api2cli

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:13 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent API-to-CLI purpose, but it asks agents to run mutable remote installers and unpinned package commands while also linking tools and publishing content publicly.

Review this skill carefully before installing. Only run it in a development environment where you are comfortable with shell execution, package installs, PATH changes, skill symlinks, and public publishing. Prefer pinned package versions, avoid `curl | bash`, inspect generated code and README files for secrets, and require explicit confirmation before linking into agents or publishing to GitHub, npm, ClawHub, Sundial Hub, or api2cli.dev.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15
• Finding: Remote Bun Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash bun --version || curl -fsSL https://bun.sh/install | bash ``` ### Technical Analysis If Bun is unavailable, this command downloads a mutable shell script from `https://bun.sh/install` and passes it directly to Bash. The downloaded content is not pinned to a specific release and is not checked against a cryptographic signature or expected checksum. The command therefore delegates arbitrary shell execution to the current response returned by the remote server. Even if the domain is normally associated with the legitimate Bun project, compromise of its hosting environment, distribution account, DNS resolution, or release pipeline could change the effective payload after this Skill has been reviewed. Installing Bun is relevant to the documented workflow, but executing an unverified remote response directly in a shell exceeds the minimum-risk method necessary to satisfy that prerequisite. ### Attack Path 1. The Skill is activated for an API-to-CLI task. 2. The prerequisite command checks whether Bun is installed. 3. If `bun --version` fails, `curl` retrieves the current installer response. 4. A compromised distribution endpoint or supply chain returns modified shell code. 5. Bash executes that code immediately with the privileges of the agent or user. 6. The payload can access the user's files, credentials, shell configuration, generated projects, and authenticated development tools. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the Skill. The payload could: - Read or modify files accessible to the user. - Access API tokens and development credentials available to the process. - Modify shell initialization files or user-level executable paths. - Tamper with generated CLI source code and later pub ...[truncated 261 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | bash` pipeline. - Prefer installation through a trusted operating-system package manager with a pinned package version. - If a standalone installer is required: 1. Download a version-specific artifact to a local file. 2. Verify its SHA-256 checksum or publisher-provided cryptographic signature. 3. Display the source and destination to the user. 4. Request explicit approval before executing it. 5. Run it without elevated privileges unless elevation is demonstrably required. - Document Bun as an optional prerequisite and stop with safe manual installation instructions when it is missing. - Pin the Bun version used to build and test generated CLIs. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/openclaw.md:9
• Finding: OpenClaw Setup Prompt Instructs the Agent to Execute a Mutable Remote Installer<![CDATA[ ## Vulnerability Details **File Location**: `references/openclaw.md:9-16` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```text Set up api2cli for me: 1. Install bun if missing: bun --version || curl -fsSL https://bun.sh/install | bash 2. Install api2cli: npm i -g api2cli 3. Install the api2cli skill from ClawHub: npx clawhub install api2cli 4. Link the skill to OpenClaw: npx api2cli link --all --openclaw 5. Verify: npx api2cli --help ``` ### Technical Analysis This block is explicitly designed to be copied into an agent as a setup prompt. Its first step directs the agent to fetch a mutable remote response and execute it through Bash without inspecting or authenticating the retrieved content. The agent-oriented presentation increases exposure because the command may be executed automatically rather than reviewed interactively by a human. No release version, checksum, signature, sandbox, or confirmation boundary is specified. The subsequent global installation and linking steps would also occur in the same setup workflow, potentially allowing a compromised prerequisite installer to tamper with those operations. ### Attack Path 1. A user copies the documented setup block into OpenClaw. 2. OpenClaw follows the numbered installation instructions. 3. If Bun is missing, the agent downloads the current response from `bun.sh`. 4. The remote distribution path supplies malicious or compromised shell content. 5. Bash executes the content with the OpenClaw process user's permissions. 6. The payload modifies the environment or intercepts subsequent package installation and Skill-linking operations. 7. Compromised content may then be placed in directories automatically discovered by the agent. ### Impact Assessment The downloaded payload can exercise all filesystem, network, and shell permissions available to the OpenClaw process. Potential scope includes: - User files and con ...[truncated 471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the remote shell pipeline with non-executable instructions linking to Bun's official installation documentation. - Require the user to install Bun outside the agent session and confirm the installed version. - If automated installation is necessary, use a versioned artifact with a pinned checksum or verified signature. - Separate download, verification, and execution into distinct steps. - Require explicit user approval immediately before executing any downloaded installer. - Run installation in a restricted environment and avoid exposing publishing credentials during setup. - Do not combine remote installer execution, global package installation, and agent Skill linking in one automatic prompt. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10
• Finding: Unpinned npm Packages Are Automatically Retrieved and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-34` **Vulnerability Type**: Unpinned executable dependencies and unsafe supply-chain resolution **Risk Level**: High Additional affected examples appear in `references/openclaw.md:13-16`, where `api2cli` is globally installed and multiple unpinned packages are executed. ### Vulnerable Code ```markdown Always use `npx api2cli` to run commands. Always use `--json` when calling generated CLIs programmatically. ``` ```bash npx api2cli search <query> ``` ```bash npx api2cli install <name> ``` Related setup instructions include: ```text 2. Install api2cli: npm i -g api2cli 3. Install the api2cli skill from ClawHub: npx clawhub install api2cli 4. Link the skill to OpenClaw: npx api2cli link --all --openclaw 5. Verify: npx api2cli --help ``` ### Technical Analysis The Skill mandates `npx api2cli` without specifying an exact version or integrity value. Depending on local npm state, `npx` can retrieve the currently resolved registry release and execute its package code. The effective implementation is therefore external to this audited project and can change after review. The risk extends beyond one command. The documented `api2cli install` operation clones, builds, links to `PATH`, and symlinks third-party Skill content into agent directories. Thus, compromise of an npm package, maintainer account, registry entry, GitHub repository, or registry-selected CLI can progress from dependency resolution to local execution and automatic agent discovery. The network, shell, and filesystem permissions declared in `claw.json` support the legitimate generation workflow, but they substantially increase the impact of an unsafe dependency resolution. ### Attack Path 1. The agent follows the instruction to always invoke `npx api2cli`. 2. npm resolves an unpinned current package release. 3. A compromised maintainer account, package release, registry response, or dependency supplies malicious code. 4. `npx` ...[truncated 1195 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every executable npm package to a reviewed exact version, for example `npx --yes api2cli@X.Y.Z`. - Use a lockfile and npm integrity metadata for project dependencies. - Verify package provenance, publisher identity, signatures, and release history before execution. - Avoid global installation where a local, version-pinned dependency is sufficient. - Resolve third-party GitHub installations to reviewed immutable commit hashes rather than mutable branches or registry names. - Display the resolved package version, repository, and commit before installation. - Require explicit user confirmation before building external repositories, modifying `PATH`, or linking Skills into agent directories. - Inspect installed Skill content before exposing it to automatic agent discovery. - Run third-party build and install operations in a sandbox with restricted filesystem access and without publishing credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (85)

External Script Fetching

High

• Category: Supply Chain

Content

## Prerequisites

```bash
bun --version || curl -fsSL https://bun.sh/install | bash
```

## Workflow

• Confidence: 99% confidence
• Finding: The prerequisite command downloads a remote script with `curl` and pipes it directly to `bash`, executing unauthenticated content from the network without prior inspection. This is a classic remote code execution pattern and is especially dangerous in an agent skill because the instruction may be followed automatically in a setup flow.

Chaining Abuse

High

• Category: Tool Misuse

Content

## Prerequisites

```bash
bun --version || curl -fsSL https://bun.sh/install | bash
```

## Workflow

• Confidence: 99% confidence
• Finding: The `| bash` construct chains network retrieval directly into shell execution, eliminating any opportunity to inspect or validate the fetched content before it runs. In the context of an agent skill, this pattern sharply increases the chance of automatic compromise from a transient CDN, DNS, MITM, or upstream package-site breach.

External Script Fetching

High

• Category: Supply Chain

Content

```
Set up api2cli for me:

1. Install bun if missing: bun --version || curl -fsSL https://bun.sh/install | bash
2. Install api2cli: npm i -g api2cli
3. Install the api2cli skill from ClawHub: npx clawhub install api2cli
4. Link the skill to OpenClaw: npx api2cli link --all --openclaw

• Confidence: 99% confidence
• Finding: `curl -fsSL https://bun.sh/install | bash` fetches a remote script and pipes it directly to the shell, giving the remote endpoint immediate arbitrary code execution on the host. This is especially dangerous in a copy-paste setup for agent users because it bypasses inspection, couples transport trust to code execution, and can lead to full system compromise if the script source or delivery path is malicious.

Chaining Abuse

High

• Category: Tool Misuse

Content

```
Set up api2cli for me:

1. Install bun if missing: bun --version || curl -fsSL https://bun.sh/install | bash
2. Install api2cli: npm i -g api2cli
3. Install the api2cli skill from ClawHub: npx clawhub install api2cli
4. Link the skill to OpenClaw: npx api2cli link --all --openclaw

• Confidence: 99% confidence
• Finding: The `| bash` chaining pattern turns remote content into immediate shell execution with no review step. In this document, it appears inside a one-shot setup prompt intended for an agent workflow, which materially increases the likelihood that dangerous code is run automatically or with minimal human oversight.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

gh repo create <app>-cli --public --source=. --push --description "<description from package.json>"
```

- If `gh repo create` succeeds but push fails (e.g. push protection), fix the issue per Phase 2 and run `git push -u origin <branch> --force`.
- If `gh repo create` says "unable to add remote" (remote already exists), just push: `git push -u origin <branch>`.
- If the repo name is taken, ask the user for an alternative name.

• Confidence: 98% confidence
• Finding: The prescribed `git push -u origin <branch> --force` uses a high-risk parameter that can overwrite remote history and bypass normal safety expectations. In this skill context, the command appears in a recovery path after push protection or remote issues, making it especially dangerous because users may execute it quickly to unblock publishing without validating the remote state.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description contains very broad trigger phrases like 'create a CLI for X', 'wrap this API', 'publish to npm', and 'push to github', which can cause accidental invocation on common development requests. In an agent context, overbroad activation is dangerous because it may pull the workflow into code generation, installation, linking, or publishing actions the user did not explicitly intend.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill repeatedly instructs the agent to execute `npx api2cli` without pinning a specific package version or integrity hash. Because `npx` resolves and executes code from the registry at runtime, a compromised maintainer account, dependency hijack, or malicious new release could cause arbitrary code execution on the user's machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This instruction fetches and executes `api2cli` via `npx` with no version pinning, which means the executed code can change over time without review. In an agent skill, that is especially risky because the agent may automatically run the command as part of a workflow, turning a supply-chain compromise into code execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The unpinned `npx api2cli install <name>` command executes code obtained dynamically from the package registry. If the package or one of its dependencies is compromised, the skill becomes a vehicle for arbitrary command execution and potentially further installation of untrusted tooling.

Session Persistence

Medium

• Category: Rogue Agent

Content

Find the API docs or OpenAPI spec. Identify: base URL, auth type, auth header, all resources and endpoints.

### 3. Create the scaffold

```bash
npx api2cli create <app> --base-url <url> --auth-type bearer

• Confidence: 69% confidence
• Finding: The workflow creates a scaffold under `~/.cli/<app>-cli/...`, establishing durable artifacts in the user's home directory that can later be executed, linked, or published. While persistence is expected for a scaffolding tool, in an agent skill this still matters because generated code and configuration can outlive the session and become a foothold for later misuse if not reviewed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Running `npx api2cli create ...` without version pinning exposes the environment to mutable registry content. Since this command scaffolds code and files that may later be built, linked, and published, a compromised release could persist malicious logic into generated artifacts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The bundle step executes an unpinned package from the registry, creating a direct supply-chain execution path. Because bundling can process project files and produce distributable artifacts, compromise here may both execute code locally and taint outputs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The `npx api2cli link <app>` command is unpinned and modifies the user's executable environment by adding linked binaries and updating PATH behavior. That magnifies the risk of a malicious or compromised package because it can establish persistence and influence future command resolution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The `npx api2cli link <app> --openclaw` command combines unpinned remote execution with cross-tool integration, increasing blast radius if abused. A malicious package could alter local skill installations, PATH, or downstream agent behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: `npx clawhub install api2cli` executes unpinned package code fetched at runtime. That creates the same supply-chain risk as the other `npx` usages, and in this context may also install additional skill content that later influences agent behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill provides workflows for publishing to GitHub, npm, ClawHub, Sundial Hub, and a registry, but it does not include an explicit warning about public disclosure of source code, secrets, embedded tokens, internal URLs, or proprietary API details. In this context, that omission is materially dangerous because the skill actively guides the user toward making artifacts public.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **Verify `gh` CLI is authenticated**: run `gh auth status`. If not logged in, ask the user to run `gh auth login` first. **Stop and wait.**
2. **Check if the CLI is already on GitHub**: run `git remote get-url origin` in the CLI directory.
   - If no remote exists → the CLI is not on GitHub yet. **Automatically run the GitHub publish flow first** (see below) before proceeding to npm or registry publish.
   - If a remote exists → already on GitHub, continue.

#### To GitHub

• Confidence: 92% confidence
• Finding: The instruction to 'Automatically run the GitHub publish flow first' delegates a consequential external action to the agent based on its own decision about repository state. Autonomous execution of publishing-related steps can lead to unintended disclosure, creation of public repositories, or irreversible network actions without sufficiently granular user approval.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The authentication instruction uses `npx clawhub login` without a version pin, so the code handling credentials is mutable and registry-controlled. If compromised, it could harvest tokens or redirect authentication flows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Publishing via `npx clawhub publish ...` executes unpinned registry code in a context that likely has access to local files and credentials. A compromised package could exfiltrate unpublished code or publish altered skill contents.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The install example `npx clawhub install <app>-cli` is another unpinned remote execution path. While presented as user guidance, it normalizes execution of mutable registry code and can propagate unsafe habits into generated skills or downstream users.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The `npx sundial-hub auth status` and `npx sundial-hub auth login` commands are unpinned and operate in a credential-sensitive context. A malicious package release could capture tokens, alter login prompts, or mislead the user about authentication state.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The push command uses an unpinned `npx` package while uploading a local skill to a public hub. This exposes both local content and credentials to any compromise in the fetched package or its dependencies.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The install example `npx sundial-hub add ...` is an unpinned runtime package execution path. Even as documentation, it instructs agents or users to trust mutable code from the registry without review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The registry install instruction `npx api2cli install <name>` is unpinned and additionally causes discovery and installation of third-party CLIs. This compounds supply-chain risk by chaining trust in both the package manager invocation and the installed artifact.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description is extremely broad ('Install any REST API as a CLI') and does not meaningfully constrain when the skill should be invoked. In a skill that also requests network, shell, and filesystem permissions, this can cause over-invocation for loosely related prompts, increasing the chance that powerful actions are taken in the wrong context or on untrusted targets.

Static analysis

No suspicious patterns detected.