TokenLab API Integration

• Outcome: Pass
• Latest audit: Oct 2, 2026 · 7:20 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed TokenLab integration helper that can create reversible client configuration files and call TokenLab APIs when you ask it to.

Before installing, review the generated preview and only use --apply when you want a client configured for TokenLab. Keep TOKENLAB_API_KEY in a local secret manager or process environment, avoid pasting keys into chat, and treat live inference/media/task calls as potentially billable. Prefer installing from a pinned reviewed source rather than the mutable README GitHub command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad TokenLab API integration and code-generation skill covering multiple model families and media/task APIs. The supplied code instead performs a narrow, local setup task: safely configuring and launching Claude Code to use TokenLab as the backend by writing a managed launcher and setting environment variables such as ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN. It inspects local files, checks policy-managed settings, validates Claude CLI version/capabilities, and optionally runs Claude with --print or auth-status. These behaviors are materially different from the declared primary purpose. While it is related to TokenLab, it does not implement the advertised API integration/code-generation functionality, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description advertises a broad TokenLab API integration skill and multi-language code generation capability. The supplied code instead only configures a Codex CLI profile file for using TokenLab as a model provider via a Responses wire API. It validates profile/model names, checks Codex version/help output, writes/restores TOML config and backup files, and prints usage instructions. While it references TokenLab base URL and API key env var, it does not implement the described API surface, endpoint selection across multiple providers/modalities, asynchronous task handling, or code generation. This is a material purpose mismatch, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a general-purpose TokenLab API integration skill covering many API products and code-generation capabilities. The actual code only configures one provider inside Hermes 0.21.3, with a fixed API base URL, environment variable reference, and chat_completions transport. It performs local filesystem/environment inspection and safe config modification, not API selection across contracts or generation of client snippets. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad TokenLab API integration skill supporting many endpoint families and code generation across languages. The supplied code does not implement those integrations. Instead, it configures a local OpenCode client/provider entry pointing to https://api.tokenlab.sh/v1 with an environment-variable API key, specifically for models that accept Chat Completions. It manipulates local config files, validates provider/model names, checks OpenCode client version and config selection, and optionally applies or restores configuration changes. This is a materially different primary purpose from the declared multi-API integration and code-generation functionality, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

描述声称这是一个 TokenLab/LemonData AI API 集成能力，覆盖多种原生端点与媒体/异步能力，并可按模型契约生成多语言代码。给出的代码却只是一个配置辅助脚本：校验 provider/model，定位本地 Pi agent 目录，准备/应用 models.json 中的 provider 配置，引用 TOKENLAB_API_KEY 环境变量，并可 restore 回滚。脚本明确提示“does not make API requests”。因此其主目的与描述不一致：它不是一个 API 集成与代码生成实现，而是面向 Pi 客户端的本地 provider 配置工具。虽然它确实与 TokenLab 相关，但仅限于把 TokenLab Chat Completions 端点登记到 Pi 中，远窄于声明范围，且新增了未声明的本地配置修改行为。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about integrating TokenLab/LemonData AI services and generating API usage code for many model families and modalities. The supplied code does none of that. Instead, it strictly edits YAML configuration for a Hermes provider, using PyYAML to parse and safely insert a provider mapping into a config document. It does not call external APIs, generate language SDK snippets, select model endpoints, or implement any multimedia, embeddings, rerank, file, or async-task behavior. This is a clear description-behavior mismatch with a materially different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码块的核心功能不是“集成 TokenLab AI API”，而是为本地客户端配置文件安全地插入/恢复 provider 配置。它处理 JSON 解析、注释/尾逗号兼容、重复键检测、备份与完整性哈希、并发写保护、恢复逻辑，以及通过子进程调用本地客户端的 --version 来检测安装与版本。虽然出现了“TokenLab”命名，但仅用于 provider 名称、受管标记和配置管理，并没有任何实际的 API 请求、端点选择、模型路由、代码生成或异步任务调用实现。因此，描述与代码行为存在明显且实质性的用途不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents a comprehensive TokenLab API integration skill that can choose native endpoints for many model families and generate example code in several languages. The supplied code instead is narrowly scoped to public model discovery: it calls /v1/models and /v1/models/{id}, inspects metadata such as accepted request formats and request contracts, and prints summaries or JSON. While it does infer a preferred endpoint from model metadata, that is only advisory inspection logic, not actual integration with those endpoints. There is no implementation for sending chat/messages/responses requests, invoking image/video/music/3D/TTS/STT/files/embeddings/rerank/System One operations, handling async tasks, or generating SDK/cURL snippets. So the actual behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向 TokenLab AI API 的集成与代码生成技能，而提供的代码块仅实现本地 setup 过程中的文件安全操作。这段代码不涉及聊天、Responses、Anthropic/Gemini、多媒体 API、embeddings、rerank、System One、异步任务，也不涉及任何远程服务访问。其主要目的与声明明显不同；虽然它可能是某个 setup helper 的支撑模块，但就该代码块本身而言，行为与声明严重不符，因此应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

| Video | `POST /v1/videos/generations` | async |
| Music | `POST /v1/music/generations` | async |
| 3D | `POST /v1/3d/generations` | async |
| Task status / cancel | `GET` / `DELETE /v1/tasks/{id}` | poll / cancel |
| TTS | `POST /v1/audio/speech` | binary audio or endpoint-declared response |
| STT / translation | `POST /v1/audio/transcriptions`, `/translations` | multipart |
| Files | `/v1/files` family | multipart / JSON |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

| Video | `POST /v1/videos/generations` | async |
| Music | `POST /v1/music/generations` | async |
| 3D | `POST /v1/3d/generations` | async |
| Task status / cancel | `GET` / `DELETE /v1/tasks/{id}` | poll / cancel |
| TTS | `POST /v1/audio/speech` | binary audio or endpoint-declared response |
| STT / translation | `POST /v1/audio/transcriptions`, `/translations` | multipart |
| Files | `/v1/files` family | multipart / JSON |

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/hermes_setup.md (reported line 22)May include surrounding context.

macOS/Linux:

bash

"$HERMES_PYTHON" scripts/configure_hermes.py --model gpt-5.6-luna
"$HERMES_PYTHON" scripts/configure_hermes.py --model gpt-5.6-luna --apply

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/hermes_setup.md (reported line 23)May include surrounding context.

bash

"$HERMES_PYTHON" scripts/configure_hermes.py --model gpt-5.6-luna
"$HERMES_PYTHON" scripts/configure_hermes.py --model gpt-5.6-luna --apply

Windows PowerShell:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/hermes_setup.md (reported line 52)May include surrounding context.

bash

hermes --profile default config get providers.tokenlab.api
hermes --profile default chat --provider custom:tokenlab --model gpt-5.6-luna

Use process-scoped environment changes and restore their prior values afterward. Normal launches retain the prior model and account. Inspecting the provider only verifies configuration loading, not key validity. Only when the user chooses a billable test should the client send a small task; inspect the complete response and matching TokenLab request record. A tool round trip and continuation are separate from configuration inspection.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/pi_setup.md (reported line 28)May include surrounding context.

bash

pi --list-models tokenlab
pi --provider tokenlab --model gpt-5.6-luna

Use your chosen provider name in both commands. Pi lists only models with configured authentication; an unset environment key can make TokenLab absent from discovery even when models.json loaded correctly. Existing saved credentials with the same provider name cause this helper to stop, so it cannot silently replace that account's authentication source.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 71% confidence

Finding

The launcher copies the entire parent environment, which can unintentionally forward unrelated secrets, proxy settings, or dangerous interpreter/runtime variables into the spawned Claude process. In a skill context that integrates third-party API access and launches another tool, over-broad environment inheritance increases the blast radius if the child process logs, exposes, or is influenced by inherited variables.

Content

Scanner excerpt · scripts/configure_claude.py (reported line 226)May include surrounding context.

python

key = os.environ.get(KEY_ENV)
    if not key or any(character.isspace() for character in key):
        raise SetupError("Set a complete TOKENLAB_API_KEY in your local launch environment; never pass it as an argument.")
    environment = os.environ.copy()
    environment.update(session_settings()["env"])
    environment["ANTHROPIC_AUTH_TOKEN"] = key
    environment["CLAUDE_CONFIG_DIR"] = str(root)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/configure_hermes.py (reported line 60)May include surrounding context.

python

if managed_dir.is_dir():
        raise SetupError("A Hermes managed scope is present; automatic setup will not override it.")
    guards = {root / ".managed": marker}
    for filename in ("config.yaml", ".env"):
        guards[managed_dir / filename] = read_file(managed_dir / filename, allow_links=True)
    for filename in (".env", "auth.json"):
        guards[root / filename] = read_file(root / filename, allow_links=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/configure_hermes.py (reported line 62)May include surrounding context.

python

if managed_dir.is_dir():
        raise SetupError("A Hermes managed scope is present; automatic setup will not override it.")
    guards = {root / ".managed": marker}
    for filename in ("config.yaml", ".env"):
        guards[managed_dir / filename] = read_file(managed_dir / filename, allow_links=True)
    for filename in (".env", "auth.json"):
        guards[root / filename] = read_file(root / filename, allow_links=True)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx skills add directly from a GitHub repository without pinning to an immutable version, commit SHA, or verified release. This creates a supply-chain risk: if the referenced package, installer behavior, or fetched repository contents change, users may execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill describes scripts that perform network access, local file writes, shell/Python execution, and environment-variable handling, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent runtime will grant broader capabilities than users expect, enabling unintended config changes or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is entirely in Chinese and presents the skill behavior, triggers, and usage context only in that language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not provided here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration_examples.md (reported line 188)May include surrounding context.

Use only when the detail contract contains gemini_generate_content. Keep native contents, parts, tools, files, and cached-content fields on this route.

bash

curl --fail-with-body \
  -X POST 'https://api.tokenlab.sh/v1beta/models/<model-id>:generateContent' \
  -H "Authorization: Bearer $TOKENLAB_API_KEY" \
  -H 'Content-Type: application/json' \

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/configure_claude.py (reported line 59)May include surrounding context.

python

APPDATA=directory, LOCALAPPDATA=directory, TMPDIR=directory,
                           TMP=directory, TEMP=directory)
        try:
            version = subprocess.run([command, "--version"], env=environment, cwd=directory,
                                     capture_output=True, text=True, timeout=10, check=True)
            help_result = subprocess.run([command, "--help"], env=environment, cwd=directory,
                                         capture_output=True, text=True, timeout=10, check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/configure_codex.py (reported line 80)May include surrounding context.

python

APPDATA=directory, LOCALAPPDATA=directory, TMPDIR=directory,
                           TMP=directory, TEMP=directory)
        try:
            version = subprocess.run([command, "--version"], env=environment, cwd=directory,
                                     capture_output=True, text=True, timeout=10, check=True)
            help_result = subprocess.run([command, "--help"], env=environment, cwd=directory,
                                         capture_output=True, text=True, timeout=10, check=True)

Tainted flow: 'environment' from os.environ.get (line 54, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/configure_claude.py (reported line 59)May include surrounding context.

python

APPDATA=directory, LOCALAPPDATA=directory, TMPDIR=directory,
                           TMP=directory, TEMP=directory)
        try:
            version = subprocess.run([command, "--version"], env=environment, cwd=directory,
                                     capture_output=True, text=True, timeout=10, check=True)
            help_result = subprocess.run([command, "--help"], env=environment, cwd=directory,
                                         capture_output=True, text=True, timeout=10, check=True)