OpenMerch Company Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its optional API endpoint override can send the OpenMerch API key to any configured URL, so it needs review before use.

Install only if you trust the publisher and can control the runtime environment. Leave OPENMERCH_BASE_URL unset for normal use, or set it only to a trusted HTTPS OpenMerch staging endpoint with a separate non-production key. Treat the OpenMerch key like a paid account credential because lookups can consume credits.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: company-brief.mjs:111

Finding

Configurable API Endpoint Can Expose the OpenMerch API Key

Content

View full analysis

Vulnerability Details

File Location: company-brief.mjs:111-116, 190-193
Vulnerability Type: Unrestricted credential-bearing network destination
Risk Level: Medium

The script permits OPENMERCH_BASE_URL to specify an arbitrary endpoint and sends the OpenMerch API key to that endpoint in every request.

js

async function call(method, path, body) {
  const headers = { "X-OpenMerch-Key": apiKey };
  if (body !== undefined) headers["Content-Type"] = "application/json";
  const res = await fetchFn(`${baseUrl}${path}`, {
    method,
    headers,
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
}

js

const baseUrl = (process.env.OPENMERCH_BASE_URL || "https://api.openmerch.dev").replace(
  /\/+$/,
  "",
);

Technical Analysis

OPENMERCH_BASE_URL is used without validating its scheme, hostname, port, or URL components. The request helper unconditionally attaches X-OpenMerch-Key to requests constructed from this value.

As a result, an attacker who can influence this non-secret environment variable can redirect authenticated requests to a server under their control. The implementation also accepts plaintext HTTP URLs, which could expose the credential and queried company domain to network interception.

A configurable endpoint can be useful for staging and testing, but unrestricted transmission of a production credential exceeds the minimum privileges required for the Skill's normal operation. The documented production functionality only requires authenticated access to the official OpenMerch API.

Attack Path

1. An attacker gains the ability to alter the execution environment or deployment configuration.
2. The attacker sets OPENMERCH_BASE_URL to an attacker-controlled HTTP or HTTPS URL.
3. A user or Agent invokes the Skill for a company-domain lookup.
4. The script sends the X-OpenMerch-Key header and requested company domain to the attack ...[truncated 999 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the configured endpoint with new URL() and reject malformed URLs.
2. Require the https: scheme for all credential-bearing production requests.
3. Allowlist api.openmerch.dev for production use rather than accepting arbitrary hosts.
4. If staging support is required, provide an explicit development-mode opt-in and use a narrow allowlist of approved staging hosts.
5. Reject URLs containing user information, fragments, unexpected ports, or other unnecessary components.
6. Use separate, restricted non-production credentials for staging and testing.
7. Ensure redirects cannot forward the credential to an untrusted origin. Disable redirects or manually validate every redirect destination before resending authenticated requests.
8. Add tests confirming that invalid schemes and unapproved hosts are rejected before any network request is made.
9. Add tests confirming that credentials are never sent across origins during redirects.
10. Update SKILL.md to clearly state the endpoint restrictions and safe staging procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- OPENMERCH_API_KEY
      anyBins:
        - node
        - curl
    envVars:
      - name: OPENMERCH_API_KEY
        required: true

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN