Api Gateway 1.0.7

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:31 PM UTC
• Version: 1.0.0

Overview

This is a disclosed API gateway, but it gives an agent broad authenticated access to many services, including delete and business-impacting actions, without clear confirmation guardrails.

Install only if you trust Maton with gateway access to the connected accounts and you intend agents to make raw authenticated API calls. Use least-privilege OAuth connections, avoid connecting production finance/CRM/storage accounts unless needed, and require manual confirmation before deletes, sends, cancellations, batch updates, permission changes, or public posts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (126)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Records
```bash
DELETE /airtable/v0/{baseId}/{tableIdOrName}?records[]=recXXXXX&records[]=recYYYYY
```

### List Bases

• Confidence: 80% confidence
• Finding: The documented DELETE endpoint accepts user-controlled record IDs directly in query parameters, enabling an agent to perform irreversible deletions if prompted with untrusted or mistaken identifiers. In this API-gateway skill, managed auth increases the risk because the agent may have valid credentials and the documentation gives a ready-made destructive call pattern without any approval or validation controls.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete a Task
```bash
DELETE /asana/api/1.0/tasks/{task_gid}
```

### Get Subtasks

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```bash
DELETE /asana/api/1.0/webhooks/{webhook_gid}
```

## Notes

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook Subscription
```bash
DELETE /calendly/webhook_subscriptions/{uuid}
```

## Notes

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete a Task
```bash
DELETE /clickup/api/v2/task/{task_id}
```

### Get Filtered Team Tasks

• Confidence: 91% confidence
• Finding: The documented DELETE task endpoint enables irreversible or difficult-to-recover removal of project data if an agent is induced to supply an attacker-chosen task_id or acts on ambiguous user input. Because this skill is an API gateway to a real third-party service, parameter abuse is especially dangerous: a malformed or socially engineered request can directly delete legitimate work items in a production workspace.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```bash
DELETE /clickup/api/v2/webhook/{webhook_id}
```

## Notes

• Confidence: 89% confidence
• Finding: The DELETE webhook endpoint can be abused to remove monitoring, automation, or security-relevant integrations by passing an attacker-selected webhook_id. In this agent-mediated context, deleting webhooks may silently disrupt downstream workflows and visibility, making the impact broader than a simple object deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```bash
DELETE /fathom/external/v1/webhooks/{id}
```

## Notes

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Event
```bash
DELETE /google-calendar/calendar/v3/calendars/primary/events/{eventId}
```

### Quick Add Event (natural language)

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete File
```bash
DELETE /google-drive/drive/v3/files/{fileId}
```

### Copy File

• Confidence: 85% confidence
• Finding: The documented DELETE endpoint enables direct file deletion, which is a high-risk capability if an agent can be induced to supply an attacker-chosen fileId or act without explicit user confirmation. Because this skill is an authenticated API gateway to Google Drive, misuse could lead to unauthorized destruction of user data under the victim's own OAuth context.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete In-App Product
```bash
DELETE /google-play/androidpublisher/v3/applications/{packageName}/inappproducts/{sku}
```

### Subscriptions

• Confidence: 90% confidence
• Finding: The documented DELETE endpoint for in-app products exposes a destructive operation where attacker-controlled or mistaken values for packageName and sku could remove monetized catalog items from a live app. In this skill context, the gateway proxies authenticated calls to Google Play, so misuse could directly impact revenue, app functionality, and operational integrity.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Edit
```bash
DELETE /google-play/androidpublisher/v3/applications/{packageName}/edits/{editId}
```

## Notes

• Confidence: 80% confidence
• Finding: Deleting an edit is a state-changing action, but compared with deleting products or canceling subscriptions, this usually affects a draft transactional update rather than directly harming live production resources. It is still risky if agents can be induced to target the wrong editId, because pending release changes may be lost or disrupted without warning.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Sitemap
```bash
DELETE /google-search-console/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}
```

## Search Analytics Query Examples

• Confidence: 95% confidence
• Finding: The documented DELETE route accepts user-controlled path parameters for both siteUrl and feedpath and performs a destructive action against a third-party service. In an agent skill context with automatic OAuth injection, this increases the chance of tool misuse or prompt-induced deletion if higher-level controls do not require explicit confirmation and scope validation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Contact
```bash
DELETE /hubspot/crm/v3/objects/contacts/{contactId}
```

#### Search Contacts

• Confidence: 80% confidence
• Finding: The skill documents a direct delete operation on CRM contacts without any guardrail language, confirmation requirement, or indication that the identifier must be trusted and user-authorized. In an agent setting with managed auth, this increases the risk of unintended or prompt-induced destructive actions against real customer records.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Company
```bash
DELETE /hubspot/crm/v3/objects/companies/{companyId}
```

#### Search Companies

• Confidence: 80% confidence
• Finding: The documented company deletion endpoint enables destructive state changes and is presented as a simple callable route with no warning or authorization caveat. In this skill context, where OAuth is injected automatically, an agent could delete CRM company records if manipulated into supplying a target ID.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Deal
```bash
DELETE /hubspot/crm/v3/objects/deals/{dealId}
```

#### Search Deals

• Confidence: 80% confidence
• Finding: The delete deal example exposes a high-risk mutating operation without contextual safeguards, making it easier for downstream agents or users to invoke deletion casually. Because this gateway operates against live third-party CRM data with managed authentication, misuse could cause business-impacting loss of pipeline records.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Issue
```bash
DELETE /jira/ex/jira/{cloudId}/rest/api/3/issue/{issueIdOrKey}
```

### Assign Issue

• Confidence: 95% confidence
• Finding: The skill exposes a direct DELETE issue endpoint with a user-controlled path parameter and no accompanying constraints, confirmation requirements, or authorization caveats. In an API-gateway context that brokers managed auth to third-party services, this is especially dangerous because an LLM or prompt-injected user input could cause irreversible deletion of real Jira issues in connected tenant environments.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Form
```bash
DELETE /jotform/form/{formId}
```

### Submissions

• Confidence: 84% confidence
• Finding: Documenting a destructive endpoint with a path parameter for arbitrary form IDs increases the risk that an agent or user could invoke permanent deletion on the wrong target, especially in a managed-auth API gateway. Because the skill provides direct access to third-party data under injected credentials, insufficient guardrails around destructive parameters can lead to irreversible data loss across a user's Jotform account.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Submission
```bash
DELETE /jotform/submission/{submissionId}
```

### Reports

• Confidence: 84% confidence
• Finding: The submission deletion endpoint accepts a direct submission ID and can permanently remove user data when called through the authenticated gateway. In this context, parameter misuse, hallucinated IDs, or prompt-driven abuse could cause unauthorized or accidental deletion of sensitive records without recovery.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Webhook
```bash
DELETE /jotform/form/{formId}/webhooks/{webhookIndex}
```

## Question Types

• Confidence: 80% confidence
• Finding: Deleting webhooks by form ID and webhook index is a destructive administrative action that can disrupt monitoring, integrations, or compliance-related data flows. In an authenticated gateway, abuse or mistaken parameters could silently disable downstream processing and visibility.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```bash
DELETE /klaviyo/api/webhooks/{webhook_id}
```

## Notes

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete a Member
```bash
DELETE /mailchimp/3.0/lists/{list_id}/members/{subscriber_hash}
```

### Add or Remove Tags

• Confidence: 96% confidence
• Finding: The documented DELETE endpoint enables direct removal of list members based on path parameters, and the reference provides no guardrails on when or how this operation should be used. In a managed-auth API gateway skill, exposing a destructive endpoint without confirmation or authorization guidance can lead to unintended bulk removals, targeted subscriber deletion, or prompt-driven abuse against customer mailing lists.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Block
```bash
DELETE /notion/v1/blocks/{blockId}
Notion-Version: 2025-09-03
```

• Confidence: 96% confidence
• Finding: The documented `DELETE /notion/v1/blocks/{blockId}` endpoint enables direct deletion of content and is presented without guardrails, confirmation requirements, or scope restrictions. In the context of an API gateway skill, this increases the risk of tool parameter abuse where a model or prompt-injected instruction supplies an arbitrary block ID and causes unauthorized or unintended data destruction.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Message
```bash
DELETE /outlook/v1.0/me/messages/{messageId}
```

#### Move Message

• Confidence: 91% confidence
• Finding: The documented DELETE message endpoint enables irreversible mailbox modification using a user-supplied messageId, yet the reference provides no constraints, confirmation requirements, or validation expectations. In an API gateway skill, this makes prompt-driven or parameter-manipulated deletion more likely, especially if an agent maps natural-language requests directly to this operation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Event
```bash
DELETE /outlook/v1.0/me/events/{eventId}
```

### Contacts

• Confidence: 90% confidence
• Finding: The DELETE event endpoint allows removal of calendar events, which can disrupt schedules, meetings, and communications with other participants if misused. Because this skill is an authenticated gateway to a third-party service, lack of guardrails around eventId selection and user confirmation materially raises the risk of accidental or prompt-induced destructive actions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Contact
```bash
DELETE /outlook/v1.0/me/contacts/{contactId}
```

## OData Query Parameters

• Confidence: 89% confidence
• Finding: The DELETE contact endpoint permits removal of address book entries with no documented warnings or approval flow. While not code execution, it is a destructive action against user data, and in the context of an agent-accessible API gateway it can be triggered through manipulated parameters or misunderstood user requests, causing data loss and workflow disruption.