Jeftest

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:54 AM UTC
• Version: 0.0.1

Overview

This skill is a broad Maton API gateway that appears purpose-aligned, but it exposes high-impact third-party actions under one API key with limited guardrails.

Install only if you intend to let the agent operate a broad API gateway. Treat MATON_API_KEY like a high-value credential, avoid printing or sharing it, review and limit each connected service's scopes, specify the intended Maton connection when multiple exist, and require explicit confirmation before deletes, public posts, payment/customer changes, admin changes, webhooks, or bulk updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:594

Finding

API Key Disclosure Through Troubleshooting Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:594-600
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

markdown

### Troubleshooting: API Key Issues

1. Check that the `MATON_API_KEY` environment variable is set:

```bash
echo $MATON_API_KEY

text

### Technical Analysis

The troubleshooting instructions print the complete `MATON_API_KEY` value to standard output. This bearer credential authenticates requests to Maton's API gateway and connection-management service.

Although transmitting the key in an HTTPS `Authorization` header is necessary for the declared gateway functionality, displaying it in plaintext is unnecessary. Terminal output can be captured in CI logs, agent transcripts, shell recordings, screenshots, support bundles, or shared troubleshooting output.

### Attack Path

1. A user encounters an authentication problem and follows the documented troubleshooting procedure.
2. `echo $MATON_API_KEY` prints the complete credential.
3. The terminal output is recorded, uploaded, copied into a support request, exposed in an agent transcript, or observed by another local user.
4. An attacker extracts the credential.
5. The attacker supplies it as a bearer token to `gateway.maton.ai` or `ctrl.maton.ai`.
6. The attacker accesses or modifies resources through the victim's existing authorized connections, subject to the OAuth scopes and permissions granted to those connections.

### Impact Assessment

Credential compromise could allow an attacker to enumerate or manage Maton connections and invoke supported third-party APIs through authorized integrations. The exact scope depends on the victim's connected services and OAuth grants. Potential effects include reading sensitive business data, creating or modifying records, sending messages, and deleting resources where the underlying connection permits those operations.

This issue does not independently expose third-party OAuth tokens, but the Maton
...[truncated 86 chars]

Remediation

View remediation

Remediation Suggestions

Replace the secret-printing command with a presence check that does not disclose the value:

bash

if [ -n "${MATON_API_KEY:-}" ]; then
  echo "MATON_API_KEY is set"
else
  echo "MATON_API_KEY is not set"
fi

Additional hardening measures:

1. Explicitly instruct users never to print, log, screenshot, or share the API key.
2. Redact authorization headers and secret environment variables from logs and support bundles.
3. Recommend immediate key rotation following suspected disclosure.
4. Prefer short-lived, narrowly scoped credentials where supported.
5. Document how users can review active connections and revoke unauthorized access.
6. Avoid placing session-bearing connection URLs in logs because their query parameters may also be sensitive.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (521)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/active-campaign/README.md (reported line 47)May include surrounding context.

Delete Contact

bash

DELETE /active-campaign/api/3/contacts/{contactId}

Tags

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/active-campaign/README.md (reported line 87)May include surrounding context.

Remove Tag from Contact

bash

DELETE /active-campaign/api/3/contactTags/{contactTagId}

Lists

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/acuity-scheduling/README.md (reported line 127)May include surrounding context.

Delete Block

bash

DELETE /acuity-scheduling/api/v1/blocks/{id}

List Forms

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/airtable/README.md (reported line 99)May include surrounding context.

Delete Records

bash

DELETE /airtable/v0/{baseId}/{tableIdOrName}?records[]=recXXXXX&records[]=recYYYYY

List Bases

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill metadata says access is strictly limited to user-authorized OAuth connections, but this Apollo reference states authentication is automatic via an injected API key. That mismatch can cause an agent or operator to assume stronger authorization boundaries than actually exist, creating a confused-deputy risk where requests may be sent to Apollo without the explicit per-user consent model described in the manifest.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This endpoint enables deletion of arbitrary tasks by task ID, and the documentation provides it without any guardrails, confirmation requirements, or validation guidance. In a routed agent environment connected to user-authorized Asana tenants, prompt-influenced parameter selection could cause unintended or attacker-induced task deletion.

Content

Scanner excerpt · references/asana/README.md (reported line 64)May include surrounding context.

Delete a Task

bash

DELETE /asana/api/1.0/tasks/{task_gid}

Get Subtasks

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This endpoint allows deletion of webhooks, which can disable downstream integrations, monitoring, or automations. In an agent-exposed API reference, presenting the delete call without warnings or ownership checks increases the risk of misuse through parameter abuse or accidental invocation.

Content

Scanner excerpt · references/asana/README.md (reported line 134)May include surrounding context.

Delete Webhook

bash

DELETE /asana/api/1.0/webhooks/{webhook_gid}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/attio/README.md (reported line 76)May include surrounding context.

Delete Record

bash

DELETE /attio/v2/objects/{object}/records/{record_id}

List Tasks

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/attio/README.md (reported line 144)May include surrounding context.

Delete Note

bash

DELETE /attio/v2/notes/{note_id}

Comments

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/attio/README.md (reported line 248)May include surrounding context.

Delete List Entry

bash

DELETE /attio/v2/lists/{list}/entries/{entry_id}

Meetings

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/baserow/README.md (reported line 57)May include surrounding context.

Delete Row

bash

DELETE /baserow/api/database/rows/table/{table_id}/{row_id}/

Batch Create Rows

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/beehiiv/README.md (reported line 61)May include surrounding context.

Delete Subscription

bash

DELETE /beehiiv/v2/publications/{publication_id}/subscriptions/{subscription_id}

Posts

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box/README.md (reported line 72)May include surrounding context.

Delete Folder

bash

DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

The recursive deletion parameter materially increases destructive scope by allowing an entire folder tree to be removed, yet the documentation presents it without guardrails or warnings. In an agent-executed integration, a mistaken or manipulated folder_id combined with recursive=true could cause bulk data loss across many files and subfolders.

Content

Scanner excerpt · references/box/README.md (reported line 73)May include surrounding context.

Delete Folder

bash

DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true

Get File

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box/README.md (reported line 98)May include surrounding context.

Delete File

bash

DELETE /box/2.0/files/{file_id}

Create Shared Link

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Deleting a file from trash implies permanent removal or destruction of recoverability, and the documentation gives no warning about that elevated impact. In an enterprise content integration, permanent deletion endpoints are more dangerous than ordinary deletes because they bypass recovery expectations and can be triggered by automation.

Content

Scanner excerpt · references/box/README.md (reported line 141)May include surrounding context.

Trash

bash

GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

Permanent deletion of folders from trash can remove large sets of content and may eliminate recovery options, making this a high-impact operation when exposed through an agent skill. The reference lists it without warning, scope caveats, or safeguards, which increases the risk of catastrophic data loss if misused.

Content

Scanner excerpt · references/box/README.md (reported line 142)May include surrounding context.

bash

GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash

Collections

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box/README.md (reported line 160)May include surrounding context.

bash

GET /box/2.0/webhooks
POST /box/2.0/webhooks
DELETE /box/2.0/webhooks/{webhook_id}

Pagination

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/brevo/README.md (reported line 56)May include surrounding context.

Delete Contact

bash

DELETE /brevo/v3/contacts/{identifier}

Lists

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com/README.md (reported line 50)May include surrounding context.

Delete Event Type

bash

DELETE /cal-com/v2/event-types/{eventTypeId}

Event Type Webhooks

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com/README.md (reported line 77)May include surrounding context.

Delete Webhook

bash

DELETE /cal-com/v2/event-types/{eventTypeId}/webhooks/{webhookId}

Bookings

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com/README.md (reported line 130)May include surrounding context.

Delete Schedule

bash

DELETE /cal-com/v2/schedules/{scheduleId}

Availability Slots

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com/README.md (reported line 188)May include surrounding context.

Delete Webhook

bash

DELETE /cal-com/v2/webhooks/{webhookId}

Teams

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The documented delete-webhook endpoint accepts a user-controlled UUID for a destructive operation, and the README provides no guardrails around authorization context, ownership checks, or confirmation. In an agent/tooling context, this raises the risk of parameter abuse where a model is tricked into deleting legitimate webhook subscriptions, disrupting integrations or monitoring flows.

Content

Scanner excerpt · references/calendly/README.md (reported line 89)May include surrounding context.

Delete Webhook Subscription

bash

DELETE /calendly/webhook_subscriptions/{uuid}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/callrail/README.md (reported line 120)May include surrounding context.

Delete Tag

bash

DELETE /callrail/v3/a/{account_id}/tags/{tag_id}.json

Users

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete Google Sheets spreadsheet ID instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:497

Example code exposes a concrete connection_id instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:94