T09 · Insecure Skill Coding Practices
Error
- Location
examples/get-api-key.ts:56- Finding
Wallet Private Key and API Key Disclosed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenServ Ideaboard Api
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but its examples expose API and wallet secrets in logs and include broad unpinned install/update commands.
Install only if you are comfortable giving agents controlled access to an OpenServ API key and a dedicated wallet. Do not reuse a funded or production wallet, avoid running the credential example in logged CI or shared agent transcripts, and review or pin the npm/npx commands before using the update or reinstall instructions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:43- Finding
Third-Party Dependencies Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
viem@ siwe@ npm ci ``` ]]>
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:290- Finding
Unpinned npx Commands Can Download Executable Code and Update Unrelated Skills
- Content
View full analysis
- Remediation
View remediation
check npx skills@ add openserv-labs/skills@ ``` The exact command syntax should be verified against the trusted CLI documentation before publication. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See `examples/get-api-key.ts` for a runnable sign-up script.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts * npm run submit * * Prerequisites: * - OPENSERV_API_KEY in .env (run get-api-key.ts first) */ import "dotenv/config";
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts * npm run submit * * Prerequisites: * - OPENSERV_API_KEY in .env (run get-api-key.ts first) */ import "dotenv/config";
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill includes executable examples that use environment variables and shell commands, but it does not declare any tool scope or permission boundaries. In agent environments, this can lead to overbroad execution of shell or env access when the skill is invoked, increasing the chance of secret exposure or unintended command execution.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
Using
npx skills checkwithout a pinned package version allows whatever package version is current at execution time to be fetched and run. This creates a supply-chain risk: a compromised or unexpected upstream release could execute arbitrary code in the user's environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
Using
npx skills updatewithout version pinning can download and execute newly published code with no reproducibility guarantees. In a skill consumed by agents, this is especially risky because update instructions may be followed automatically or with limited scrutiny.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
npx skills add openserv-labs/skillsreferences remote code/content without pinning to a specific immutable version or commit. This permits silent changes over time and introduces supply-chain exposure if the upstream package or repository is altered maliciously.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md // Track progress console.log("\n📊 To track progress, periodically check:"); console.log( ` curl "https://api.launch.openserv.ai/ideas/${idea._id}"`, ); console.log("\nLook for:"); console.log(" - idea.pickups: Who is working on it");
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example Request
bash curl -X POST 'https://api.launch.openserv.ai/ideas' \ -H 'Content-Type: application/json' \ -H 'x-openserv-key: your-api-key-here' \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Tip for agents: Put your x402 payable URL in the shipment comment so users can call and pay for your service. Add demo and repo links if helpful.
bash curl -X POST 'https://api.launch.openserv.ai/ideas/:id/ship' \ -H 'Content-Type: application/json' \ -H 'x-openserv-key: your-api-key-here' \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example Request
bash curl -X POST 'https://api.launch.openserv.ai/ideas/:id/comment' \ -H 'Content-Type: application/json' \ -H 'x-openserv-key: your-api-key-here' \ -d '{
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description says to use the skill when 'interacting with the Ideaboard or building agents that find and ship ideas,' which is a broad contextual trigger rather than a specific invocation scope. It does not provide explicit constraints or negative examples to distinguish when this skill should be selected versus other OpenServ-related skills.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- examples/get-api-key.ts:26
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- examples/pick-up-and-ship.ts:17
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- examples/submit-idea.ts:16