Api Gateway 1.0.7

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:31 PM UTC
• Version: 1.0.0

Overview

This is a disclosed API gateway, but it gives an agent broad authenticated access to many services, including delete and business-impacting actions, without clear confirmation guardrails.

Install only if you trust Maton with gateway access to the connected accounts and you intend agents to make raw authenticated API calls. Use least-privilege OAuth connections, avoid connecting production finance/CRM/storage accounts unless needed, and require manual confirmation before deletes, sends, cancellations, batch updates, permission changes, or public posts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (126)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The documented DELETE endpoint accepts user-controlled record IDs directly in query parameters, enabling an agent to perform irreversible deletions if prompted with untrusted or mistaken identifiers. In this API-gateway skill, managed auth increases the risk because the agent may have valid credentials and the documentation gives a ready-made destructive call pattern without any approval or validation controls.

Content

Scanner excerpt · references/airtable.md (reported line 99)May include surrounding context.

Delete Records

bash

DELETE /airtable/v0/{baseId}/{tableIdOrName}?records[]=recXXXXX&records[]=recYYYYY

List Bases

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/asana.md (reported line 64)May include surrounding context.

Delete a Task

bash

DELETE /asana/api/1.0/tasks/{task_gid}

Get Subtasks

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/asana.md (reported line 134)May include surrounding context.

Delete Webhook

bash

DELETE /asana/api/1.0/webhooks/{webhook_gid}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/calendly.md (reported line 89)May include surrounding context.

Delete Webhook Subscription

bash

DELETE /calendly/webhook_subscriptions/{uuid}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The documented DELETE task endpoint enables irreversible or difficult-to-recover removal of project data if an agent is induced to supply an attacker-chosen task_id or acts on ambiguous user input. Because this skill is an API gateway to a real third-party service, parameter abuse is especially dangerous: a malformed or socially engineered request can directly delete legitimate work items in a production workspace.

Content

Scanner excerpt · references/clickup.md (reported line 87)May include surrounding context.

Delete a Task

bash

DELETE /clickup/api/v2/task/{task_id}

Get Filtered Team Tasks

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The DELETE webhook endpoint can be abused to remove monitoring, automation, or security-relevant integrations by passing an attacker-selected webhook_id. In this agent-mediated context, deleting webhooks may silently disrupt downstream workflows and visibility, making the impact broader than a simple object deletion.

Content

Scanner excerpt · references/clickup.md (reported line 135)May include surrounding context.

Delete Webhook

bash

DELETE /clickup/api/v2/webhook/{webhook_id}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/fathom.md (reported line 70)May include surrounding context.

Delete Webhook

bash

DELETE /fathom/external/v1/webhooks/{id}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/google-calendar.md (reported line 99)May include surrounding context.

Delete Event

bash

DELETE /google-calendar/calendar/v3/calendars/primary/events/{eventId}

Quick Add Event (natural language)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The documented DELETE endpoint enables direct file deletion, which is a high-risk capability if an agent can be induced to supply an attacker-chosen fileId or act without explicit user confirmation. Because this skill is an authenticated API gateway to Google Drive, misuse could lead to unauthorized destruction of user data under the victim's own OAuth context.

Content

Scanner excerpt · references/google-drive.md (reported line 93)May include surrounding context.

Delete File

bash

DELETE /google-drive/drive/v3/files/{fileId}

Copy File

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The documented DELETE endpoint for in-app products exposes a destructive operation where attacker-controlled or mistaken values for packageName and sku could remove monetized catalog items from a live app. In this skill context, the gateway proxies authenticated calls to Google Play, so misuse could directly impact revenue, app functionality, and operational integrity.

Content

Scanner excerpt · references/google-play.md (reported line 51)May include surrounding context.

Delete In-App Product

bash

DELETE /google-play/androidpublisher/v3/applications/{packageName}/inappproducts/{sku}

Subscriptions

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Deleting an edit is a state-changing action, but compared with deleting products or canceling subscriptions, this usually affects a draft transactional update rather than directly harming live production resources. It is still risky if agents can be induced to target the wrong editId, because pending release changes may be lost or disrupted without warning.

Content

Scanner excerpt · references/google-play.md (reported line 129)May include surrounding context.

Delete Edit

bash

DELETE /google-play/androidpublisher/v3/applications/{packageName}/edits/{editId}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The documented DELETE route accepts user-controlled path parameters for both siteUrl and feedpath and performs a destructive action against a third-party service. In an agent skill context with automatic OAuth injection, this increases the chance of tool misuse or prompt-induced deletion if higher-level controls do not require explicit confirmation and scope validation.

Content

Scanner excerpt · references/google-search-console.md (reported line 56)May include surrounding context.

Delete Sitemap

bash

DELETE /google-search-console/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}

Search Analytics Query Examples

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The skill documents a direct delete operation on CRM contacts without any guardrail language, confirmation requirement, or indication that the identifier must be trusted and user-authorized. In an agent setting with managed auth, this increases the risk of unintended or prompt-induced destructive actions against real customer records.

Content

Scanner excerpt · references/hubspot.md (reported line 65)May include surrounding context.

Delete Contact

bash

DELETE /hubspot/crm/v3/objects/contacts/{contactId}

Search Contacts

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The documented company deletion endpoint enables destructive state changes and is presented as a simple callable route with no warning or authorization caveat. In this skill context, where OAuth is injected automatically, an agent could delete CRM company records if manipulated into supplying a target ID.

Content

Scanner excerpt · references/hubspot.md (reported line 128)May include surrounding context.

Delete Company

bash

DELETE /hubspot/crm/v3/objects/companies/{companyId}

Search Companies

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The delete deal example exposes a high-risk mutating operation without contextual safeguards, making it easier for downstream agents or users to invoke deletion casually. Because this gateway operates against live third-party CRM data with managed authentication, misuse could cause business-impacting loss of pipeline records.

Content

Scanner excerpt · references/hubspot.md (reported line 190)May include surrounding context.

Delete Deal

bash

DELETE /hubspot/crm/v3/objects/deals/{dealId}

Search Deals

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill exposes a direct DELETE issue endpoint with a user-controlled path parameter and no accompanying constraints, confirmation requirements, or authorization caveats. In an API-gateway context that brokers managed auth to third-party services, this is especially dangerous because an LLM or prompt-injected user input could cause irreversible deletion of real Jira issues in connected tenant environments.

Content

Scanner excerpt · references/jira.md (reported line 82)May include surrounding context.

Delete Issue

bash

DELETE /jira/ex/jira/{cloudId}/rest/api/3/issue/{issueIdOrKey}

Assign Issue

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

Documenting a destructive endpoint with a path parameter for arbitrary form IDs increases the risk that an agent or user could invoke permanent deletion on the wrong target, especially in a managed-auth API gateway. Because the skill provides direct access to third-party data under injected credentials, insufficient guardrails around destructive parameters can lead to irreversible data loss across a user's Jotform account.

Content

Scanner excerpt · references/jotform.md (reported line 99)May include surrounding context.

Delete Form

bash

DELETE /jotform/form/{formId}

Submissions

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The submission deletion endpoint accepts a direct submission ID and can permanently remove user data when called through the authenticated gateway. In this context, parameter misuse, hallucinated IDs, or prompt-driven abuse could cause unauthorized or accidental deletion of sensitive records without recovery.

Content

Scanner excerpt · references/jotform.md (reported line 121)May include surrounding context.

Delete Submission

bash

DELETE /jotform/submission/{submissionId}

Reports

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Deleting webhooks by form ID and webhook index is a destructive administrative action that can disrupt monitoring, integrations, or compliance-related data flows. In an authenticated gateway, abuse or mistaken parameters could silently disable downstream processing and visibility.

Content

Scanner excerpt · references/jotform.md (reported line 148)May include surrounding context.

Delete Webhook

bash

DELETE /jotform/form/{formId}/webhooks/{webhookIndex}

Question Types

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/klaviyo.md (reported line 221)May include surrounding context.

Delete Webhook

bash

DELETE /klaviyo/api/webhooks/{webhook_id}

Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The documented DELETE endpoint enables direct removal of list members based on path parameters, and the reference provides no guardrails on when or how this operation should be used. In a managed-auth API gateway skill, exposing a destructive endpoint without confirmation or authorization guidance can lead to unintended bulk removals, targeted subscriber deletion, or prompt-driven abuse against customer mailing lists.

Content

Scanner excerpt · references/mailchimp.md (reported line 104)May include surrounding context.

Delete a Member

bash

DELETE /mailchimp/3.0/lists/{list_id}/members/{subscriber_hash}

Add or Remove Tags

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The documented DELETE /notion/v1/blocks/{blockId} endpoint enables direct deletion of content and is presented without guardrails, confirmation requirements, or scope restrictions. In the context of an API gateway skill, this increases the risk of tool parameter abuse where a model or prompt-injected instruction supplies an arbitrary block ID and causes unauthorized or unintended data destruction.

Content

Scanner excerpt · references/notion.md (reported line 269)May include surrounding context.

Delete Block

bash

DELETE /notion/v1/blocks/{blockId}
Notion-Version: 2025-09-03

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The documented DELETE message endpoint enables irreversible mailbox modification using a user-supplied messageId, yet the reference provides no constraints, confirmation requirements, or validation expectations. In an API gateway skill, this makes prompt-driven or parameter-manipulated deletion more likely, especially if an agent maps natural-language requests directly to this operation.

Content

Scanner excerpt · references/outlook.md (reported line 127)May include surrounding context.

Delete Message

bash

DELETE /outlook/v1.0/me/messages/{messageId}

Move Message

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The DELETE event endpoint allows removal of calendar events, which can disrupt schedules, meetings, and communications with other participants if misused. Because this skill is an authenticated gateway to a third-party service, lack of guardrails around eventId selection and user confirmation materially raises the risk of accidental or prompt-induced destructive actions.

Content

Scanner excerpt · references/outlook.md (reported line 185)May include surrounding context.

Delete Event

bash

DELETE /outlook/v1.0/me/events/{eventId}

Contacts

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The DELETE contact endpoint permits removal of address book entries with no documented warnings or approval flow. While not code execution, it is a destructive action against user data, and in the context of an agent-accessible API gateway it can be triggered through manipulated parameters or misunderstood user requests, causing data loss and workflow disruption.

Content

Scanner excerpt · references/outlook.md (reported line 213)May include surrounding context.

Delete Contact

bash

DELETE /outlook/v1.0/me/contacts/{contactId}

OData Query Parameters