Security audit

Snapshot to API

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about API discovery, but it can use a logged-in browser session to inspect and sample authenticated API data without strong safeguards.

Install only if you are comfortable letting the agent inspect network calls and fetch APIs from pages you open while logged in. Use it on user-approved sites, avoid sensitive account, billing, profile, admin, or auth endpoints, and review any discovered API details before saving them into another skill or long-term notes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/discover_apis.js:15
Finding: Overbroad hostname matching exposes unrelated cross-origin request URLs
Content: View full analysis
e.name.includes(hostname)) .filter(e => !e.name.match(/\.(js|css|png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot)(\?|$)/)); ``` The same pattern is prescribed in `SKILL.md:35-37`: ```javascript const entries = performance.getEntriesByType('resource') .filter(e => e.name.includes(window.location.hostname) && !e.name.match(/\.(js|css|png|jpg|webp|svg|woff|ttf)(\?|$)/)) ``` ### Technical Analysis The code claims to select resources from the same domain, but it uses substring matching against the complete URL. This does not verify the parsed URL's hostname or origin. For example, if the current hostname is `target.example`, all of the following can satisfy the check: ```text https://target.example.attacker.test/api https://attacker.test/path?source=target.example https://attacker.test/target.example/api ``` The script subsequently parses accepted entries and returns their paths, including query strings: ```javascript const url = new URL(e.name); const path = url.pathname + url.search; ``` Query parameters may contain signed URL values, access identifiers, personal data, search terms, or session-like secrets. Although paths are truncated to 200 characters in the script, truncation is not redaction and does not reliably prevent disclosure. This behavior exceeds the minimum privilege necessary for same-origin API discovery because unrelated cross-origin resources are included even though the declared functionality only requires discovering APIs associated with the target application. ### Attack Path 1. A user opens a maliciou ...[truncated 1310 chars]
Remediation: View remediation
{ try { return new URL(entry.name).origin === currentOrigin; } catch { return false; } }) .filter(entry => !new URL(entry.name).pathname.match( /\.(js|css|png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot)$/i ) ); ``` 2. If trusted subdomains are required, use an explicit hostname allowlist rather than suffix or substring matching. 3. Do not return complete query strings by default. Return the origin and pathname, together with parameter names but not parameter values: ```javascript const url = new URL(entry.name); const safeEntry = { origin: url.origin, path: url.pathname, queryParameters: [...url.searchParams.keys()] }; ``` 4. Explicitly redact sensitive parameter names such as `token`, `key`, `secret`, `signature`, `auth`, `session`, and `code`. 5. Require confirmation before testing any endpoint outside the exact origin of the page. 6. Apply the same correction to both the executable script and the workflow example in `SKILL.md` so users are not instructed to reproduce the vulnerable pattern. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:58
Finding: Authenticated API responses are sampled without sensitive-data filtering
Content: View full analysis
{ return fetch('') .then(r => r.json()) .then(data => { // Inspect the structure const keys = Object.keys(data?.data || data || {}); return JSON.stringify({ topLevelKeys: keys, sample: JSON.stringify(data).substring(0, 1000) }); }); } ``` ### Technical Analysis The Skill directs the Agent to fetch an API through the active browser session and serialize the first 1,000 characters of the response into its output. Because the target page is opened first to establish cookie or session authentication, the API response may contain information available only to the authenticated user. The code does not: - Classify the endpoint before reading its response. - Limit inspection to fields required for the user's task. - Detect or redact credentials, tokens, personal data, or internal identifiers. - Validate the response content type or status. - Ask for confirmation before sampling a potentially sensitive endpoint. Selecting the first 1,000 serialized characters is not a security boundary. Sensitive fields are commonly placed near the beginning of JSON objects, and the location of a secret is controlled by the response format. The response sample is then returned to the Agent and may enter model context or associated logs. The declared purpose of this step is to understand the response structure. That purpose can be fulfilled using top-level key names, value types, array lengths, and a user-approved field allowlist. Returning arbitrary values therefore exceeds the minimum data access needed for structural discovery. ### Attack Path 1. The Skill opens a target page and establishes the user's authenticated browser session. 2. Endpoint discovery identifies an API that is accessible with that ...[truncated 1566 chars]
Remediation: View remediation
fetch('') .then(response => { if (!response.ok) { throw new Error(`HTTP ${response.status}`); } const contentType = response.headers.get('content-type') || ''; if (!contentType.includes('application/json')) { throw new Error('Expected a JSON response'); } return response.json(); }) .then(data => { const value = data?.data ?? data; if (Array.isArray(value)) { return JSON.stringify({ type: 'array', length: value.length, itemKeys: value.length && value[0] && typeof value[0] === 'object' ? Object.keys(value[0]) : [] }); } return JSON.stringify({ type: typeof value, topLevelKeys: value && typeof value === 'object' ? Object.keys(value) : [] }); }); ``` 3. If values are necessary, require an explicit allowlist of fields directly related to the user's request. 4. Add recursive redaction for sensitive key names, including `password`, `secret`, `token`, `authorization`, `cookie`, `session`, `email`, `phone`, and `accessKey`. 5. Require user confirmation before reading endpoints that appear to contain user profiles, authentication details, billing data, administrative records, or bulk datasets. 6. Preserve the documented prohibition on write operations and add an explicit restriction against testing user-information, authentication, analytics, and configuration endpoints. 7. Minimize retention by avoiding raw API response data in logs and Agent output unless it is essential to the requested task. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to open arbitrary target pages, enumerate network resources, and issue fetch requests to discovered endpoints, which clearly exercises network-capable behavior. Because the manifest declares no explicit tool scope or allowed-tools restrictions, the skill grants broader-than-declared capability and makes it harder to enforce least privilege or review what external access is intended. In this context, the skill is specifically about API discovery against arbitrary sites, which increases exposure to unintended data access and cross-environment misuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.