simpleerp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.1

Overview

This SimpleERP helper matches its stated API purpose, but it needs review because it can automatically send API keys and make persistent ERP or admin changes, including to a user-specified HTTP host.

Install only if you trust the SimpleERP environment and are comfortable with an agent making authenticated API calls. Use it against localhost or an explicitly trusted HTTPS origin, avoid broad/admin API keys, review write or delete actions before execution, and treat API-key creation or rotation output as sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:18

Finding

API Key Exposure Through Plaintext HTTP and User-Controlled Destinations

Content

View full analysis

"` in production. ``` ### Technical Analysis The Skill permits the destination host to be supplied by the user and directs the agent to send an API key to that host. It does not require HTTPS for non-loopback destinations, restrict destinations to trusted origins, or require confirmation before forwarding an environment-derived credential to a changed origin. Although plaintext HTTP is ordinarily acceptable for traffic strictly confined to the loopback interface, the instruction explicitly allows replacing `localhost` with another host. An authenticated request to such a host can expose the `x-api-key` to: - The destination server operator. - A network attacker capable of observing or modifying plaintext traffic. - Proxies and network-monitoring systems. - Command execution or agent logs that record literal request headers. The ...[truncated 1637 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/admin-and-permissions.md:21

Finding

Raw Administrative API Key May Be Exposed in Execution Output and Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The instruction to 'run them automatically' gives the agent authority to make operational decisions and execute commands without a separate user approval checkpoint. Because this skill targets an ERP backend with authenticated administrative and data-modifying endpoints, autonomous execution can turn ambiguous prompts into real changes, deletions, or sensitive data retrieval.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## Agent execution policy

- If completing the user request requires running commands/scripts (including `curl` commands or PowerShell `Invoke-WebRequest` / `Invoke-RestMethod`), **run them automatically**. Do not ask the user to run/execute anything.
- **`GET /api/health`** may run **without** an API key. **All other** HTTP calls need a resolved `x-api-key` per **Credentials** below; if no key is available after that resolution, **ask once** for the key before issuing authenticated requests (then continue running commands automatically).

## Environment

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly directs the agent to execute HTTP commands automatically, which can cause network actions and data transmission without a clear user-facing confirmation at the moment of execution. In a skill that can perform create/update/delete operations against an ERP API, this increases the risk of unintended state changes or disclosure of business data if a user request is ambiguous or manipulated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/admin-and-permissions.md (reported line 16)May include surrounding context.

List system users

bash

curl "http://localhost:3000/api/admin/users?status=&limit=100&offset=0"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/admin-and-permissions.md (reported line 63)May include surrounding context.

Example: list permissions for a function

bash

curl "http://localhost:3000/api/permissions?functionId=<FUNCTION_ID>&limit=100&offset=0"

Example: list API key permission rows for one key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/documents-sales-purchasing.md (reported line 20)May include surrounding context.

List sale orders

bash

curl "http://localhost:3000/api/sale-orders?status=&customerId=&limit=100&offset=0"

Create a sale order

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document provides copy-pasteable POST examples that create sale and purchase orders in the ERP without any warning that these operations modify business data or should only be run with explicit user confirmation. In an agent-skill context, that increases the chance an automated assistant or user will execute destructive or financially significant actions unintentionally, affecting orders, inventory planning, and accounting workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/inventory-and-deliveries.md (reported line 14)May include surrounding context.

List inventory (filter by warehouse/product)

bash

curl "http://localhost:3000/api/inventory?warehouseId=&prodId=&limit=100&offset=0"

Get inventory for a specific warehouse and product

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This documentation includes state-changing inventory transfer and adjustment examples that can modify stock levels, but it does not clearly warn users that these operations alter business data and may trigger downstream fulfillment or accounting effects. In an agent skill context, omission of such warnings increases the chance of accidental destructive or unauthorized actions when an automation follows the examples literally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/master-data-endpoints.md (reported line 22)May include surrounding context.

List system parameters

bash

curl "http://localhost:3000/api/sys-par?codePrefix=&limit=100&offset=0"

Create a system parameter

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents multiple POST-style create actions for system parameters, currencies, warehouses, account managers, partners, customers, and suppliers, but it does not include any user-facing warning that these examples will create or alter persistent records. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/products-and-pricing.md (reported line 14)May include surrounding context.

List products

bash

curl "http://localhost:3000/api/products?status=&sku=&limit=100&offset=0"

Create a product

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reference examples omit the required x-api-key header on API requests, contradicting the skill metadata that says credentials must be sent on all requests except GET /api/health. This can cause operators or downstream agents to make unauthenticated requests, leading to failed operations, accidental insecure workarounds, or normalization of bypassing documented authentication requirements.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/returns-and-memos.md (reported line 14)May include surrounding context.

List customer returns

bash

curl "http://localhost:3000/api/cust-returns?status=&customerId=&saleOrderId=&limit=100&offset=0"

Create a customer return

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/workflows.md (reported line 20)May include surrounding context.

1. Create customer

bash

curl "http://localhost:3000/api/customers" \
  -H "Content-Type: application/json" \
  -d '{
    "partnerName": "Customer Co",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The partner and customer payload examples force "language": "en" as the only shown value, which can be read as prescribing English by default. Under SQP-3, language or locale constraints should offer user choice or be clearly justified if fixed.

Content

No source excerpt is available for this finding.