Security audit
Security checks across malware telemetry and agentic risk
This looks like a legitimate Pancake API helper, but it needs review because some high-impact write and token actions bypass its stated safety guard.
Install only in a trusted workspace and with Pancake credentials you are comfortable exposing to an agent. Before use, patch the scripts to require CONFIRM_WRITE=YES for pages-generate-token and chat-plugin-send, fix url_encode to pass data as a Python argument instead of interpolating into code, avoid putting tokens in logs or chat transcripts, and treat exports, call logs, customer updates, staff assignment, uploads, and message sends as sensitive actions requiring explicit user intent.
url="${url}?${token_param}"
fi
# Build curl command
local curl_args=(-s -X "$method")
if [[ -n "$body" ]]; thenchat-plugin-send)
page_id="${1:?PAGE_ID required}"
body="$(cat)"
curl -s -X POST -H "Content-Type: application/json" -d "$body" "${PANCAKE_BASE_URL}/api/v1/pke_chat_plugin/messages?page_id=${page_id}"
;;
# Get chat plugin messages### User API (`https://pages.fm/api/v1`)
- `GET /pages` - Liệt kê pages
- `POST /pages/{page_id}/generate_page_access_token` - Tạo page access token
### Page API v2 (`https://pages.fm/api/public_api/v2`)
- `GET /pages/{page_id}/conversations` - Liệt kê conversationstitle: Pancake API Library
version: 1.0.0
description: >
API for retrieving page data, generating access tokens, and listing conversations on Pancake platform.
contact:
name: Pancake Support
url: 'https://www.pancake.biz/contact'required: true
schema:
type: string
description: Pancake user access token for authentication.
responses:
'200':
description: Successful responsetags:
- Pages
summary: Generate page_access_token
description: "Generate or refresh page_access_token by the admin's access_token of page. Page Access Token used to authenticate public APIs on behalf of a Page. The page's admin can retrieve this token from the Pancake interface by going to: Page's settings → Tools. This token does not expire unless it is manually deleted or renewed. An API key is a token that you provide when making API calls. Include the token in a query parameter called page_access_token."
security:
- UserAccessToken: []
parameters:required: true
schema:
type: string
description: Pancake user access token with admin rights to the page.
responses:
'200':
description: Token generated successfullyrequired: true
schema:
type: string
description: Access token of the page for authentication.
- name: page_id
in: path
required: truerequired: true
schema:
type: string
description: Access token of the page used for authentication.
requestBody:
required: true
content:required: true
schema:
type: string
description: Access token of the page used for authentication.
requestBody:
required: true
content:required: true
schema:
type: string
description: Page access token
responses:
'200':
description: Success responserequired: true
schema:
type: string
description: Page access token
responses:
'200':
description: Success response63/63 vendors flagged this skill as clean.
No suspicious patterns detected.