Security audit

Heroku Platform API

Security checks for vulnerabilities and agentic risk

Overview

This Heroku management skill is purpose-aligned, but it needs Review because its safety and network-scope promises do not consistently match its own examples.

Install only if you are comfortable giving an agent meaningful Heroku operational authority. Use a narrowly scoped read token first, keep HEROKU_PERMISSION=readonly unless you intend changes, avoid HEROKU_NONINTERACTIVE_WRITES unless CI writes are explicitly desired, and treat logs, build output, source blobs, and database backup URLs as sensitive. Review or patch the examples so all mutations go through the guard and returned URLs are host-validated.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest explicitly claims the skill only contacts api.heroku.com and postgres-api.heroku.com, but the build/log examples dereference API-returned URLs on other hosts. That breaks the stated network trust boundary and can cause sensitive data or build/log content to be sent to undeclared third-party endpoints, undermining policy enforcement and reviewer expectations.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The log retrieval workflow uses POST to obtain a logplex URL and then fetches that URL with curl, which can point outside the two declared domains. Because logs may contain secrets, tokens, request metadata, and user data, this undeclared cross-host transmission materially expands the exposure surface beyond what the manifest promises.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The backup restore example downloads a public backup URL returned by the Postgres API, which is outside the declared two-domain allowlist. Database backups are highly sensitive; fetching them from undeclared external hosts creates a serious trust-boundary mismatch and may bypass network restrictions or auditing controls.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The documentation says reading logs is allowed in readonly mode, but the shared guard blocks all non-GET methods, including the POST used to create log sessions. This mismatch can push operators to bypass the guard with direct curl commands, weakening the stated permission model and increasing the chance of unsafe workarounds.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The security manifest states that only HEROKU_API_KEY and HEROKU_PERMISSION are accessed, but the code also reads HEROKU_NONINTERACTIVE_WRITES. This hidden control materially affects write authorization behavior, so omitting it from the manifest misleads auditors and automated policy checks about the skill's true privilege surface.

Scope Creep

Medium

Confidence: 96% confidence
Finding: The code introduces an undeclared environment variable that authorizes non-interactive writes, effectively bypassing the interactive confirmation control described elsewhere. Hidden privilege toggles are dangerous because they can be set in CI or agent environments without reviewers realizing the skill can perform writes autonomously.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill states destructive actions are always gated by the permission/confirmation mechanism, but webhook deletion is shown with direct curl, bypassing the guard entirely. That inconsistency enables silent destructive requests if a user or downstream agent copies the example as-is, violating the advertised safety model.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The mandatory rules require checking HEROKU_PERMISSION before every operation, yet multiple direct curl snippets bypass the guard and execute requests directly. This is a genuine policy-enforcement gap because readers are given copy-pastable examples that circumvent the central safety control.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The log examples encourage creating log sessions and fetching log content without warning that app/router logs may contain secrets, personal data, internal URLs, and operational metadata. Because the content is then transmitted to returned logplex URLs, the missing disclosure increases the risk of inadvertent sensitive-data exposure in environments that assume tighter network scope.

Static analysis

No suspicious patterns detected.