onebound-api

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.2

Overview

The skill appears to provide the advertised product search features, but its configurable gateway can send the user's API key to an arbitrary server if the environment is changed.

Review before installing if you rely on environment files or shared agent launchers. Use only the default gateway unless you intentionally trust another gateway, require HTTPS, and rotate ONEBOUND_API_KEY if it may have been sent to an unexpected host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gateway-request.sh:27

Finding

Unrestricted Gateway Override Can Disclose the API Key

Content

View full analysis

Vulnerability Details

File Location: scripts/gateway-request.sh, lines 27–36
Vulnerability Type: Unvalidated network destination for sensitive credentials
Risk Level: Medium

bash

BASE_URL="${ONEBOUND_BASE_URL:-https://onebound.vercel.app}"

REQUEST_ARGS=()
for pair in "$@"; do
  REQUEST_ARGS+=(--data-urlencode "$pair")
done

RESPONSE=$(curl -sS -G -w "\n%{http_code}" "${BASE_URL}${PATH_SUFFIX}" \
  -H "Authorization: Bearer ${ONEBOUND_API_KEY}" \
  "${REQUEST_ARGS[@]}")

Technical Analysis

The script permits ONEBOUND_BASE_URL to specify an arbitrary network destination without validating its scheme, hostname, port, user information, query string, or fragment. It subsequently sends ONEBOUND_API_KEY to that destination in a bearer authorization header.

Although transmitting the key to the documented Onebound HTTPS gateway is necessary for the declared product-search and item-detail functionality, unrestricted destination selection is not required for normal operation. It creates a credential-exfiltration risk if the environment variable is maliciously or accidentally changed. The script also accepts plaintext HTTP URLs, which could expose the API key and request data to network interception.

The request query parameters can contain users' product search terms and item identifiers. Those values would be disclosed alongside the credential when requests are redirected to an untrusted gateway.

Attack Path

1. An attacker, compromised launcher, unsafe environment file, or erroneous configuration sets ONEBOUND_BASE_URL to an attacker-controlled destination, such as http://attacker.example.
2. A user invokes one of the legitimate Taobao or 1688 search/detail wrapper scripts.
3. The wrapper delegates the request to gateway-request.sh.
4. The helper constructs the URL from the unvalidated base URL and the endpoint path.
5. curl sends Authorization: Bearer ${ONEBOUND_API_KEY} a ...[truncated 835 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the configurable base URL if custom gateways are not an essential requirement, and use the fixed destination https://onebound.vercel.app.
• If custom gateways are required, parse and validate the URL before attaching credentials.
• Require the https scheme and reject plaintext HTTP.
• Allowlist approved hostnames, expected ports, and endpoint prefixes.
• Reject URLs containing embedded credentials, query strings, or fragments.
• Bind credentials to destinations: use a separate, explicitly configured, least-privileged credential for each custom gateway rather than sending the default Onebound key to arbitrary hosts.
• Require explicit user or administrator approval before enabling a non-default gateway.
• Configure curl to restrict protocols, for example with --proto '=https'.
• Document the trust implications of gateway overrides and avoid inheriting this security-sensitive setting from untrusted environment files.
• Rotate the API key immediately if it may already have been sent to an unauthorized endpoint.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to run multiple shell scripts but does not declare any explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and can let a host agent expose broader shell capability than necessary, increasing the blast radius if script arguments are mishandled or the skill is modified later.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

md

- Always check that `ONEBOUND_API_KEY` is set before calling any script. If missing, tell the user to set it.
- Default to `https://onebound.vercel.app` when `ONEBOUND_BASE_URL` is not set.
- Never ask the user for upstream credentials when using this skill.
- Never fabricate product search or detail results. Always call the platform gateway.
- If a script returns an error, show the error message to the user.
- Do not expose the API key in output.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing descriptive content in Chinese for the embedded API specification, including the API description and server description. The skill does not indicate that Chinese is required, nor does it offer an English alternative or user opt-in, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.