Jeftest

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:54 AM UTC
• Version: 0.0.1

Overview

This skill is a broad Maton API gateway that appears purpose-aligned, but it exposes high-impact third-party actions under one API key with limited guardrails.

Install only if you intend to let the agent operate a broad API gateway. Treat MATON_API_KEY like a high-value credential, avoid printing or sharing it, review and limit each connected service's scopes, specify the intended Maton connection when multiple exist, and require explicit confirmation before deletes, public posts, payment/customer changes, admin changes, webhooks, or bulk updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:594
• Finding: API Key Disclosure Through Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md:594-600` **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```markdown ### Troubleshooting: API Key Issues 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEY ``` ``` ### Technical Analysis The troubleshooting instructions print the complete `MATON_API_KEY` value to standard output. This bearer credential authenticates requests to Maton's API gateway and connection-management service. Although transmitting the key in an HTTPS `Authorization` header is necessary for the declared gateway functionality, displaying it in plaintext is unnecessary. Terminal output can be captured in CI logs, agent transcripts, shell recordings, screenshots, support bundles, or shared troubleshooting output. ### Attack Path 1. A user encounters an authentication problem and follows the documented troubleshooting procedure. 2. `echo $MATON_API_KEY` prints the complete credential. 3. The terminal output is recorded, uploaded, copied into a support request, exposed in an agent transcript, or observed by another local user. 4. An attacker extracts the credential. 5. The attacker supplies it as a bearer token to `gateway.maton.ai` or `ctrl.maton.ai`. 6. The attacker accesses or modifies resources through the victim's existing authorized connections, subject to the OAuth scopes and permissions granted to those connections. ### Impact Assessment Credential compromise could allow an attacker to enumerate or manage Maton connections and invoke supported third-party APIs through authorized integrations. The exact scope depends on the victim's connected services and OAuth grants. Potential effects include reading sensitive business data, creating or modifying records, sending messages, and deleting resources where the underlying connection permits those operations. This issue does not independently expose third-party OAuth tokens, but the Maton ...[truncated 86 chars]
• Remediation: ## Remediation Suggestions Replace the secret-printing command with a presence check that does not disclose the value: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fi ``` Additional hardening measures: 1. Explicitly instruct users never to print, log, screenshot, or share the API key. 2. Redact authorization headers and secret environment variables from logs and support bundles. 3. Recommend immediate key rotation following suspected disclosure. 4. Prefer short-lived, narrowly scoped credentials where supported. 5. Document how users can review active connections and revoke unauthorized access. 6. Avoid placing session-bearing connection URLs in logs because their query parameters may also be sensitive.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (521)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Contact
```bash
DELETE /active-campaign/api/3/contacts/{contactId}
```

### Tags

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Remove Tag from Contact
```bash
DELETE /active-campaign/api/3/contactTags/{contactTagId}
```

### Lists

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Block
```bash
DELETE /acuity-scheduling/api/v1/blocks/{id}
```

### List Forms

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Records
```bash
DELETE /airtable/v0/{baseId}/{tableIdOrName}?records[]=recXXXXX&records[]=recYYYYY
```

### List Bases

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Scope Creep

High

• Confidence: 93% confidence
• Finding: The skill metadata says access is strictly limited to user-authorized OAuth connections, but this Apollo reference states authentication is automatic via an injected API key. That mismatch can cause an agent or operator to assume stronger authorization boundaries than actually exist, creating a confused-deputy risk where requests may be sent to Apollo without the explicit per-user consent model described in the manifest.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete a Task
```bash
DELETE /asana/api/1.0/tasks/{task_gid}
```

### Get Subtasks

• Confidence: 90% confidence
• Finding: This endpoint enables deletion of arbitrary tasks by task ID, and the documentation provides it without any guardrails, confirmation requirements, or validation guidance. In a routed agent environment connected to user-authorized Asana tenants, prompt-influenced parameter selection could cause unintended or attacker-induced task deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```bash
DELETE /asana/api/1.0/webhooks/{webhook_gid}
```

## Notes

• Confidence: 88% confidence
• Finding: This endpoint allows deletion of webhooks, which can disable downstream integrations, monitoring, or automations. In an agent-exposed API reference, presenting the delete call without warnings or ownership checks increases the risk of misuse through parameter abuse or accidental invocation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Record
```bash
DELETE /attio/v2/objects/{object}/records/{record_id}
```

### List Tasks

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Note
```bash
DELETE /attio/v2/notes/{note_id}
```

### Comments

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete List Entry
```bash
DELETE /attio/v2/lists/{list}/entries/{entry_id}
```

### Meetings

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Row
```bash
DELETE /baserow/api/database/rows/table/{table_id}/{row_id}/
```

### Batch Create Rows

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Subscription
```bash
DELETE /beehiiv/v2/publications/{publication_id}/subscriptions/{subscription_id}
```

### Posts

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Folder
```bash
DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Folder
```bash
DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true
```

### Get File

• Confidence: 83% confidence
• Finding: The recursive deletion parameter materially increases destructive scope by allowing an entire folder tree to be removed, yet the documentation presents it without guardrails or warnings. In an agent-executed integration, a mistaken or manipulated folder_id combined with recursive=true could cause bulk data loss across many files and subfolders.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete File
```bash
DELETE /box/2.0/files/{file_id}
```

### Create Shared Link

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Trash
```bash
GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash
```

• Confidence: 80% confidence
• Finding: Deleting a file from trash implies permanent removal or destruction of recoverability, and the documentation gives no warning about that elevated impact. In an enterprise content integration, permanent deletion endpoints are more dangerous than ordinary deletes because they bypass recovery expectations and can be triggered by automation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash
```

### Collections

• Confidence: 82% confidence
• Finding: Permanent deletion of folders from trash can remove large sets of content and may eliminate recovery options, making this a high-impact operation when exposed through an agent skill. The reference lists it without warning, scope caveats, or safeguards, which increases the risk of catastrophic data loss if misused.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
GET /box/2.0/webhooks
POST /box/2.0/webhooks
DELETE /box/2.0/webhooks/{webhook_id}
```

## Pagination

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Contact
```bash
DELETE /brevo/v3/contacts/{identifier}
```

### Lists

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Event Type
```bash
DELETE /cal-com/v2/event-types/{eventTypeId}
```

### Event Type Webhooks

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Webhook
```bash
DELETE /cal-com/v2/event-types/{eventTypeId}/webhooks/{webhookId}
```

### Bookings

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Schedule
```bash
DELETE /cal-com/v2/schedules/{scheduleId}
```

### Availability Slots

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Webhook
```bash
DELETE /cal-com/v2/webhooks/{webhookId}
```

### Teams

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook Subscription
```bash
DELETE /calendly/webhook_subscriptions/{uuid}
```

## Notes

• Confidence: 84% confidence
• Finding: The documented delete-webhook endpoint accepts a user-controlled UUID for a destructive operation, and the README provides no guardrails around authorization context, ownership checks, or confirmation. In an agent/tooling context, this raises the risk of parameter abuse where a model is tricked into deleting legitimate webhook subscriptions, disrupting integrations or monitoring flows.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Tag
```bash
DELETE /callrail/v3/a/{account_id}/tags/{tag_id}.json
```

### Users

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete Google Sheets spreadsheet ID instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:497

Example code exposes a concrete connection_id instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:94