Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward HTTP helper skill whose network access is broad but clearly tied to its stated purpose.
Install this only if you want agents to make user-directed HTTP requests. Review destinations before sending requests, avoid placing real secrets in examples or logs, and only send Authorization headers or sensitive bodies to APIs you trust.
The skill explicitly enables arbitrary outbound HTTP requests with custom headers and bodies, but the description does not warn users that invoking it can transmit data to external systems. In an agent context, this omission is risky because users may not realize sensitive prompts, tokens, or local data could be sent off-platform to attacker-controlled endpoints.
The example includes an Authorization bearer token in default headers without any accompanying guidance on secret handling. This normalizes passing credentials into arbitrary HTTP requests and may lead users or downstream agents to expose API keys or tokens to unintended endpoints or logs.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// GET
const resp = await client.get("https://api.example.com/items");
// POST with JSON body
const resp = await client.post("https://api.example.com/items", {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// GET
const resp = await client.get("https://api.example.com/items");
// POST with JSON body
const resp = await client.post("https://api.example.com/items", {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// GET
const resp = await client.get("https://api.example.com/items");
// POST with JSON body
const resp = await client.post("https://api.example.com/items", {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// GET
const resp = await client.get("https://api.example.com/items");
// POST with JSON body
const resp = await client.post("https://api.example.com/items", {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// GET
const resp = await client.get("https://api.example.com/items");
// POST with JSON body
const resp = await client.post("https://api.example.com/items", {
The package description advertises a broadly generic HTTP request capability without stating any scope restrictions, allowlists, or intended trust boundaries. In an agent skill, this can enable misuse for arbitrary outbound network access, including contacting attacker-controlled endpoints, probing internal services, or exfiltrating data if higher-level controls are weak or absent.