AutoHeal AI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:14 AM UTC
• Version: 1.0.0

Overview

This skill matches its stated error-monitoring purpose, but its examples expose an API key in browser code and send raw error details to AutoHeal without clear privacy controls.

Install only after reviewing the AutoHeal data flow. Do not put a privileged AutoHeal API key in frontend code; use a backend proxy or a restricted public ingestion token if available. Add redaction for stack traces, messages, URLs, and user data before sending telemetry, and require explicit approval before an agent modifies production application entry points.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24
• Finding: Client-Side Exposure of the AutoHeal API Key## Vulnerability Details **File Location**: `SKILL.md:24-30` and `SKILL.md:43-49` **Vulnerability Type**: Client-side credential exposure **Risk Level**: High The browser integration instructs users to include `AUTOHEAL_API_KEY` in requests made directly from client-side JavaScript. ```javascript headers: { "Content-Type": "application/json" }, body: JSON.stringify({ key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY", message: msg, stack: err?.stack || "", source_url: source, browser: navigator.userAgent }) ``` The same credential handling is repeated for unhandled promise rejections: ```javascript headers: { "Content-Type": "application/json" }, body: JSON.stringify({ key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY", message: err?.message || String(err), stack: err?.stack || "", source_url: window.location.href, browser: navigator.userAgent }) ``` ### Technical Analysis Secrets cannot be securely retained in browser-side code. JavaScript build systems commonly replace environment-variable expressions during compilation, causing the resulting API key to be included in downloadable application bundles. Even if substitution does not occur, users are instructed to replace the placeholder with a usable key. The API key is also included directly in the JSON request body. Site visitors, browser extensions, injected scripts, browser developer tools, and systems with access to captured network requests can inspect and recover it. The project uses the same `AUTOHEAL_API_KEY` as a bearer token when querying error status. The documentation does not establish that browser-facing keys are short-lived, origin-restricted, ingestion-only, or otherwise separated from credentials used for authenticated API operations. ### Attack Path 1. A project follows the documented browser integration and supplies its AutoHeal API key. 2. The key is embedded in a client-side bundle or exposed in ...[truncated 1097 chars]
• Remediation: ## Remediation Suggestions 1. Never include a privileged AutoHeal API key in browser code, build-time frontend environment variables, or browser request bodies. 2. Route browser telemetry through an application-controlled backend. The backend should hold the API key and forward only validated, sanitized fields. 3. If direct browser ingestion is required, introduce a separate public ingestion token that is: - Restricted to ingestion only. - Bound to explicitly configured origins. - Short-lived and easily rotated. - Protected by per-origin and per-client rate limits. - Unable to query errors, account information, or other authenticated resources. 4. Separate ingestion credentials from management and status-query credentials. 5. Add abuse controls, including payload limits, replay protection, anomaly detection, and revocation. 6. Update the Skill instructions to explain explicitly that server API keys must never be exposed to frontend applications.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26
• Finding: Unredacted Production Error and URL Data Sent to a Third Party## Vulnerability Details **File Location**: `SKILL.md:26-31`, `SKILL.md:43-49`, `SKILL.md:64-65`, and `SKILL.md:75-76` **Vulnerability Type**: Unrestricted sensitive telemetry disclosure **Risk Level**: Medium The browser integration automatically sends exception messages, stack traces, source or current URLs, and browser identifiers to `https://autohealai.com`. ```javascript body: JSON.stringify({ key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY", message: msg, stack: err?.stack || "", source_url: source, browser: navigator.userAgent }) ``` For rejected promises, it transmits the complete current page URL: ```javascript body: JSON.stringify({ key: process.env.AUTOHEAL_API_KEY || "YOUR_API_KEY", message: err?.message || String(err), stack: err?.stack || "", source_url: window.location.href, browser: navigator.userAgent }) ``` The Node.js integration also sends raw exception content: ```javascript message: err.message, stack: err.stack || "" ``` The same behavior is used for unhandled rejections: ```javascript message: err.message, stack: err.stack || "" ``` ### Technical Analysis Exception messages and stack traces are not guaranteed to contain only diagnostic information. Depending on application behavior, they may include access tokens, request parameters, user identifiers, personal information, database details, internal filesystem paths, source structure, or values derived from rejected objects. Sending `window.location.href` is especially risky because it includes the complete query string and fragment. URLs can contain OAuth authorization codes, password-reset tokens, invitation tokens, search terms, email addresses, internal record identifiers, or other sensitive information. The global handlers transmit data automatically for every uncaught exception and unhandled rejection. The instructions provide no field allowlist, secret redaction, URL normali ...[truncated 1634 chars]
• Remediation: ## Remediation Suggestions 1. Remove query strings and fragments before transmitting a URL. Prefer sending only a normalized route template or pathname. 2. Apply a strict telemetry schema and allowlist only fields required for analysis. 3. Redact credentials, authorization headers, cookies, email addresses, tokens, and known personal-data patterns from messages and stack traces. 4. Truncate messages and stack traces to bounded lengths and reject oversized payloads. 5. Avoid serializing arbitrary rejection reasons. Extract only safe fields from genuine `Error` objects. 6. Provide application-level filtering hooks so projects can suppress sensitive errors or fields. 7. Make production telemetry explicitly configurable and document the external destination, retention policy, access controls, and data-processing implications. 8. Disable collection in sensitive routes or environments unless explicitly enabled. 9. Add automated tests verifying that URLs, tokens, credentials, and representative personal data are redacted before transmission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs users to automatically send production error messages, stack traces, source URLs, and browser/user-agent context to a third-party API, but it provides no privacy warning, consent step, or data-minimization guidance. Error telemetry often contains sensitive information such as internal paths, tokens in URLs, PII, or proprietary code details, so silent transmission materially increases confidentiality risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The browser example embeds `process.env.AUTOHEAL_API_KEY` into client-side code and even falls back to a literal placeholder, encouraging use of an API credential in the browser. Client-side secrets are exposed to end users and attackers through source inspection or runtime tooling, enabling unauthorized use of the API and possible access to associated error data.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation examples are broad enough that an agent could apply the skill in situations the user did not explicitly authorize, including making code or configuration changes to an arbitrary project. In an agentic context, vague activation cues increase the chance of overreach and unintended modification, especially because the README frames setup as a general capability without clear preconditions or consent boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup description tells users the agent can 'set up AutoHeal error monitoring' but does not warn that this may modify source files, dependencies, environment configuration, or deployment settings. For agent-driven tooling, lack of disclosure about write actions can lead to silent project changes that surprise users and weaken change control.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README encourages users to 'report this error to AutoHeal' without warning that error details may be transmitted to a third-party service and could include sensitive data from logs, stack traces, request context, or user content. In a monitoring/error-reporting skill, this omission is particularly risky because agents may forward data automatically and users may not realize the privacy implications.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill includes shell-capable examples (curl commands) and code that performs network exfiltration, but it declares no tool scope or permissions boundaries. That omission makes the skill less transparent and increases the chance a user or agent will run networked commands without understanding the external access and data-handling implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

```html
<script>
window.onerror = function(msg, source, line, col, err) {
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 95% confidence
• Finding: This browser `fetch` sends error messages, stack traces, source URLs, and browser fingerprinting data to an external domain. In the skill context, this is more dangerous because it is framed as drop-in code for production apps, so users may unknowingly exfiltrate sensitive runtime data from every client session.

External Transmission

Medium

• Category: Data Exfiltration

Content

window.onunhandledrejection = function(e) {
  const err = e.reason;
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 95% confidence
• Finding: This unhandled rejection handler automatically transmits potentially sensitive exception content and the current page URL to a remote API. Rejection reasons may contain application state, secrets, or user data, making broad automatic forwarding an avoidable data leakage risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```javascript
process.on('uncaughtException', (err) => {
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 92% confidence
• Finding: The server-side uncaught exception hook sends raw error messages and stack traces to an external service. Server exceptions frequently include internal file paths, query fragments, credentials, tokens, or business data, so automatic offsite transmission can expose sensitive backend information.

External Transmission

Medium

• Category: Data Exfiltration

Content

process.on('unhandledRejection', (reason) => {
  const err = reason instanceof Error ? reason : new Error(String(reason));
  fetch("https://autohealai.com/api/errors/ingest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 92% confidence
• Finding: This handler converts arbitrary rejection reasons into errors and sends them externally, broadening the range of potentially sensitive application data that may be exfiltrated. Because promise rejections can carry raw objects or strings from business logic, the data exposure surface is larger than ordinary exception logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

After an error is ingested, check its analysis status:

```bash
curl -s "https://autohealai.com/api/errors/{ERROR_ID}/status" \
  -H "Authorization: Bearer $AUTOHEAL_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.