FIND SAP API

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:21 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches a SAP spec downloader, but it also includes under-disclosed backend code generation and unsafe file-writing patterns that should be reviewed before installation.

Use Review treatment before installing. Only run this with SAP credentials you are prepared to expose to the local runtime, prefer a user-owned output directory instead of /usr/download, and do not run the backend scaffolder on untrusted OpenAPI files until code-string escaping and path containment are fixed. Pin dependencies before using it in shared, CI, or production environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scaffold_backend_from_openapi.py:127

Finding

Unescaped OpenAPI Metadata Enables Python Code Injection in Generated Modules

Content

View full analysis

Dict[str, Any]:\n''' f''' """{op.summary}"""\n''' f''' return await _invoke_operation("{op.fn_name}", path_params, query, body, headers)\n''' ) ``` ```python API_BASE = os.getenv("{env_prefix}_APIBase", "{api_base_hint}") ``` ```python endpoints.append( f'''@router.post("/{op.fn_name}", response_model=OperationResponse)\n''' f'''async def api_{op.fn_name}(request_data: OperationRequest):\n''' f''' """{op.summary}"""\n''' f''' try:\n''' f''' result = await generated_tools.{op.fn_name}(\n''' ) ``` ```python tools_py = render_tools_py(module_name_clean, env_prefix, api_base_hint, operations) api_py = render_api_py(route_prefix, module_name_clean, operations) ``` ### Technical Analysis The scaffolder treats OpenAPI metadata as trusted Python source fragments. In particular: - An operation `summary` or `description` is inserted directly into a triple-quoted Python docstring. - The server-derived `api_base_hint` is inserted directly into a double-quoted Python string. - No Python-literal encoding, AST construction, or escaping is appl ...[truncated 2015 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/import_sap_hub_spec.py:85

Finding

Category Path Traversal Allows Specification Import Outside the Intended Project Directory

Content

View full analysis

Path: category_dir = api_root / category connection_dir = category_dir / "Connection" if category_dir.exists(): if connection_dir.exists() and connection_dir.is_dir(): return connection_dir return category_dir connection_dir.mkdir(parents=True, exist_ok=True) return connection_dir ``` ```python project_root = Path(args.project_root).expanduser().resolve() api_root = project_root / "APIConnectionToSAP" if not api_root.exists(): raise FileNotFoundError(f"APIConnectionToSAP not found under {project_root}") source_file = pick_source_file(args.file, Path(args.downloads_dir).expanduser().resolve(), args.pattern) target_dir = resolve_target_dir(api_root, args.category) out_base = normalize_base_name(args.name) if args.name else normalize_base_name(source_file.stem) target_file = dedupe_target_path(target_dir / f"{out_base}{source_file.suffix.lower()}") if args.mode == "copy": shutil.copy2(source_file, target_file) else: shutil.move(str(source_file), str(target_file)) ``` ### Technical Analysis The `--category` value is appended directly to `api_root` without validating separators, absolute paths, or `..` traversal components. The resulting path is not resolved and checked for containment beneath `APIConnectionToSAP`. For example, a category such as `../../attacker-target` causes the effective destination to escape the intended API category tree. If the destination does not exist, `mkdir(parents=True)` creates it. The selected source file is subsequently copied or moved into that location. Although the output base name is normalized, this does not protect the parent directory selected through `--category`. ### Att ...[truncated 1337 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scaffold_backend_from_openapi.py:365

Finding

Unvalidated Module Identifier Enables Generated File Placement Outside the Source Directory

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Python and Browser Dependencies Reduce Build Integrity

Content

View full analysis

=1.40.0 PyYAML>=6.0 ``` ```bash python3 -m pip install playwright python3 -m playwright install chromium ``` The same unpinned installation procedure appears in the quick-start instructions: ```bash python3 -m pip install playwright python3 -m playwright install chromium ``` ### Technical Analysis The requirements use lower-bound constraints rather than exact reviewed versions. As a result, a future installation may retrieve any newer Playwright or PyYAML release accepted by the package resolver. The documentation also instructs users to install the latest resolvable Playwright package and then download its Chromium runtime without an application-controlled integrity lock. This makes installations non-reproducible and prevents the audited package from identifying exactly which dependency and browser builds will execute. No malicious dependency or known vulnerable version is proven in the reviewed files. The issue is a supply-chain hardening weakness: trust is delegated to future package and browser releases that were not part of this audit. ### Attack Path 1. A user follows the installation instructions or installs from `requirements.txt` at a later date. 2. The package resolver selects a newer, unaudited dependency version because only a minimum version is specified. 3. Playwright downloads the browser revision associated with the selected package. 4. If an upstream release, distribution account, package index path, mirror, or browser artifact is compromised, malicious installation or runtime code executes under the installing user's privileges. ### Impact Assessment A compromised dependency can execute with the privileges of the user performing installa ...[truncated 431 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A large mismatch between the claimed SAP-download/authentication behavior and the actual underlying purpose can be security-relevant because it obscures what the skill really does, frustrating review and trust decisions. In a credential-handling skill, deceptive or materially inaccurate descriptions increase the chance that users execute code with secrets under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 79% confidence

Finding

A large mismatch between the claimed SAP-download/authentication behavior and the actual underlying purpose can be security-relevant because it obscures what the skill really does, frustrating review and trust decisions. In a credential-handling skill, deceptive or materially inaccurate descriptions increase the chance that users execute code with secrets under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A large mismatch between the claimed SAP-download/authentication behavior and the actual underlying purpose can be security-relevant because it obscures what the skill really does, frustrating review and trust decisions. In a credential-handling skill, deceptive or materially inaccurate descriptions increase the chance that users execute code with secrets under false assumptions.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/reliable_sap_hub_download.py (reported line 333)May include surrounding context.

python

except PermissionError as e:
        raise SystemExit(
            f"Cannot create output dir '{out_dir}' (permission denied). "
            "Create it first (for example: sudo mkdir -p /usr/download && sudo chown \"$USER\":staff /usr/download) "
            "or pass --output-dir to a writable path."
        ) from e

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The browser is launched with flags that disable normal secure credential-store behavior and force a basic password store while using a persistent profile directory under /tmp. In a multi-user or weakly isolated environment, this can increase the chance that session artifacts, cookies, or saved secrets are stored less securely and exposed to other local users or later processes.

Content

Scanner excerpt · scripts/reliable_sap_hub_download.py (reported line 362)May include surrounding context.

python

with sync_playwright() as p:
        launch_kwargs = {
            "headless": not args.headful,
            "ignore_default_args": ["--use-mock-keychain", "--password-store=basic"],
        }
        context = p.chromium.launch_persistent_context(profile_path, **launch_kwargs)
        try:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file's stated behavior is scaffolding executable backend code from arbitrary OpenAPI specs, which materially differs from the skill manifest's claimed purpose of downloading and validating SAP API specifications. In an agent skill context, this mismatch is dangerous because it introduces undeclared code-generation capability that can expand the attack surface, create new privileged execution paths, and evade operator expectations and review boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script generates runnable FastAPI endpoints and HTTP client code under src/, turning external OpenAPI content and user-supplied parameters into new executable application surface. That capability is not justified by the declared downloader role, and in a security-sensitive agent environment it can be abused to smuggle in unintended networked functionality and authenticated request paths under trusted project code.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scaffold_backend_from_openapi.py (reported line 233)May include surrounding context.

python

rel = relative_path.lstrip("/")

    if not base:
        raise ValueError("BASEURL is empty. Set BASEURL in .env")

    if api_base:
        return f"{{base}}/{{api_base}}/{{rel}}"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises use of sensitive capabilities including environment credentials, file writes, and network/browser automation, but does not declare an explicit tool/permission scope. That weakens reviewability and can allow broader-than-expected execution in agent environments, especially since the skill handles SAP credentials and writes to a fixed filesystem path.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The documentation instructs users to run commands with sudo to create and chown a system directory. Encouraging privilege escalation in setup steps is dangerous because users may execute unreviewed commands as root, and a fixed privileged path like /usr/download can create ownership, tampering, or broader host-impact issues in shared environments.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

If needed:

bash

sudo mkdir -p /usr/download
sudo chown "$USER":staff /usr/download

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Using sudo chown on a fixed directory changes filesystem ownership with elevated privileges and can expose a shared location to unintended modification. In agent or multi-user environments, this can allow tampering with downloaded artifacts or misuse of a system-level path for persistence or data staging.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash

sudo mkdir -p /usr/download
sudo chown "$USER":staff /usr/download

5. Maintain login credentials via environment variables:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

In this manifest file, the notes field broadly describes 'reliable SAP API specification download' but does not define when the skill should be invoked, what exact user requests should trigger it, or any exclusion conditions. For manifest files, missing specificity around activation scope can lead to unintended invocation overlap with general SAP or download-related requests.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/quickstart.md (reported line 8)May include surrounding context.

bash

python3 -m pip install playwright
python3 -m playwright install chromium
sudo mkdir -p /usr/download
sudo chown "$USER":staff /usr/download
export SAP_HUB_USERNAME='your_user'
export SAP_HUB_PASSWORD='your_password'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The quickstart instructs changing ownership of a root-level directory to the invoking user with sudo chown. In this skill's context, downloaded API specs are later written there, so making a shared system path user-controlled can create integrity and trust issues, especially on multi-user systems or when other tooling assumes /usr content is administrative and trusted.

Content

Scanner excerpt · references/quickstart.md (reported line 9)May include surrounding context.

python3 -m pip install playwright python3 -m playwright install chromium sudo mkdir -p /usr/download sudo chown "$USER":staff /usr/download export SAP_HUB_USERNAME='your_user' export SAP_HUB_PASSWORD='your_password'

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quickstart tells users to export SAP credentials directly into environment variables without any warning about secret handling, shell history exposure, process visibility, or use of a safer secret store. In the context of a downloader that authenticates to SAP Business Accelerator Hub, these are real credentials for an external service, so normalizing insecure handling increases the chance of credential leakage and unauthorized API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code accesses sensitive credentials from environment variables and later uses them for automated login, which is a safety-relevant operation under the rule. While the module docstring mentions environment-variable login, there is no user-facing disclosure such as a prompt, visible log, or explicit runtime warning when credentials are consumed.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/reliable_sap_hub_download.py (reported line 333)May include surrounding context.

python

except PermissionError as e:
        raise SystemExit(
            f"Cannot create output dir '{out_dir}' (permission denied). "
            "Create it first (for example: sudo mkdir -p /usr/download && sudo chown \"$USER\":staff /usr/download) "
            "or pass --output-dir to a writable path."
        ) from e

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The generated tools module silently uses environment-derived credentials to perform authenticated outbound HTTP requests, but the scaffolder does not prominently disclose that generated code will do so. In an agent setting, hidden credential use is risky because users or operators may trigger generated modules without realizing they will access protected systems using ambient secrets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes generated modules directly into the project's src tree instead of the manifest-declared /usr/download location for downloaded specifications. Writing into source directories is riskier because it persists behavioral changes to trusted code, enabling accidental or unauthorized expansion of the running application rather than producing passive artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest sets 'defaultBrowser' to 'chromium', which is a natural-language/configured constraint on execution environment without any indication of user opt-in or justification. Under the policy rule, forced tool or locale-style constraints should be documented or optional unless clearly required for a region- or platform-specific purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency specification uses a lower-bound constraint only, which makes builds non-reproducible and allows future package releases to be installed without review. In a skill that performs authenticated browser automation against SAP and processes downloaded specs, this increases supply-chain risk because a compromised or breaking upstream release could be pulled in automatically.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.40.0
PyYAML>=6.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

PyYAML is also unpinned, so the installed version may vary across environments and time, preventing reliable assurance about security posture. This is more concerning here because the skill explicitly downloads and validates JSON/YAML/API specification artifacts, making YAML parsing part of the likely attack surface if untrusted content is ever processed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

playwright>=1.40.0
PyYAML>=6.0

Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The manifest references PyYAML without pinning a version even though multiple known advisories exist for some PyYAML releases. Because the skill handles downloaded spec content and may parse YAML artifacts, an affected PyYAML version could expose the runtime to unsafe deserialization or input-handling issues if malicious or malformed files are processed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.