Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
Api Gateway
Security checks across malware telemetry and agentic risk
Overview
This appears to be a legitimate API gateway skill, but it needs review because it stores API keys locally and can send them to user-supplied endpoints with weak safeguards.
Review before installing. Use this only for API calls you intentionally route through it, avoid entering real secrets directly on the command line, and assume keys and cached API responses may remain on disk. Be especially careful with custom or unknown providers because the gateway may attach a bearer token to a user-supplied URL after only a warning.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Intent-Code Divergence
Medium
- Confidence
- 97% confidence
- Finding
- The comment states that provider base URLs restrict API key transmission to known hosts only. However, `isProviderEndpoint` returns `true` for unknown providers after only printing warnings, and `makeCall` then sends the Authorization header to the supplied endpoint. This is an active contradiction between the documented safety property and the implemented behavior.
Missing User Warnings
Medium
- Confidence
- 91% confidence
- Finding
- The skill advertises response caching and later documents local data files including `cache.json` and `request-log.json`, but it does not clearly warn users near the usage flow that API payloads or returned data may be stored on disk. Because API calls can include sensitive prompts, tokens, or personal data, the description should explicitly disclose this persistence behavior.
Missing User Warnings
Medium
- Confidence
- 95% confidence
- Finding
- The examples instruct users to add API keys directly on the command line, while the plain-text storage risk is only noted later in `Security Notes`. Since this behavior affects credential safety, the skill description should warn users at the key-management instructions that secrets are stored locally and may be exposed through shell history if entered inline.
Missing User Warnings
Medium
- Confidence
- 91% confidence
- Finding
- The documented command `--keys add <provider> <key>` instructs users to pass credentials on the command line, which can expose secrets via shell history and process inspection. The file describes key storage permissions, but it does not warn users about this credential-handling risk anywhere in the usage text or nearby code comments.
Missing User Warnings
Medium
- Confidence
- 88% confidence
- Finding
- `addKey` persists the provided key to disk, but there is no confirmation prompt or user-facing disclosure at the point where a secret passed as a command-line argument is being handled and stored. Because this operation involves sensitive credentials, the lack of any warning about exposure and persistence is a safety-relevant omission.
Credential Access
High
- Category
- Privilege Escalation
- Content
## Security Notes - Keys stored as plain text in JSON (same risk as .env files) - For production, integrate with a secrets manager - Masked output prevents accidental exposure in logs - Request log limited to 1000 entries
- Confidence
- 60% confidence
- Finding
- .env
VirusTotal
VirusTotal findings are pending for this skill version.
Static analysis
No suspicious patterns detected.