OpenMerch Email Verify

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:16 AM UTC
• Version: 1.0.3

Overview

This is a straightforward paid OpenMerch email checker with disclosed external API use; keep the API endpoint at the trusted default and only check addresses you are allowed to share.

Install only if you are comfortable sending the target email address to OpenMerch and paying OpenMerch for each verification. Keep OPENMERCH_BASE_URL unset unless you deliberately use a trusted OpenMerch staging endpoint, and rotate the API key if it was ever run with an untrusted or plaintext endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: verify-email.mjs:36

Finding

Unrestricted API Base URL Can Expose Credentials and Email Data

Content

View full analysis

Vulnerability Details

File Location: verify-email.mjs, lines 36–53
Vulnerability Type: Unvalidated credential-bearing network destination
Risk Level: Medium

Vulnerable Code

js

const apiKey = process.env.OPENMERCH_API_KEY;
if (!apiKey) fail("OPENMERCH_API_KEY is not set. Get a key from the Developer page in the OpenMerch app.");

const baseUrl = (process.env.OPENMERCH_BASE_URL || "https://api.openmerch.dev").replace(/\/+$/, "");

async function call(method, path, body) {
  const headers = { "X-OpenMerch-Key": apiKey };
  if (body !== undefined) headers["Content-Type"] = "application/json";
  const res = await fetch(`${baseUrl}${path}`, {
    method,
    headers,
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
  const text = await res.text();
  let json;
  try {
    json = text ? JSON.parse(text) : {};
  } catch {
    json = { raw_body: text };
  }
  if (!res.ok) {
    fail(`${method} ${path} -> HTTP ${res.status}: ${text || res.statusText}`);
  }
  return json;
}

Technical Analysis

OPENMERCH_BASE_URL controls the destination of every API request but is not parsed or validated. The implementation neither requires HTTPS nor restricts the hostname to an approved OpenMerch endpoint.

Every request made through call() includes the sensitive X-OpenMerch-Key header. Planning and execution requests also include the email address supplied by the user. Consequently, an attacker who can influence the process environment can redirect both the API credential and personal data to an arbitrary server. An http:// URL is also accepted, permitting plaintext transmission and network interception.

Sending the target email and API key to the legitimate OpenMerch service is necessary for the declared external verification functionality and is documented. The security issue is that the same sensitive values may be sent to an unrestricted, user-configurab ...[truncated 1244 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the configured endpoint with new URL() and reject malformed values.
• Require the https: protocol in production to prevent plaintext credential and email transmission.
• Restrict the hostname to api.openmerch.dev or a narrowly defined allowlist of trusted OpenMerch hosts.
• If staging or testing overrides are necessary, require an explicit development-mode opt-in and use separate, least-privileged non-production credentials.
• Reject URLs containing unexpected credentials, ports, query strings, fragments, or path prefixes unless specifically required.
• Consider preventing automatic forwarding of authentication headers across redirects, or disable redirects and validate every redirect destination.
• Rotate the OpenMerch API key if the Skill has previously run with an untrusted or plaintext base URL.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires environment access for OPENMERCH_API_KEY and performs outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege guarantees and makes it harder for a host agent or reviewer to constrain what the skill is permitted to access, especially since the skill handles a live billing credential and performs paid API calls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- OPENMERCH_API_KEY
      anyBins:
        - node
        - curl
    envVars:
      - name: OPENMERCH_API_KEY
        required: true

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples encourage sending full email addresses to an external verification provider, which is a form of third-party data sharing, but they do not warn about privacy, consent, or organizational data-handling requirements. Even though an email address is relatively low-sensitivity compared with credentials, it is still personal or business contact data and may create compliance, confidentiality, or user-expectation issues if transmitted without clear disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the supplied email address to a third-party API as part of its core functionality, but it provides no explicit privacy notice, consent prompt, or data-handling warning at runtime. Because email addresses are personal data in many contexts, this can expose user PII to an external service without adequate transparency, creating privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples.md:17

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58