Secure API Calls

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:43 PM UTC
• Version: 1.0.3

Overview

This skill is coherent about using Keychains as a credential proxy, but it asks users to trust a broad third-party credential service, global CLI install, and persistent machine identity for high-impact API access.

Install only if you are comfortable routing API requests through keychains.dev and storing connected credentials in its vault. Use narrowly scoped provider credentials, review approval pages carefully, avoid write-capable or financial/account APIs unless necessary, and verify how to revoke machines, providers, and local ~/.keychains/ keys before relying on it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Global Installation of an Unverifiable Third-Party Credential CLI

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:22

Finding

Broad Disclosure of API Requests to a Third-Party Credential Proxy

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

Automatic Machine Registration Creates Persistent Local Authentication Material

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill instructs installation of a third-party CLI that is specifically designed to broker credential-backed API access and create local machine identity material. While not overtly malicious, introducing an external binary with automatic machine registration and key generation expands the attack surface and creates a trust dependency on the vendor and supply chain.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Install:

text

npm install -g keychains@0.0.13

Basic usage:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

This command uses a credential-brokering CLI to make authenticated requests via a remote proxy, meaning sensitive request components are intentionally handed to an external service for token injection and forwarding. Even if the agent never sees the real token, the proxy becomes a high-trust intermediary that can access request context and act on the user's behalf.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The approval-flow example confirms that the tool can activate authenticated access after a user approval step, which is legitimate but security-sensitive behavior. In an agent ecosystem, such capability can become dangerous if approval links are socially engineered or if agents are allowed to trigger broad-scope actions once approval is granted.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

When keychains returns an approval link, show it to the user and poll:

bash

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# → "Authorize at: https://keychains.dev/approve/abc123xyz"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

Polling an approval URL is not malicious by itself, but it operationalizes a workflow for turning user authorization into automated credential use. In compromised or poorly governed agents, this could facilitate unattended execution once approval is obtained, increasing abuse potential.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# → "Authorize at: https://keychains.dev/approve/abc123xyz"

keychains wait https://keychains.dev/approve/abc123xyz --timeout 800

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The replayed command demonstrates that once approval is granted, the tool can repeatedly perform authenticated API actions without exposing raw tokens to the agent. This reduces direct secret leakage but still grants powerful delegated access that could be abused for unintended API operations if the agent is compromised or insufficiently constrained.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

-H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
# → "Authorize at: https://keychains.dev/approve/abc123xyz"

keychains wait https://keychains.dev/approve/abc123xyz --timeout 800

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This line confirms successful post-approval credential-backed execution through the proxy. The danger lies in normalizing a capability where agents can indirectly wield user credentials, making governance, auditing, and scoping essential even if tokens themselves remain hidden.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

keychains wait https://keychains.dev/approve/abc123xyz --timeout 800

keychains curl https://api.github.com/user/repos
-H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

→ works now

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The SDK is described as a drop-in replacement for fetch with automatic registration and credential handling, which lowers friction but increases the chance developers adopt powerful credential-mediated network access without sufficient review. Convenience wrappers around authentication flows can mask the sensitivity of what is being delegated to the vendor service.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

For TypeScript/Node.js agents, @keychains/machine-sdk provides keychainsFetch() — a drop-in fetch() replacement with the same automatic registration and credential handling as the CLI.

text

npm install @keychains/machine-sdk

typescript

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The explicit use of KeychainsError with approvalUrl shows the SDK exposes authorization flow control to the application, enabling apps or agents to orchestrate credential approval flows. That is not malicious, but it increases the need for anti-phishing and strict UI controls so approval URLs are not mishandled or deceptively presented.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

text

```typescript
import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The explicit use of KeychainsError with approvalUrl shows the SDK exposes authorization flow control to the application, enabling apps or agents to orchestrate credential approval flows. That is not malicious, but it increases the need for anti-phishing and strict UI controls so approval URLs are not mishandled or deceptively presented.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

text

```typescript
import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The SDK example sends an authenticated request through a service that substitutes placeholder values with real credentials server-side. This avoids exposing raw secrets to the agent, but it still centralizes credential use in an external intermediary and could enable unauthorized data access if request generation is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {
    headers: { Authorization: 'Bearer {{OAUTH2_ACCESS_TOKEN}}' },
  });
  console.log(await res.json());

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Handling approval URLs in code is part of the intended flow, but it provides a mechanism by which agents can guide users into granting delegated access. The context makes this more dangerous than a generic SDK example because the skill targets credential use across thousands of providers, amplifying blast radius if approvals are abused.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

});
  console.log(await res.json());
} catch (err) {
  if (err instanceof KeychainsError && err.approvalUrl) {
    console.log('Please approve:', err.approvalUrl);
  }
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Basic usage:

text

keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

- "List GitHub repos: `keychains curl https://api.github.com/user/repos -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'`"
- "Send Slack message: `keychains curl https://slack.com/api/chat.postMessage -X POST -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}' -H 'Content-Type: application/json' -d '{\"channel\":\"#general\",\"text\":\"Hello!\"}'`"
- "List Stripe customers: `keychains curl https://api.stripe.com/v1/customers?limit=5 -H 'Authorization: Bearer {{STRIPE_SECRET_KEY}}'`"
- "Read Gmail: `keychains curl 'https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10' -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'`"

## How It Works

Static analysis

No suspicious patterns detected.