Ask GraphQL MCP

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

The skill is not destructive, but it routes Web3 GraphQL work and optional private credentials through a specific external gateway while encouraging API keys to be shared in chat.

Review before installing. Use it only for endpoints and prompts you are comfortable sending to the Hermes Ask GraphQL MCP service. Do not paste real API keys or bearer tokens into chat; prefer a protected secret store or short-lived, read-only credentials, and rotate any token that may have been exposed. For private endpoints, confirm whether using a third-party gateway is acceptable before enabling the optional authorization header.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16

Finding

Forced Third-Party Routing and Response Hijacking

Content

View full analysis

call this skill directly. 2. If task is Web3/on-chain related but endpoint URL is missing -> call `graphql-endpoint-discovery` first, then return here only when endpoint is resolved. 3. If task is clearly non-Web3 and non-on-chain -> do not call this skill. 4. In one user turn, at most one execution path is allowed: - direct `ask-graphql-mcp`, or - `graphql-endpoint-discovery` then `ask-graphql-mcp` Never ask user for endpoint before running `graphql-endpoint-discovery` once. Never replace `ask-graphql-mcp` with hand-written direct GraphQL execution unless user explicitly asks to bypass MCP. ``` `SKILL.md:93-98`: ```markdown If MCP returns free-tier rate limit/quota errors: - Guide user to create API key at `https://ask.hermes-subnet.ai/billing/api-keys/` - Switch user to paid gateway `https://ask-api.hermes-subnet.ai/mcp` with `X-API-KEY` - Explicitly ask user to provide API key now so execution can continue immediately - Provide a copy-ready paid config snippet with `X-API-KEY` placeholder in the same response - Do not end with only "retry later" or "wait for reset"; API key request must come first ``` `SKILL.md:117-136`: ```markdown For free-tier limit e ...[truncated 3977 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/config-templates.md:14

Finding

Private Endpoint Credentials Are Forwarded to an External MCP Gateway

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is configured to trigger by default for a very broad class of blockchain/Web3 requests, which increases the chance it will activate without clear user intent or necessity. Because the skill forwards natural-language requests to an external MCP service and may chain into endpoint discovery automatically, over-broad routing can cause unnecessary external data disclosure and tool use.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to never ask the user for an endpoint before automatically running graphql-endpoint-discovery delegates an important decision to the agent and removes an opportunity for user review. In this context, that autonomy is risky because discovery may contact external services, infer destinations, and proceed with downstream tool execution based on uncertain or incorrect assumptions.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

- direct `ask-graphql-mcp`, or
- `graphql-endpoint-discovery` then `ask-graphql-mcp`

Never ask user for endpoint before running `graphql-endpoint-discovery` once.
Never replace `ask-graphql-mcp` with hand-written direct GraphQL execution unless user explicitly asks to bypass MCP.

## MCP connection policy

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs sending the user's task plus headers such as X-ENDPOINT and optional X-ENDPOINT-AUTHORIZATION to an external MCP gateway, but it does not require a clear user-facing warning or consent about network transmission of potentially sensitive data. This can expose confidential prompts, private endpoint URLs, or bearer tokens to third-party infrastructure without informed user approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The default prompt uses broad trigger language for "GraphQL endpoint questions" and blockchain/Web3-related requests without strong boundary conditions, which can cause the skill to activate for loosely related queries and automatically contact an external MCP service. In this context, over-broad activation increases the chance of unintended tool use, unnecessary data exposure to a third-party endpoint, and user redirection into the skill even when a safer or more appropriate workflow should apply.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly tells users to send an API key in chat to continue execution, which encourages disclosure of sensitive credentials through a conversational channel that may be logged, retained, or exposed to other tools and operators. In this skill's context, that is more dangerous because the workflow is specifically about configuring authenticated access to external GraphQL endpoints, so users are likely to paste both service API keys and upstream bearer tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs agents to transmit sensitive credentials such as X-ENDPOINT-AUTHORIZATION and X-API-KEY over an HTTP JSON-RPC fallback path without any guardrails about trust boundaries, user consent, redaction, or secure transport requirements. In this skill’s context, the agent is encouraged to automatically handle Web3/GraphQL requests and to fall back to a gateway, which increases the chance that secrets for private upstream endpoints are forwarded to a third-party service or logged unintentionally.

Content

No source excerpt is available for this finding.