Freeapi

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible OpenAPI client, but it handles API keys in ways that can expose them to untrusted specs, local files, or unintended network destinations.

Review carefully before installing. Only use trusted OpenAPI specs, avoid entering API keys into chat, do not store valuable tokens in a project `.env`, and do not run this against specs or servers you would not trust with the selected credentials. Prefer narrowly scoped tokens and revoke any credential that may have been used with an untrusted spec.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:111

Finding

Credential Exfiltration Through Attacker-Controlled OpenAPI Specifications

Content

View full analysis

API_KEY const token = process.env[envVarName] || process.env[`${envVarName}_TOKEN`] || process.env[`${envVarName}_KEY`]; if (token) { if (scheme.type === 'http' && scheme.scheme === 'bearer') { headers['Authorization'] = `Bearer ${token}`; } else if (scheme.type === 'apiKey' && scheme.in === 'header') { headers[scheme.name] = token; } } } } console.error(`Executing ${selectedMethod.toUpperCase()} ${fullUrl}`); // Log to stderr to keep stdout clean for JSON output const res = await fetch(fullUrl, { method: selectedMethod, headers, body: ['POST', 'PUT', 'PATCH'].includes(selectedMethod.toUpperCase()) ? JSON.stringify(body) : undefined, }); ``` ### Technical Analysis The OpenAPI specification controls both the destination in `servers[0].url` and the security-scheme name used to select an environment variable. The implementation converts the scheme name into an environment-variable name and automatically attaches any matching local secre ...[truncated 2069 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:111

Finding

Arbitrary Network Access and Internal-Service Request Capability

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:111

Finding

API Credentials Can Be Transmitted Over Plaintext HTTP

Content

View full analysis

API_KEY const token = process.env[envVarName] || process.env[`${envVarName}_TOKEN`] || process.env[`${envVarName}_KEY`]; if (token) { if (scheme.type === 'http' && scheme.scheme === 'bearer') { headers['Authorization'] = `Bearer ${token}`; } else if (scheme.type === 'apiKey' && scheme.in === 'header') { headers[scheme.name] = token; } } } } console.error(`Executing ${selectedMethod.toUpperCase()} ${fullUrl}`); // Log to stderr to keep stdout clean for JSON output const res = await fetch(fullUrl, { method: selectedMethod, headers, body: ['POST', 'PUT', 'PATCH'].includes(selectedMethod.toUpperCase()) ? JSON.stringify(body) : undefined, }); ``` ### Technical Analysis The protocol check only adds `https://` when the server value does not start with the text `http`. An explicitly provided `http://` URL is accepted unchanged. Authentication headers and request bodies are then sent to that URL without checking whether transport encryption is active. Bearer tokens and API keys generally function as reusable credentials. Sending them over plaintext HTTP exposes them to passive network observers and active intermediaries. Request bodies may also contain confidential business or personal data. ### Attack Path 1. A supplied OpenAPI specification ...[truncated 916 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:239

Finding

API Keys Are Persisted in Plaintext Without Enforced File Protections

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This onboarding flow directs the agent to request sensitive credentials from the user and then use write/edit capabilities to store them locally. That creates a direct secret-handling pathway inside the agent, which is dangerous because prompt injection, logging, transcript retention, workspace access, or later tool misuse could expose or misuse those credentials.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example thought process reinforces a norm that when a secret is missing, the correct next step is to ask for it and save it before proceeding. This is risky because examples often become operational behavior, causing agents to habitually solicit and persist high-value credentials rather than using safer out-of-band configuration methods.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 9)May include surrounding context.

js

import YAML from 'yaml';
import inquirer from 'inquirer';

// Load environment variables from .env file
dotenv.config();

const SERVICES = [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Resolving and using .env in the current working directory enables the tool to persist credentials into whichever folder the user happens to be in, which may be a shared repo, synced workspace, or otherwise untrusted location. Because the same application also auto-loads .env and can inject secrets into arbitrary spec-defined requests, this creates a practical credential exposure and misuse path.

Content

Scanner excerpt · index.js (reported line 242)May include surrounding context.

js

console.log('\n--- Configuring Keys ---');
    
    const envPath = path.resolve(process.cwd(), '.env');
    let envContent = '';
    if (fs.existsSync(envPath)) {
      envContent = fs.readFileSync(envPath, 'utf8');

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The lockfile pins lodash 4.17.23, and the cited advisories describe real classes of risk for applications that expose affected functionality, including prototype pollution in _.unset and code injection through _.template. Even though a lockfile alone does not prove the vulnerable APIs are reachable, shipping a known-vulnerable dependency is a true supply-chain weakness because downstream code or future changes may invoke those paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: tmp==0.0.33 — 2 advisory(ies): CVE-2025-54798 (tmp allows arbitrary temporary file / directory write via symbolic link `dir` pa); CVE-2026-44705 (tmp has Path Traversal via unsanitized prefix/postfix that enables directory esc)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency tree includes tmp 0.0.33, and the reported issues indicate unsafe temporary file handling and path manipulation weaknesses that can lead to arbitrary file or directory write when attacker-controlled inputs influence temp paths. In a CLI-oriented package with interactive/editor-related dependencies, temp-file usage is plausible, which makes this more than a theoretical concern if the vulnerable code path is exercised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

### 1. Onboarding (The "Integral" Method)

Do not ask users to run raw CLI commands unless they prefer it. Instead, **guide them conversationally**:

1.  **Ask**: "Which service do you want to connect? (e.g., GitHub, Stripe, OpenAI)"
2.  **Prompt**: "Please provide your API key for [Service]. I will save it securely to your local `.env` file."

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to ask users for API keys and write them into a local .env file, while assuring users this is secure without discussing risks such as plaintext secret storage, accidental commits, shell/history exposure, or unauthorized local access. In agent contexts, normalizing conversational collection and persistence of secrets increases the chance of unsafe credential handling and secret sprawl.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

When a user asks to perform an action (e.g., "Check my GitHub issues"):

1.  **Locate Spec**: Find the OpenAPI spec URL (e.g., `https://api.github.com/openapi/v3`).
2.  **Check Keys**: Verify the key exists in `.env`. If not, trigger the **Onboarding** flow above.
3.  **Run**: Use `node skills/freeAPI/index.js run` with the spec and parameters.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool prompts for a large set of unrelated third-party service credentials despite having no constrained business purpose or per-service justification. Bulk credential collection expands blast radius significantly: a user may store many high-value secrets that can later be misused by arbitrary spec-driven requests or other local processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CLI presents itself as a bare OpenAPI client but also includes an interactive credential-harvesting/setup workflow that writes secrets into a local .env file. Understating that behavior is risky because users may invoke the tool without realizing it solicits and persists sensitive credentials on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The run command fetches a user-supplied OpenAPI spec and executes arbitrary operations against remote endpoints, while auto-injecting matching environment credentials into requests. Without strong warnings or trust controls, users may unknowingly send sensitive data or authenticated requests to attacker-controlled servers described by a malicious spec.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The setup flow writes API keys directly to a local .env file without prominently warning that secrets are being persisted to disk in the current working directory. This can expose credentials through accidental check-in, insecure file permissions, backups, shell history/workspace sharing, or use in untrusted directories.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: yaml==2.8.2 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

The project directly depends on yaml 2.8.2, and the advisory describes a stack overflow/denial-of-service condition when parsing deeply nested YAML collections. Because this package appears to intentionally process YAML, the skill context increases relevance: if untrusted YAML input is accepted, an attacker may crash the process or degrade availability.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret version range, which allows newer compatible releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility, especially if a future upstream release is compromised or introduces a security regression.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"start": "node index.js"
  },
  "dependencies": {
    "commander": "^11.0.0",
    "dotenv": "^16.3.1",
    "inquirer": "^9.2.12",
    "yaml": "^2.3.1"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret version range, which allows newer compatible releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility, especially if a future upstream release is compromised or introduces a security regression.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json

},
  "dependencies": {
    "commander": "^11.0.0",
    "dotenv": "^16.3.1",
    "inquirer": "^9.2.12",
    "yaml": "^2.3.1"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret version range, which allows newer compatible releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility, especially if a future upstream release is compromised or introduces a security regression.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"dependencies": {
    "commander": "^11.0.0",
    "dotenv": "^16.3.1",
    "inquirer": "^9.2.12",
    "yaml": "^2.3.1"
  },
  "author": "xethis",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret version range, which allows newer compatible releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility, especially if a future upstream release is compromised or introduces a security regression.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"commander": "^11.0.0",
    "dotenv": "^16.3.1",
    "inquirer": "^9.2.12",
    "yaml": "^2.3.1"
  },
  "author": "xethis",
  "license": "MIT",

Known Vulnerable Dependency: yaml==2.8.2 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:150