tells users the agent can 'set up AutoHeal error monitoring' but does not warn that this may modify source files, dependencies, environment configuration, or deployment settings. For agent-driven tooling, lack of disclosure about write actions can lead to silent project changes that surprise users and weaken change control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README encourages users to 'report this error to AutoHeal' without warning that error details may be transmitted to a third-party service and could include sensitive data from logs, stack traces, request context, or user content. In a monitoring/error-reporting skill, this omission is particularly risky because agents may forward data automatically and users may not realize the privacy implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill includes shell-capable examples (curl commands) and code that performs network exfiltration, but it declares no tool scope or permissions boundaries. That omission makes the skill less transparent and increases the chance a user or agent will run networked commands without understanding the external access and data-handling implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This browser fetch sends error messages, stack traces, source URLs, and browser fingerprinting data to an external domain. In the skill context, this is more dangerous because it is framed as drop-in code for production apps, so users may unknowingly exfiltrate sensitive runtime data from every client session.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

html

<script>
window.onerror = function(msg, source, line, col, err) {
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This unhandled rejection handler automatically transmits potentially sensitive exception content and the current page URL to a remote API. Rejection reasons may contain application state, secrets, or user data, making broad automatic forwarding an avoidable data leakage risk.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

window.onunhandledrejection = function(e) {
  const err = e.reason;
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The server-side uncaught exception hook sends raw error messages and stack traces to an external service. Server exceptions frequently include internal file paths, query fragments, credentials, tokens, or business data, so automatic offsite transmission can expose sensitive backend information.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

javascript

process.on('uncaughtException', (err) => {
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This handler converts arbitrary rejection reasons into errors and sends them externally, broadening the range of potentially sensitive application data that may be exfiltrated. Because promise rejections can carry raw objects or strings from business logic, the data exposure surface is larger than ordinary exception logging.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

process.on('unhandledRejection', (reason) => {
  const err = reason instanceof Error ? reason : new Error(String(reason));
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

After an error is ingested, check its analysis status:

bash

curl -s "https://autohealai.com/api/errors/{ERROR_ID}/status" \
  -H "Authorization: Bearer $AUTOHEAL_API_KEY"

Static analysis

No suspicious patterns detected.