OpenMerch People Enrichment

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 1.0.1

Overview

The skill’s stated function is clear, but a configurable API endpoint can send your OpenMerch API key and lookup data to an arbitrary environment-selected server.

Install only if you trust OpenMerch, have a lawful basis to enrich personal contact data, and accept paid API usage. Keep OPENMERCH_BASE_URL unset for normal use, or use only a trusted HTTPS staging endpoint with a separate test key; do not run this in an environment where others can set or alter that variable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: people-enrichment.mjs:35

Finding

Unrestricted API Base URL Can Exfiltrate Credentials and Lookup Identifiers

Content

View full analysis

Vulnerability Details

File Location: people-enrichment.mjs:35-39, 68-73
Vulnerability Type: Unvalidated network destination for authenticated requests
Risk Level: High

Vulnerable Code

js

const apiKey = process.env.OPENMERCH_API_KEY;
if (!apiKey)
  throw new Error("OPENMERCH_API_KEY is not set. Get a key from the Developer page in the OpenMerch app.");

const baseUrl = (process.env.OPENMERCH_BASE_URL || "https://api.openmerch.dev").replace(/\/+$/, "");

js

async function call(method, path, body) {
  const headers = { "X-OpenMerch-Key": apiKey };
  if (body !== undefined) headers["Content-Type"] = "application/json";
  const res = await fetchFn(`${baseUrl}${path}`, {
    method,
    headers,
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });

Technical Analysis

The implementation accepts OPENMERCH_BASE_URL without validating its protocol, hostname, port, embedded credentials, or trust status. The call helper subsequently attaches the sensitive X-OpenMerch-Key authentication header to every request sent to this configured destination.

Consequently, any party capable of influencing the Skill's environment can redirect authenticated requests to an attacker-controlled server. The override can also specify plain HTTP, exposing the API key, Apollo person ID, job data, and returned personal information to network interception.

Although a configurable staging endpoint is documented, forwarding a production credential to any environment-selected host exceeds the minimum privilege required for the declared production enrichment functionality. The default destination is the documented OpenMerch API, but the code does not enforce that security boundary.

The malicious endpoint can return a crafted successful plan response with a positive price, causing the Skill to continue to /v1/execute. It can then return manipulated job results or ...[truncated 2236 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin production requests to the expected origin:

   js

   const DEFAULT_ORIGIN = "https://api.openmerch.dev";
   

2. If endpoint overrides are not essential to ordinary users, remove OPENMERCH_BASE_URL from the production Skill entirely.

3. If staging support is required, parse the value with new URL() and enforce:

   • The https: protocol.
   • An explicit hostname allowlist.
   • Approved ports only.
   • No embedded username or password.
   • No fragments or unexpected path prefix.

4. Use separate, restricted non-production credentials for staging. Never forward a production key to a staging or developer-selected endpoint.

5. Fail closed when URL validation fails and avoid including the API key in diagnostic output.

6. Add automated tests verifying that the implementation rejects:

   • Plain HTTP URLs.
   • Unapproved domains and subdomains.
   • Loopback, link-local, and private-network destinations.
   • URLs containing embedded credentials.
   • Unexpected ports and malformed URLs.

7. Where supported by OpenMerch, restrict API keys by environment, scope, budget, expiration, or source identity to reduce the impact of disclosure.

8. Preserve the existing data minimization in normalize, which avoids emitting the complete upstream provider response.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires access to a sensitive environment variable (OPENMERCH_API_KEY) and can invoke executables (node, curl), but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an avoidable least-privilege gap: an agent/runtime may grant broader capabilities than intended, increasing the chance of secret exposure or unintended command execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- OPENMERCH_API_KEY
      anyBins:
        - node
        - curl
    envVars:
      - name: OPENMERCH_API_KEY
        required: true

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 7)May include surrounding context.

text

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples.md:22

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:62