Api Gateway

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Maton API gateway skill, but it needs review because it gives an agent broad live-service action capability, including deletion, posting, file, admin, and business-data operations, with limited guardrail guidance.

Install only if you are comfortable letting the agent act through your Maton-authorized third-party connections. Use the narrowest OAuth scopes available, verify the selected connection before actions, require explicit confirmation for deletes, public posts, financial/admin changes, and bulk mutations, never print or share MATON_API_KEY, and validate any pre-signed media upload destination before sending local files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:614
• Finding: Maton API Key Disclosed in Troubleshooting Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:614-619` **Vulnerability Type**: Credential exposure through terminal output **Risk Level**: Medium ### Vulnerable Code ```markdown ### Troubleshooting: API Key Issues 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEY ``` ``` ### Technical Analysis The troubleshooting procedure instructs users to print the complete `MATON_API_KEY` value to standard output. This credential authenticates requests to the Maton gateway and connection-management endpoints. Displaying the secret is unnecessary when only its presence needs to be verified. The value may be captured in terminal recordings, CI/CD logs, remote support sessions, screenshots, command output copied into tickets, or other diagnostic artifacts. Although the command does not deliberately transmit the credential to an unrelated server, it materially increases the likelihood of accidental disclosure. ### Attack Path 1. A user encounters an authentication problem and follows the documented troubleshooting procedure. 2. The user runs `echo $MATON_API_KEY`. 3. The complete API key appears in terminal output. 4. The output is captured by terminal logging, screen sharing, automation logs, screenshots, or copied diagnostic information. 5. An attacker obtains the exposed key. 6. The attacker submits the key as a bearer credential to `gateway.maton.ai` or `ctrl.maton.ai`. 7. Subject to the key's server-side permissions, the attacker accesses authorized third-party connections or performs supported connection-management operations. ### Impact Assessment A disclosed key may permit unauthorized calls through any third-party connection associated with the Maton account, within the OAuth scopes previously authorized by the user. This could expose connected-service data or permit modification and deletion operations supported by those scopes. The key also authenticates connection-management requests. Consequent ...[truncated 284 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace secret-printing instructions with a presence-only check: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fi ``` - If limited fingerprinting is necessary, show only a short non-sensitive identifier generated by the service rather than any portion of the bearer token. - Warn users not to include API keys in logs, screenshots, support tickets, shell tracing, or copied terminal output. - Ensure application and gateway logs redact `Authorization` headers and known key formats. - Provide a documented key-revocation and rotation procedure. - Advise immediate rotation whenever the key has been displayed in a recorded or shared environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/linkedin/README.md:222
• Finding: LinkedIn Media Upload Trusts an Unvalidated Response-Supplied Destination<![CDATA[ ## Vulnerability Details **File Location**: `references/linkedin/README.md:222-229` **Vulnerability Type**: Unvalidated outbound file-upload destination **Risk Level**: Medium ### Vulnerable Code ```python upload_url = init_resp['value']['uploadInstructions'][0]['uploadUrl'] video_urn = init_resp['value']['video'] # Step 2: Upload binary DIRECTLY to pre-signed URL (NOT through gateway, NO auth header) with open(file_path, 'rb') as f: video_data = f.read() upload_req = urllib.request.Request(upload_url, data=video_data, method='PUT') upload_req.add_header('Content-Type', 'application/octet-stream') upload_resp = urllib.request.urlopen(upload_req) ``` ### Technical Analysis The example obtains `upload_url` from a remote gateway response and uses it directly as the destination for a local file upload. It does not verify: - That the scheme is HTTPS. - That the hostname is an expected LinkedIn upload host. - That the URL does not contain unexpected user-information or port components. - That redirects remain within an approved hostname set. The code correctly avoids attaching `MATON_API_KEY` to the direct upload. Therefore, the exposed asset is the selected media file rather than the gateway credential. Nevertheless, treating a remotely supplied URL as an unrestricted upload destination creates a data-exfiltration path if the gateway response, upstream response, or relevant network trust boundary is compromised. ### Attack Path 1. The user selects a local video and starts the documented LinkedIn upload workflow. 2. The initialization request is sent through `gateway.maton.ai`. 3. A compromised or incorrectly behaving gateway or upstream response supplies an attacker-controlled URL in `uploadInstructions[0].uploadUrl`. 4. The example accepts the URL without checking its scheme or hostname. 5. The code reads the complete selected file into memory. 6. The file is sent with an HTTP `PUT` request to the attacker-controlled destination. 7. The atta ...[truncated 834 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Parse and validate the URL before opening or reading the local file. - Require the `https` scheme. - Enforce an exact allowlist of LinkedIn-controlled upload hostnames documented for this API. - Reject URLs containing unexpected credentials, fragments, or nonstandard ports. - Disable automatic redirects where possible, or validate the scheme and hostname of every redirect target before following it. - Perform destination validation before reading the file from disk. - Stream the file rather than loading it completely into memory. - Continue omitting both the Maton API key and third-party OAuth headers from pre-signed upload requests. - Add explicit failure behavior so an unexpected destination terminates the operation rather than falling back to an unrestricted request. Example validation pattern: ```python from urllib.parse import urlparse ALLOWED_UPLOAD_HOSTS = { "www.linkedin.com", # Add only other upload hosts explicitly documented and verified by LinkedIn. } parsed = urlparse(upload_url) if ( parsed.scheme != "https" or parsed.hostname not in ALLOWED_UPLOAD_HOSTS or parsed.username is not None or parsed.password is not None or parsed.port not in (None, 443) ): raise ValueError("Unexpected LinkedIn upload destination") ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (567)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Contact
```bash
DELETE /active-campaign/api/3/contacts/{contactId}
```

### Tags

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Remove Tag from Contact
```bash
DELETE /active-campaign/api/3/contactTags/{contactTagId}
```

### Lists

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The README documents cancellation, rescheduling, and deletion operations but does not warn that these actions are destructive or difficult to reverse. Because this skill operates through managed OAuth against user-authorized third-party services, an agent following the reference could cancel appointments or delete scheduling blocks in production with immediate business impact.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Block
```bash
DELETE /acuity-scheduling/api/v1/blocks/{id}
```

### List Forms

• Confidence: 88% confidence
• Finding: The documented DELETE endpoint takes a directly supplied block ID and performs a destructive action, which creates a parameter-abuse risk if an agent passes the wrong identifier or acts on unvalidated user input. In a multi-service API gateway context, this is more dangerous because the skill is designed for direct action against live external systems once OAuth authorization exists.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Records
```bash
DELETE /airtable/v0/{baseId}/{tableIdOrName}?records[]=recXXXXX&records[]=recYYYYY
```

### List Bases

• Confidence: 95% confidence
• Finding: The documented DELETE endpoint shows a direct pattern for deleting records via user-controlled query parameters, with no mention of validation, confirmation, or safeguards. In this API-gateway context, the skill enables access to real OAuth-authorized Airtable bases, so exposing destructive parameterized deletion guidance can be abused by prompt injection or mistaken agent actions to remove legitimate records.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete a Task
```bash
DELETE /asana/api/1.0/tasks/{task_gid}
```

### Get Subtasks

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```bash
DELETE /asana/api/1.0/webhooks/{webhook_gid}
```

## Notes

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Record
```bash
DELETE /attio/v2/objects/{object}/records/{record_id}
```

### List Tasks

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Note
```bash
DELETE /attio/v2/notes/{note_id}
```

### Comments

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete List Entry
```bash
DELETE /attio/v2/lists/{list}/entries/{entry_id}
```

### Meetings

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Row
```bash
DELETE /baserow/api/database/rows/table/{table_id}/{row_id}/
```

### Batch Create Rows

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Subscription
```bash
DELETE /beehiiv/v2/publications/{publication_id}/subscriptions/{subscription_id}
```

### Posts

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Folder
```bash
DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Folder
```bash
DELETE /box/2.0/folders/{folder_id}
DELETE /box/2.0/folders/{folder_id}?recursive=true
```

### Get File

• Confidence: 80% confidence
• Finding: The recursive delete variant materially amplifies the destructive scope of a single operation and is presented without any guardrails or warning. In an API gateway skill used by agents, this can enable large-scale accidental deletion if model-generated parameters are accepted too readily.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete File
```bash
DELETE /box/2.0/files/{file_id}
```

### Upload File (up to 50 MB)

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

### Chunked Upload (Large Files)

#### Create Upload Session
```bash
POST /box/api/2.0/files/upload_sessions
Content-Type: application/json

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Abort Upload Session
```bash
DELETE /box/api/2.0/files/upload_sessions/{session_id}
```

### Create Shared Link

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The trash section includes permanent deletion endpoints for files and folders from trash without any caution about irreversibility. In an agent-mediated environment, omission of such warnings materially increases the chance of destructive actions causing permanent data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Trash
```bash
GET /box/2.0/folders/trash/items
DELETE /box/2.0/files/{file_id}/trash
DELETE /box/2.0/folders/{folder_id}/trash
```

• Confidence: 85% confidence
• Finding: `DELETE /files/{file_id}/trash` permanently removes a trashed file, which is more dangerous than a normal delete and can bypass recovery expectations. In an agent-accessible gateway, omission of safeguards around this endpoint raises the risk of irreversible loss from prompt mistakes or ambiguous user requests.

Static analysis

No suspicious patterns detected.