ClawHub
Back to skill

Security audit

Api Gateway 1.0.46

Security checks for vulnerabilities and agentic risk

Overview

This API-gateway skill is not malicious, but it needs review because it gives agents broad power over connected apps and documents destructive actions without enough safety guidance.

Install only if you are comfortable giving the agent access to Maton-managed connections for the services you authorize. Use least-privilege OAuth scopes, require explicit confirmation before deletes, live sends, admin changes, billing actions, or public posts, and treat MATON_API_KEY and connection URLs as secrets that should not be printed, pasted into logs, or shared.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:541
Finding

MATON_API_KEY Disclosed Through Troubleshooting Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:541-544
Vulnerability Type: Secret exposure through terminal output
Risk Level: Medium

Vulnerable Code

bash
### Troubleshooting: API Key Issues

1. Check that the `MATON_API_KEY` environment variable is set:

```bash
echo $MATON_API_KEY
text

### Technical Analysis

The troubleshooting instructions explicitly print the complete `MATON_API_KEY` value to standard output. The key is the bearer credential used to authenticate requests to Maton's gateway and connection-management services.

Printing a secret is unnecessary to verify that an environment variable is configured. Terminal output can be retained in scrollback, CI/CD logs, shell-session recordings, support captures, screen sharing, or AI-agent transcripts. This increases the credential's exposure beyond the process that legitimately needs it.

### Attack Path

1. A user encounters an authentication problem and follows the documented troubleshooting procedure.
2. The user runs `echo $MATON_API_KEY`.
3. The complete bearer credential appears in terminal output.
4. A local user, logging system, support transcript recipient, session recorder, or other party with access to that output obtains the key.
5. The party submits the key in an `Authorization: Bearer` header to `gateway.maton.ai` or `ctrl.maton.ai`.
6. The party can use the victim's authorized Maton connections until the key is revoked or otherwise becomes invalid.

### Impact Assessment

Disclosure can permit unauthorized use of the Maton account and its existing OAuth-backed service connections. The exact scope is limited by the third-party connections and OAuth scopes that the user previously authorized, but those connections may include sensitive services such as email, cloud storage, CRM systems, collaboration platforms, payment systems, and administrative APIs.

The key does not independently create new third-party authoriza
...[truncated 127 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the command with a non-revealing presence check:

    bash
    if [ -n "${MATON_API_KEY:-}" ]; then
  echo "MATON_API_KEY is set"
else
  echo "MATON_API_KEY is not set"
fi

  • If diagnostic identification is required, display only a short, non-sensitive fingerprint derived from a one-way hash rather than any portion of the key.

  • Add an explicit warning that API keys must not be printed, pasted into support tickets, included in screenshots, or stored in logs.

  • Redact authorization headers in application and proxy logging.

  • Document an immediate key-rotation procedure for suspected disclosure.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:78
Finding

OAuth Connection Session URLs Printed Without Redaction

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:78-101
Vulnerability Type: Sensitive OAuth connection-session data exposed through standard output
Risk Level: Medium

Vulnerable Code

python
import urllib.request, os, json
req = urllib.request.Request('https://ctrl.maton.ai/connections?app=slack&status=ACTIVE')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))

The documented response includes a session-bearing URL:

json
{
  "connections": [
    {
      "connection_id": "21fd90f9-5935-43cd-b6c8-bde9d915ca80",
      "status": "ACTIVE",
      "creation_time": "2025-12-08T07:20:53.488460Z",
      "last_updated_time": "2026-01-31T20:03:32.593153Z",
      "url": "https://connect.maton.ai/?session_token=5e9...",
      "app": "slack",
      "metadata": {}
    }
  ]
}

The same unfiltered response-printing pattern is used for an individual connection at SKILL.md:123-138.

Technical Analysis

The examples serialize and print the complete response returned by the Maton connection-management API. The documented response schema contains a browser-ready connection URL with a session_token query parameter.

Session tokens embedded in URLs are capability-like secrets and should not be exposed in logs or general diagnostic output. Printing the entire response can place these URLs in terminal history systems, CI logs, support captures, screen-sharing recordings, or agent transcripts. URL query parameters may also be retained by browser history and monitoring infrastructure when copied or opened.

Listing connection metadata does not require revealing the authorization URL or its token. The implementation therefore exposes more sensitive information than is necessary for routine connection inspection.

Attack Path

  1. A user or automated agent runs the documented connection- ...[truncated 1152 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not print raw connection-management responses.

  • Select and display only non-sensitive fields such as connection_id, app, status, and timestamps.

  • Remove the url field from diagnostic output or redact its query string:

    python
    response = json.load(urllib.request.urlopen(req))
for connection in response.get("connections", []):
    connection.pop("url", None)
print(json.dumps(response, indent=2))

  • When the connection URL must be shown interactively, display it only on explicit user request and warn that it is sensitive.

  • Configure logging and telemetry systems to redact session_token and similar OAuth query parameters.

  • Apply short expiration, single-use semantics, server-side user binding, and invalidation after successful authorization to connection-session tokens.

  • Document revocation and connection-deletion procedures for exposed authorization URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (411)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/active-campaign.md (reported line 47)May include surrounding context.

Delete Contact

bash
DELETE /active-campaign/api/3/contacts/{contactId}

Tags

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/active-campaign.md (reported line 87)May include surrounding context.

Remove Tag from Contact

bash
DELETE /active-campaign/api/3/contactTags/{contactTagId}

Lists

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/acuity-scheduling.md (reported line 127)May include surrounding context.

Delete Block

bash
DELETE /acuity-scheduling/api/v1/blocks/{id}

List Forms

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/airtable.md (reported line 99)May include surrounding context.

Delete Records

bash
DELETE /airtable/v0/{baseId}/{tableIdOrName}?records[]=recXXXXX&records[]=recYYYYY

List Bases

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The documented DELETE task endpoint accepts a directly supplied task GID and performs irreversible state change without any documented guardrails, confirmation step, or ownership verification guidance. In the context of an API gateway skill, this increases the risk of prompt-driven parameter abuse where an agent is induced to delete the wrong task, delete tasks in bulk, or act on attacker-supplied identifiers within the user’s authorized Asana workspace.

Content

Scanner excerpt · references/asana.md (reported line 64)May include surrounding context.

Delete a Task

bash
DELETE /asana/api/1.0/tasks/{task_gid}

Get Subtasks

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The DELETE webhook endpoint allows removal of webhook configurations based solely on a provided webhook GID, with no warning about validating the target or confirming the action. In a managed OAuth gateway, misuse could disable monitoring, audit, or workflow integrations for authorized Asana resources, causing loss of visibility or interruption of downstream automations.

Content

Scanner excerpt · references/asana.md (reported line 134)May include surrounding context.

Delete Webhook

bash
DELETE /asana/api/1.0/webhooks/{webhook_gid}

Notes

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/attio.md (reported line 76)May include surrounding context.

Delete Record

bash
DELETE /attio/v2/objects/{object}/records/{record_id}

List Tasks

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/beehiiv.md (reported line 61)May include surrounding context.

Delete Subscription

bash
DELETE /beehiiv/v2/publications/{publication_id}/subscriptions/{subscription_id}

Posts

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box.md (reported line 72)May include surrounding context.

Delete Folder

bash
DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box.md (reported line 73)May include surrounding context.

Delete Folder

bash
DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true

Get File

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box.md (reported line 98)May include surrounding context.

Delete File

bash
DELETE /box/2.0/files/{file_id}

Create Shared Link

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box.md (reported line 141)May include surrounding context.

Trash

bash
GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box.md (reported line 142)May include surrounding context.

bash
GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash

Collections

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/box.md (reported line 160)May include surrounding context.

bash
GET /box/2.0/webhooks
POST /box/2.0/webhooks
DELETE /box/2.0/webhooks/{webhook_id}

Pagination

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/brevo.md (reported line 56)May include surrounding context.

Delete Contact

bash
DELETE /brevo/v3/contacts/{identifier}

Lists

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

This reference exposes an immediate send operation for live campaigns without any warning that the action triggers real outbound communication to potentially many recipients. In an agentic context, such under-signposted high-impact actions increase the risk of accidental mass email sends, reputational harm, and compliance issues if an agent invokes the endpoint without strong confirmation semantics.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com.md (reported line 50)May include surrounding context.

Delete Event Type

bash
DELETE /cal-com/v2/event-types/{eventTypeId}

Event Type Webhooks

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com.md (reported line 77)May include surrounding context.

Delete Webhook

bash
DELETE /cal-com/v2/event-types/{eventTypeId}/webhooks/{webhookId}

Bookings

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com.md (reported line 130)May include surrounding context.

Delete Schedule

bash
DELETE /cal-com/v2/schedules/{scheduleId}

Availability Slots

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cal-com.md (reported line 188)May include surrounding context.

Delete Webhook

bash
DELETE /cal-com/v2/webhooks/{webhookId}

Teams

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/calendly.md (reported line 89)May include surrounding context.

Delete Webhook Subscription

bash
DELETE /calendly/webhook_subscriptions/{uuid}

Notes

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/callrail.md (reported line 120)May include surrounding context.

Delete Tag

bash
DELETE /callrail/v3/a/{account_id}/tags/{tag_id}.json

Users

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/clickfunnels.md (reported line 88)May include surrounding context.

Delete Contact

bash
DELETE /clickfunnels/api/v2/contacts/{contact_id}

Upsert Contact

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/clickfunnels.md (reported line 208)May include surrounding context.

Delete Webhook Endpoint

bash
DELETE /clickfunnels/api/v2/webhooks/outgoing/endpoints/{endpoint_id}

Images

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The documented DELETE endpoint for SMS templates enables permanent removal of a resource identified only by a path parameter, with no guidance about confirmation, validation, or reversibility. In an LLM-driven tool environment, this creates a realistic risk of accidental or prompt-induced deletion if the model selects the wrong template_id or acts without user consent.

Content

Scanner excerpt · references/clicksend.md (reported line 49)May include surrounding context.

GET /clicksend/v3/sms/templates POST /clicksend/v3/sms/templates PUT /clicksend/v3/sms/templates/{template_id} DELETE /clicksend/v3/sms/templates/{template_id}

text

### MMS

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete Google Sheets spreadsheet ID instead of a placeholder.

Critical
Code
suspicious.exposed_resource_identifier
Location
SKILL.md:442

Example code exposes a concrete connection_id instead of a placeholder.

Critical
Code
suspicious.exposed_resource_identifier
Location
SKILL.md:94