Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: building an automation can trigger live, recurring account actions, and the skills give tool responses excessive authority.
Use a test team and limited connections first. Require explicit permission before activation, live tests, or recurring processing, even when you requested a build. Ensure your agent treats returned remarks as information rather than permission to act. The Endpoints guidance includes stronger approval and credential safeguards; no credential theft or deliberate deception was found.
Referenced artifact was not completely inspected
hand-edited generated module. See the complete [read-only SDK example](examples/read-document.md) when a
Referenced artifact was not completely inspected
| A value must be transformed (dates, text, arrays, conditionals) | [IML functions](./references/iml-functions.md) |
Referenced artifact was not completely inspected
| The user asks for retries or fallbacks, or failure/data loss is unacceptable — most scenarios need none | [Error handling](./references/error-handling.md) |
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
signal, so never report "no error found" as "nothing went wrong".
2. **`scenario_execution_module_get`** on the suspect module and the `cycle` `inspect` reported (usually 1) —
the real input and output that module saw. Never pick a cycle independently; a wrong cycle returns
unrelated data with no warning.
3. Cross-check the current `config` with `scenario_module_get` — but first compare `scenario_get`'s `lastEdit`
to the run's `startedAt`. If the scenario was edited after the run, what you read is not necessarily what
ran; say so before attributing the bug.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
"you're connected to Google, so Gmail is covered". Note that some Gmail modules name the connection parameter
`account` rather than `__IMTCONN__`; `configurationSchema` says which.
## Make AI Tools (`ai-tools:*`)
`model` is required and has no default. With a Make AI Provider connection use the tier slugs `"small"`,
`"medium"`, `"large"` — a provider model id such as `"gpt-4o-mini"` is rejected. Users without that connection
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Missing key or zone: check the selected credential source and CLI fallback rules first.
- 401/403: distinguish Make API authentication/scopes, team access, and the selected provider connection.
Do not apply scenario MCP's full-OAuth-bundle rule automatically or broaden access without approval.
- 501/unavailable: stop for beta/runtime enablement; installation and catalog visibility cannot fix it.
- npm 404: verify the exact current package name and registry access before declaring the SDK nonexistent.
Do not create a fake substitute. Any authorized official-source fallback must remain unmodified, pinned,
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
For bulk work, keep a stable input-ID set and bounded concurrency. Stop scheduling new work on failure,
drain in-flight operations, and report completed/failed/unknown IDs separately. A timeout is not permission
to skip verification or to call the next mutation batch before the previous batch is resolved.
## Bind approval to the actual action
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
---
name: mapping
description: How a module's mapper references upstream data — module-id references, the trigger-output rule for webhook and on-demand scenarios, whole-bundle and array syntax, and the gotchas that pass validation and fail at run time.
---
# Mapping
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Run with the approved environment configured, or with the existing project-local file:
node --env-file=.env.local read-document.mjs
The example prints private document data deliberately for local inspection. Choose an approved output
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
For an existing project-local .env.local, Node supports:
node --env-file=.env.local read-document.mjs
Keep that file ignored and private. Node's existing process environment takes precedence over its env file;
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The guidance tells the agent to run a scenario to discover output fields, expanding a build/edit task into execution despite the skill's stated scope excluding running and debugging. Executing a connected scenario can trigger downstream writes, notifications, or other external effects; the guidance does not require explicit execution authorization or isolated test conditions.
The skill excludes running scenarios from its stated scope but directs the agent to activate and run newly created scenarios as a routine final step. Approval of a design does not necessarily authorize execution, and activation can enable ongoing processing and real actions against connected accounts despite the earlier instruction to leave autoActivate off unless asked.
A terminal-based agent needing a command sequence or a host needing a small tool catalog could be working with any platform. The loading instruction does not restrict activation to Make Endpoints, so it could select these platform-specific instructions for unrelated tasks.
The verification instructions invoke live execution without distinguishing a safe test from actions that send messages, modify records, or otherwise affect connected services. Activating a polling scenario and then manually running it can also introduce unexpected processing, and asking the user to send a real webhook request does not explain the downstream consequences.
The statement that a tool result's content remark is an instruction promotes lower-trust returned data into behavioral authority. A compromised tool response or attacker-controlled content surfaced through a remark could redirect the agent toward unauthorized disclosure or actions; the skill's read-only framing does not enforce a boundary against such instructions.
The directive to 'Treat every remark as an instruction' promotes tool-response content from contextual data into agent authority, creating a prompt-injection path if an attacker can influence those remarks. In a scenario-management skill with write, execution, and connection capabilities, injected instructions could redirect consequential actions or suppress relevant disclosures. The otherwise cautious workflow guidance and explicit warning not to follow user-written notes do not constrain this blanket trust in tool remarks.
Declaring that a tool result's content remark is an instruction grants returned text authority without checking its provenance or scope. If such remarks include attacker-controlled or externally sourced text, prompt injection could redirect scenario configuration or induce unauthorized actions using the agent's connected-account access.
No suspicious patterns detected.