Security audit

APIClaw

Security checks for vulnerabilities and agentic risk

Overview

APIClaw is a disclosed API-integration skill, but it asks users to run mutable npm code and can route full request payloads through NordSym's proxy when local credentials are missing.

Review this carefully before installing. Pin and audit the npm package version if possible, use your own provider credentials for sensitive work, avoid proxy mode for confidential prompts or messages, and restrict provider tokens to the minimum accounts and permissions needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:54
Finding: Unpinned npm Package Is Executed from a Mutable Remote Source## Vulnerability Details **File Location**: `SKILL.md:54-60` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Installation ```bash npx @nordsym/apiclaw ``` Audit first: [GitHub](https://github.com/nordsym/apiclaw) | [npm](https://npmjs.com/package/@nordsym/apiclaw) ``` ### Technical Analysis The installation instructions use `npx` to download and execute `@nordsym/apiclaw` without specifying an exact version or verifying a cryptographic integrity value. Consequently, the code executed by this command can change after the skill documentation has been reviewed. The audited project contains only `SKILL.md` and `SECURITY.md`; it does not include the npm package's executable source. The behavior of the remotely retrieved package therefore cannot be verified from the supplied artifact. If the npm publisher account, package distribution pipeline, or a future package release is compromised, running the documented command could execute attacker-controlled package code. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or package contents for `@nordsym/apiclaw`. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user or agent follows the documented installation command. 4. `npx` resolves and downloads the mutable package release. 5. Package entry points or lifecycle behavior execute with the privileges of the user invoking `npx`. 6. The malicious package may read accessible files and environment variables, make network requests, alter user-owned files, or execute additional commands. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the invoking user. The affected scope may include user-readable files, environment variables, provider credentials under `~/.secrets/`, source repositories, and any network or filesyst ...[truncated 146 chars]
Remediation: ## Remediation Suggestions - Pin the installation command to an exact, independently audited package version, for example `npx @nordsym/apiclaw@1.2.3`. - Publish and verify package integrity hashes or signed provenance before execution. - Vendor or include the executable source in the reviewed artifact so runtime behavior can be audited. - Use a lockfile and a trusted package registry configuration where the package is installed as a project dependency. - Disable dependency lifecycle scripts where compatible with the package's operation. - Run the package in a sandbox with minimum filesystem, environment-variable, credential, and network access. - Re-audit every version update rather than relying on a mutable unversioned command.

other

Warning

Location: SECURITY.md:48
Finding: Implicit Proxy Fallback Exposes Complete Request Payloads to a Third Party## Vulnerability Details **File Location**: `SECURITY.md:48-56`; also documented in `SKILL.md:48-52` **Vulnerability Type**: Sensitive data exposure through third-party proxying **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## What Gets Proxied **With your own credentials:** Nothing. Requests go directly to provider APIs. **Without credentials (using proxy):** The **full request payload** goes through APIClaw's proxy. This includes: - API parameters - Message content (if sending SMS/email) - Prompts (if calling AI models) The proxy uses NordSym's credentials to execute on your behalf. ``` The corresponding warning in `SKILL.md` states: ```markdown ## ⚠️ Important: Proxy Behavior **With your own credentials** (`~/.secrets/*.env`): Requests go **directly** to provider APIs. Your data never touches NordSym servers. **Without credentials**: Requests proxy through NordSym, including **full payloads** (prompts, message content, etc.). Do not send sensitive data via proxy. ``` ### Technical Analysis When local provider credentials are absent, APIClaw is documented as forwarding complete request payloads through NordSym's proxy. Those payloads may contain prompts, API parameters, email text, SMS content, personal information, proprietary data, or other confidential material. Although this behavior is disclosed in the documentation, credential absence acts as the condition that changes the data path. The supplied documentation does not establish that the operation fails closed, requires explicit per-call consent, performs sensitive-field redaction, or provides a mandatory proxy-disable control. A missing, misnamed, inaccessible, or improperly loaded credential file can therefore cause data to be transmitted to an additional third party. The project does not include executable source, so transport security, proxy authentication, retention policies, logging behavior, deletion controls, and server-s ...[truncated 1265 chars]
Remediation: ## Remediation Suggestions - Fail closed when provider credentials are unavailable instead of automatically using the proxy. - Require explicit, informed consent before every proxied call, clearly identifying NordSym as an additional recipient. - Provide a configuration option that permanently disables proxy fallback. - Display the selected route before transmitting a request and require separate authorization when changing from direct mode to proxy mode. - Detect missing or unreadable credential files early and return an actionable error. - Minimize payloads and redact secrets, credentials, personal information, and unnecessary metadata before proxy transmission. - Document transport encryption, authentication, retention periods, logging practices, deletion procedures, subprocessors, and incident-response controls. - Provide visible audit logs that identify whether each request was direct or proxied. - Prevent sensitive workload categories from using proxy mode through enforceable policy rather than documentation alone.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The installation command uses `npx @nordsym/apiclaw` without pinning an exact package version, so users may execute whatever version is current on npm at install/run time. If the package is later compromised, maliciously updated, unpublished/replaced, or its dependency chain is poisoned, the skill instructs automatic retrieval and execution of unreviewed code.