Security audit

Api Gateway

Security checks across malware telemetry and agentic risk

Overview

This is a broad API gateway skill for live third-party accounts, and its high-impact capabilities are under-scoped and inconsistently documented.

Install only if you trust Maton with gateway access to your connected services. Use least-privilege connections, avoid broad admin scopes, and require explicit human confirmation before any write, delete, billing, public-sharing, webhook, messaging, or account-administration action. Treat MATON_API_KEY and any service API-key connections as sensitive secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (87)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The README states that authentication is automatic because the router injects an API key, which directly conflicts with the skill metadata claiming that third-party services require explicit user OAuth authorization. In an API-gateway skill, this kind of inconsistency can mislead an agent or operator into believing Apollo access is implicitly available, increasing the risk of unauthorized third-party requests or misuse of credentials.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The README states that Baserow connections use API_KEY authentication rather than the skill's declared managed OAuth model. This mismatch can mislead downstream agents or operators about trust boundaries, token handling, consent flow, and scope limitations, increasing the chance of insecure integration behavior or accidental credential misuse.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The README says Buffer 'uses API key authentication,' which conflicts with the skill's stated security model that Maton's API key does not grant third-party access and that each service requires explicit user OAuth authorization. This kind of contradictory auth documentation can cause agents or integrators to send the wrong credential type, misunderstand trust boundaries, or encourage insecure handling of secrets for a third-party service.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill metadata states that access to third-party services requires explicit OAuth authorization by the user, but this Chargebee reference says the router automatically injects Basic authentication from an API key. That is a material security-model mismatch: it implies direct third-party API access via stored credentials rather than per-user OAuth consent, which can lead to overbroad access assumptions, unauthorized use of a connected tenant, and unsafe agent behavior.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The README explicitly says fal.ai uses API key authentication, which conflicts with the skill-level security statement claiming third-party services require explicit OAuth authorization through Maton's connect flow. This mismatch can mislead users or integrators about the trust boundary and authorization model, increasing the risk that API-key-based access is used without the expected user consent flow or with weaker credential handling controls.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: This reference exposes high-risk Kibana capabilities such as security role enumeration and connector execution that go beyond a narrow read-only integration reference. In an API gateway skill, documenting these endpoints can enable an agent to perform sensitive administrative or external-action operations against a user's Kibana instance if the connected account is privileged, increasing the chance of overbroad or unsafe use.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The README states that the Manus connection uses API_KEY authentication, which conflicts with the skill metadata claiming managed OAuth with explicit per-user authorization. In an API-gateway skill, this mismatch is dangerous because agents or integrators may assume the endpoint is covered by user-scoped OAuth controls when it may instead rely on a broader static credential, creating a risk of unauthorized access, overbroad access, or bypass of expected consent boundaries.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The file documents a PDF/document-processing proxy service inside a skill whose stated purpose is managed OAuth access to user-authorized SaaS applications. That mismatch can cause operators or downstream agents to treat arbitrary document-processing and external file-fetching capabilities as if they were covered by the safer OAuth model, increasing the risk of inappropriate data handling and misuse.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The README explicitly states that the Reducto connection uses API_KEY authentication, which conflicts with the skill-level security claim that third-party services require explicit user OAuth authorization. This mismatch can mislead operators or downstream agents into assuming user-granted OAuth protections exist when access may instead be governed by a shared or centrally managed API key, increasing the risk of overbroad access and unauthorized data transmission.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The invocation guidance says to use this skill whenever users want to interact with external services, which is extremely broad for a capability that can perform direct authenticated actions across many third-party accounts. In an agent setting, this increases the chance of over-selection and unintended use for high-impact operations like sending messages, modifying records, or accessing sensitive data without clear guardrails.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The examples demonstrate real write operations against external systems, such as posting Slack messages and creating HubSpot contacts, but the document does not prominently warn that these actions affect live third-party accounts and data. In an autonomous or semi-autonomous agent workflow, this omission can lead to unintended side effects, data modification, or outbound communications on behalf of the user.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The README documents write-capable and privacy-impacting operations such as creating contacts/accounts, updating contacts, and adding contacts to sequences, but gives no warning that these actions modify third-party data or may trigger outreach workflows. In an agent-facing integration guide, omission of such warnings raises the chance of unintended changes, privacy harm, or user-surprising actions being performed without explicit confirmation.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The README encourages enrichment and search requests involving emails, LinkedIn URLs, and contact/person records, while noting automatic authentication, but it does not warn that such data is transmitted to Apollo, a third-party service. In the context of a broad API-gateway skill, lack of disclosure increases the risk that sensitive personal or business data is sent externally without informed user awareness or appropriate minimization.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The README prominently documents destructive delete and batch-delete endpoints, as well as update operations, without any warning about irreversible data loss, confirmation requirements, or safe-use guidance. In an agent skill that enables external API actions, this omission increases the risk that an agent or user invokes destructive operations unintentionally against live third-party data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation includes destructive operations such as delete and sharing-capable actions without warning about irreversible data loss, recursive deletion, or access expansion. In an agent skill, examples are likely to be copied directly into tool calls, so omission of cautions materially increases the chance of unsafe actions being performed on real user data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The example sets `"shared_link": {"access": "open"}` without warning that this can make folder contents publicly accessible to anyone with the link, depending on Box configuration. Because this is presented as a normal example in an API gateway skill, an agent or user may reproduce it without understanding the external exposure risk.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The README documents authentication and data operations against account, channel, and post resources without warning about credential handling or the privacy sensitivity of user social-media content and account metadata. In an agent skill that brokers access to external services, missing security guidance increases the chance of oversharing data, mishandling tokens, or making requests without clear user awareness of what third-party data is being accessed.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Documenting webhook creation without any caution can lead an agent or operator to send calendaring events to arbitrary external URLs, which may disclose scheduling metadata to third parties. In an API-gateway skill that connects to real user-authorized services, this is more sensitive because the action establishes ongoing outbound data flow beyond a one-time API call.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The README includes numerous state-changing operations such as creating customers, creating subscriptions, canceling subscriptions, generating hosted pages, and creating portal sessions, but it does not warn that these actions can affect billing, customer accounts, or live service state. In an agent skill, examples like these can normalize destructive or high-impact actions without requiring confirmation, increasing the chance of accidental or unauthorized business-impacting changes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Documenting webhook creation without a privacy or outbound-data warning can lead downstream agents or users to register endpoints that exfiltrate customer, order, or form data to arbitrary third-party URLs. In an API-gateway skill that simplifies access to many services, this is more dangerous because it normalizes a data-export mechanism without highlighting trust, destination validation, or sensitivity considerations.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The remote image upload-by-URL feature causes the third-party service to fetch a user-supplied external URL, which can have privacy and security implications such as leaking that a fetch occurred, pulling content from untrusted hosts, or facilitating misuse of internal or sensitive URLs if not carefully constrained. While this is documentation rather than code, omitting any caution makes risky use more likely.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This section documents high-impact administrative actions such as suspending and removing members, including options like wiping data and transferring ownership, but provides no warning that these operations can disrupt access or cause data loss. In an agent skill context, omission of confirmation and impact guidance increases the chance that an LLM-driven workflow or user will execute destructive actions without adequate review.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documented endpoint permanently deletes a team folder, yet the reference provides no warning that the action is irreversible and may destroy shared organizational data. In a gateway skill that exposes live third-party admin APIs, this omission materially increases the risk of accidental catastrophic deletion by users or autonomous agents.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guidance explains how to use the Dropbox-API-Select-User header to access files on behalf of a member, but it does not warn that this is an impersonation-style capability with significant privacy and insider-risk implications. In this skill, managed OAuth and scoped connections reduce exposure somewhat, but once authorized, the feature can still enable broad access to employee content if used without clear authorization boundaries and auditing guidance.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The README notes that the integration uses API key authentication but provides no guidance about sensitive credential handling, storage, or privacy implications. In a skill designed to connect to external services, omission of such warnings can lead developers or users to expose keys in prompts, logs, configs, or shared environments.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.