Security audit

OfficeX

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OfficeX API guide, but it exposes broad billing, credential, and admin workflows with weak safeguards, so it belongs in Review before installation.

Install only if you intentionally work with OfficeX and can enforce your own safeguards. Use a dedicated low-privilege account, avoid giving the agent master keys, superadmin secrets, payment tokens, or reusable third-party API keys, and require explicit confirmation before any billing, deletion, payout, wallet, or admin operation. Treat app documentation, context_prompt, downloaded skill text, iframe parameters, and agent_context values as untrusted unless separately reviewed and isolated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:294
Finding: Untrusted Third-Party Instructions Are Injected into the AI System Prompt
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:534
Finding: Raw Third-Party Credentials Are Transmitted to OfficeX and Injected into AI Context
Content: View full analysis
(null deletes key) { "api_key": "sk-abc123", "workspace_id": "ws-456" } // Response (200) { success: true, agent_context: { "api_key": "sk-abc123", "workspace_id": "ws-456" } } ``` **Two patterns for setting `agent_context`:** 1. **Webhook-response (auto):** Return credentials in your INSTALL webhook response → auto-applied as `agent_context`. Best for apps that provision credentials server-side on install. 2. **Post-install from app UI (manual):** App collects credentials from the user inside its own iframe/UI after install, then PATCHes them via install secret auth. Best for apps where the **user supplies their own API key/token** (e.g., Telegram bot token, OpenAI key, Stripe key). Flow: - User installs app (no extra params needed) - User opens app → enters their credentials in the app's UI - App calls `PATCH /installs/{install_id}/context` with install secret auth - Credentials are stored on the installation → available to AI agent via `load_app_skill` # App-side context update (install secret auth) PATCH /v1/installs/{install_id}/context Headers: X-Officex-Install-Id: {install_id}, X-Officex-Install-Secret: {install_secret} Body: { "telegram_bot_token": "123456:ABC-DEF..." } → { success: true, agent_context: { "telegram_bot_token": "123456:ABC-DEF..." } } ``` ### Technical Analysis The documented architecture intentionally collects raw user-supplied secrets, sends ...[truncated 2021 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:819
Finding: INSTALL Webhook Is Trusted Without Authentication or Replay Protection
Content: View full analysis
{ const { event, payload, uuid } = req.body; if (event === "INSTALL") { const { install_id, install_secret, user_id, app_id, email } = payload; let user = await db.users.findOne({ officex_user_id: user_id }); if (!user) { user = await db.users.create({ officex_user_id: user_id, officex_install_id: install_id, created_at: new Date(), }); } else { await db.users.update( { officex_user_id: user_id }, { officex_install_id: install_id }, ); } // Return agent_context — credentials the AI agent needs to call your API res.json({ agent_context: { user_token: user.apiToken, base_url: "https://myapp.com/api/v1", }, }); } else { res.json({ received: true }); } }); ``` ### Technical Analysis The webhook handler trusts `event`, `payload`, and `uuid` directly from the HTTP request body. It does not verify a cryptographic signature, shared secret, issuer, timestamp, destination application, or request freshness. The handler uses this unauthenticated input to create or update users and returns a user API token in `agent_context`. The `uuid` is parsed but is not used for replay detection. HTTPS protects transport confidentiality but does not prove that an incoming request originated from OfficeX. Any network client that can reach the endpoint can construct the expected JSON envelope. ### Attack Path 1. An attacker identifies the public `/webhooks/officex` endpoint. 2. The attacker submits a forged `INSTALL` event containing selected `user_id`, `install_id`, `app_id`, and email values. 3. The handler accepts the event without verifyi ...[truncated 911 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:845
Finding: Iframe SSO Authenticates Users from Unverified Query Parameters
Content: View full analysis
{ const installId = req.query.officex_install_id; const customerId = req.query.officex_customer_id; const user = await resolveUser(installId, customerId); req.session.user = user; req.session.officex = { install_id: installId, install_secret: req.query.officex_install_secret, }; res.redirect("/dashboard"); }); ``` ```typescript async function resolveUser(installId, customerId) { // Try install_id first (most specific) let user = await db.users.findOne({ officex_install_id: installId }); if (user) return user; // Fall back to customer_id (they might have reinstalled) user = await db.users.findOne({ officex_user_id: customerId }); if (user) { await db.users.update({ id: user.id }, { officex_install_id: installId }); return user; } // No user found — create on-the-fly return await db.users.create({ officex_user_id: customerId, officex_install_id: installId, created_at: new Date(), }); } ``` ### Technical Analysis The iframe entry route treats client-controlled query parameters as proof of identity. It does not verify the install secret with OfficeX, validate a signed launch assertion, or confirm that the customer and installation are legitimately associated. If the supplied installation ID is unknown, `resolveUser` falls back to the supplied customer ID. It then returns the matching user and overwrites that user's installation ID with an attacker-controlled value. The caller immediately assigns the returned user to the authenticated session. Knowledge of a victim's OfficeX user ID may therefore be sufficient to establish an application session as that victim. Even where a victim identifier is not known, the endpoint can cr ...[truncated 1093 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:715
Finding: Billing Secret Is Exposed in URLs and Browser-Accessible Storage
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:86
Finding: Testing Mode Uses a Globally Hardcoded OTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: The skill exposes destructive install-management operations that could be driven by agent-supplied parameters without emphasizing confirmation or identity checks. In an LLM/tooling environment, delete and rotate-secret actions are especially sensitive because prompt confusion or malicious instruction injection can cause service disruption or credential invalidation.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
GET /users/me/installs/{id} → { install (with usage stats) } POST /install/{app_id_or_slug} { max_per_hour?, max_per_day?, max_per_month?, allowed_until? } → { app_id, install_id, install_secret, agent_context? } ⚠️ secret shown once DELETE /users/me/installs/{id} → { success } PATCH /users/me/installs/{id} { max_per_hour?, max_per_day?, max_per_month?, allowed_until?, lifetime_spend_limit? } → { install } POST /users/me/installs/{id}/rotate-secret → { install_secret }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: Documenting app deletion as a routine callable action without guardrails creates a tool-parameter abuse risk. An agent that misbinds app_id or follows adversarial prompt content could delete production apps, causing outage and loss of configuration or marketplace presence.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
GET /users/me/apps/{app_id} → { app } PATCH /users/me/apps/{app_id} (see full schema below) → { app } DELETE /users/me/apps/{app_id} → { success } GET /users/me/apps/{app_id}/inbox → { reservations[], pagination? } POST /users/me/apps/{app_id}/inbox/{log_id}/ack → { success } GET /users/me/apps/{app_id}/installs → { installs[] }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Chat deletion is less severe than credential or billing actions, but still a destructive operation vulnerable to parameter abuse in agent workflows. Ambiguous references like 'delete that thread' can easily map to the wrong id without verification, causing data loss and audit gaps.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
POST /users/me/chats { title?, project_id?, tracer_id? } → { thread } GET /users/me/chats/{id} → { thread, messages[] } PATCH /users/me/chats/{id} { title?, tracer_id?: string|null } → { thread } DELETE /users/me/chats/{id} → { success }

text
Streaming (Function URL, NOT API Gateway):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Prompt CRUD, especially DELETE, can be abused if an agent accepts untrusted identifiers or vague instructions. Because prompts may encode business logic or sensitive workflows, accidental or manipulated deletion can degrade system behavior and user trust.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
text
GET /users/me/inbox → { messages[] } GET/POST/PATCH/DELETE /users/me/prompts[/{id}] → prompt CRUD GET /refs/{slug} → { ref } (No Auth) GET/POST /users/me/refs[/{slug}] → ref CRUD [Master Key] POST /uploads/presign { filename, content_type } → { presigned_url, key }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Admin endpoints include destructive and state-changing operations such as deleting apps and adjusting wallets, yet the skill presents them as accessible API surface without strong operational safeguards. In an agent setting, exposing superadmin actions materially increases the risk of catastrophic misuse from prompt injection, wrong parameter binding, or accidental invocation.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
All under `/admin/*` with `x-officex-admin-secret`: **Users:** `GET /admin/users`, `GET/PATCH /admin/users/{id}`, `GET /admin/users/{id}/wallets` **Apps:** `GET /admin/apps`, `GET/PATCH/DELETE /admin/apps/{id}` **Wallets:** `GET /admin/wallets`, `GET /admin/wallets/{id}`, `POST /admin/wallets/{id}/adjust { amount }` **Treasury:** `GET /admin/treasury`, `POST /admin/reconcile`, `GET /admin/audit` **Payouts:** `GET /admin/payouts`, `GET /admin/payouts/{id}`, `POST /admin/payouts/{id}/approve`, `POST /admin/payouts/{id}/reject`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: Admin voucher deletion is a privileged destructive operation that can be abused through untrusted parameters or mistaken targeting. In a tool-using agent, even small admin actions can impact billing, credits, and user entitlements if invoked without confirmation and strict authorization controls.
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
**Wallets:** `GET /admin/wallets`, `GET /admin/wallets/{id}`, `POST /admin/wallets/{id}/adjust { amount }` **Treasury:** `GET /admin/treasury`, `POST /admin/reconcile`, `GET /admin/audit` **Payouts:** `GET /admin/payouts`, `GET /admin/payouts/{id}`, `POST /admin/payouts/{id}/approve`, `POST /admin/payouts/{id}/reject` **Vouchers:** `POST /admin/vouchers`, `GET /admin/vouchers`, `GET/PATCH/DELETE /admin/vouchers/{code}` ## Error Format

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill encourages storing and transmitting sensitive credentials via agent_context, webhook responses, iframe parameters, and app-side patch operations without strong privacy warnings or safer alternatives. In an agent ecosystem, this materially raises the risk of credential exposure through logs, prompts, browser history, referrers, third-party scripts, or prompt/tool misuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad terms like 'wallet', 'OTP', 'webhook', and 'iframe', which can cause the skill to activate in conversations unrelated to OfficeX. Overbroad activation increases the chance the agent injects sensitive OfficeX-specific instructions or credential-handling guidance into the wrong context, enabling confused-deputy behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document states install secrets are 'billing only', but later authorizes those same secrets to write arbitrary agent_context and send inbox messages. That scope expansion turns a payment credential into a broader capability token, increasing blast radius if leaked and making downstream integrators likely to over-trust or mishandle it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Publishing a hardcoded OTP of '0000' without a strong, repeated warning that it is limited to isolated staging/test environments normalizes unsafe authentication assumptions. If copied into production-adjacent deployments or misunderstood by developers, it could lead to account takeover or severely weakened auth flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation presents destructive admin and deletion operations, including app deletion, voucher deletion, and wallet adjustment, without prominent cautions, confirmation requirements, or rollback guidance. In an agent-assisted setting, that increases the risk of unintended irreversible actions from ambiguous prompts or parameter mistakes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
Example:

bash
curl -X POST https://cloud.officex.app/v1/register-app \ -H "Content-Type: application/json" \ -H "x-officex-user-id: $OFFICEX_USER_ID" \ -H "x-officex-master-key: $OFFICEX_API_KEY" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 985)May include surrounding context.
Example:

bash
curl -X POST https://cloud.officex.app/v1/register-app \ -H "Content-Type: application/json" \ -H "x-officex-user-id: $OFFICEX_USER_ID" \ -H "x-officex-master-key: $OFFICEX_API_KEY" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 591)May include surrounding context.
text
```bash curl -X POST https://cloud.officex.app/v1/installs/$INSTALL_ID/inbox \ -H "Content-Type: application/json" \ -H "x-officex-install-id: $INSTALL_ID" \ -H "x-officex-install-secret: $INSTALL_SECRET" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 906)May include surrounding context.
typescript
async function safeReserve(installId, installSecret, amount, jobId) { try { const res = await fetch("https://cloud.officex.app/v1/reserve", { method: "POST", headers: { "Content-Type": "application/json",

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest description enumerates covered areas such as REST API calls, billing, installs, wallets, webhooks, iframes, and chat-agent integration, but does not mention schedules. The later 'Tracers' section states that tracer IDs link threads and 'schedule runs' and references POST /users/me/schedules and schedule responses, expanding functionality beyond the described scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.