Security audit

ApexApi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed guide for using the ApexApi service, including API-key setup, paid usage, web access, and optional MCP integration.

Install only if you intend to let your agent use ApexApi for paid model calls and web access. Keep the API key and claim token private, set spend limits where available, approve any funding or wallet transaction yourself, and be cautious with the optional unpinned npx MCP setup.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

Category: Data Exfiltration
Content: If your host speaks MCP, you can use ApexApi as an MCP server instead of raw HTTP — same key, same balance: - **Local (stdio):** `npx -y apexapi-mcp` with env `APEXAPI_API_KEY=ak-…` - **Remote (HTTP):** `https://api.apexapi.dev/mcp` with header `Authorization: Bearer ak-…` - Claude Code: `claude mcp add apexapi -e APEXAPI_API_KEY=ak-… -- npx -y apexapi-mcp` Tools cover models, chat, images, video, scrape/crawl/extract. Docs: https://apexapi.dev/docs/mcp
Confidence: 67% confidence
Finding: The MCP section instructs users to run a remote or package-fetched integration (`npx -y apexapi-mcp`) with a live API key in environment variables, creating a supply-chain and credential-exposure risk if the package or execution environment is compromised. Because MCP servers can expose powerful tools and web access, a compromised package or remote endpoint could misuse the bearer token and act on the account without additional user approval.

Static analysis

No suspicious patterns detected.