Api Integration Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it asks for command execution and file-writing authority beyond a basic API helper and gives broad, under-scoped usage guidance.

Review before installing. Use this only in a constrained workspace, avoid granting administrator privileges, do not let it run arbitrary commands or write files unless you explicitly asked for that, and bind API keys to known trusted API hosts rather than generic URLs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:141

Finding

Unrestricted API Endpoint Enables Server-Side Request Forgery and Credential Forwarding

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:141-148
Vulnerability Type: Unrestricted outbound request target
Risk Level: High

Vulnerable Code

python

import requests
# ...
def call_api(endpoint, method='GET', data=None, headers=None):
    response = requests.request(
        method=method,
        url=endpoint,
        json=data,
        headers=headers
    )
    response.raise_for_status()
    return response.json()

Technical Analysis

The generic API wrapper sends a request to the caller-controlled endpoint without validating its scheme, hostname, resolved address, port, or redirect destination. If untrusted input can influence this parameter, the function becomes a server-side request forgery primitive.

An attacker could direct the agent toward loopback addresses, private network services, link-local addresses, or cloud instance metadata endpoints. Because the function also accepts arbitrary headers, authentication credentials intended for a legitimate API may be forwarded to an attacker-controlled destination.

URL validation based only on the original hostname would be insufficient because redirects and DNS resolution could still lead to prohibited addresses. Validation must cover both the initial URL and every redirect destination.

Attack Path

1. An attacker supplies an API integration request containing an internal or attacker-controlled URL.
2. The agent passes that URL to call_api() as endpoint.
3. The function invokes requests.request() without destination validation.
4. The request reaches an internal service, cloud metadata endpoint, or attacker-operated server.
5. If authorization headers were supplied, they are transmitted to the selected destination.
6. The response may expose internal service data or credentials to the attacker through the agent's output.

Impact Assessment

Successful exploitation may permit access to network reso ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

• Accept only HTTPS URLs unless another protocol is explicitly required.
• Maintain an explicit allowlist of permitted API hostnames and ports.
• Resolve hostnames before connecting and reject loopback, link-local, private, multicast, and reserved IP ranges.
• Revalidate the resolved address at connection time to reduce DNS rebinding risk.
• Disable redirects where possible. Otherwise, validate every redirect destination before following it.
• Do not accept arbitrary caller-provided authentication headers. Construct credentials internally for the approved destination.
• Bind each credential to a specific hostname and never forward it when the destination host changes.
• Apply outbound firewall or proxy rules so the agent cannot reach metadata services or unrelated internal networks.
• Sanitize response data before returning it to prevent inadvertent disclosure of credentials or internal information.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:141

Finding

HTTP Request Examples Omit Connection and Read Timeouts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:141-148
Vulnerability Type: Unbounded outbound HTTP request duration
Risk Level: Medium

Vulnerable Code

python

import requests
# ...
def call_api(endpoint, method='GET', data=None, headers=None):
    response = requests.request(
        method=method,
        url=endpoint,
        json=data,
        headers=headers
    )
    response.raise_for_status()
    return response.json()

A second example at SKILL.md:159-164 has the same issue:

python

response = requests.get(
    'https://api.example.com/v1/users',
    headers={'Authorization': 'Bearer your_api_key_here'}
)
response.raise_for_status()
data = response.json()

Technical Analysis

Python's requests library does not impose a timeout unless one is supplied explicitly. Both examples can therefore wait indefinitely during connection establishment or while receiving response data.

A stalled or malicious API server can retain connections without completing the response. In an agent, worker, or batch-processing environment, repeated stalled requests may consume execution slots, sockets, memory, and other resources.

Although raise_for_status() handles HTTP error status codes, it does not limit request duration or handle a server that never completes an HTTP response.

Attack Path

1. The agent is instructed to call a slow, unavailable, or attacker-controlled API endpoint.
2. The endpoint accepts the connection but delays or never completes its response.
3. The request remains blocked because no connection or read timeout is configured.
4. Repeated requests consume available workers or execution capacity.
5. Legitimate tasks are delayed or prevented from completing.

Impact Assessment

Exploitation can cause denial of service for the current agent task and, in shared worker environments, may reduce or exhaust processing capacity for other ...[truncated 176 chars]

Remediation

View remediation

Remediation Suggestions

• Configure explicit connection and read timeouts for every request, for example:

  python

  response = requests.request(
      method=method,
      url=endpoint,
      json=data,
      headers=headers,
      timeout=(5, 30)
  )
  

• Catch requests.Timeout, requests.ConnectionError, and related request exceptions.

• Apply a strict overall task deadline in addition to per-request timeouts.

• Use retries only for transient failures and safe, idempotent operations.

• Cap retry attempts and use exponential backoff with jitter.

• Limit response body size and concurrent outbound requests.

• Add cancellation support so abandoned agent tasks do not retain network resources.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:397

Finding

Troubleshooting Guidance Encourages Unnecessary Administrator Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:397
Vulnerability Type: Unsafe privilege-escalation guidance
Risk Level: Medium

Vulnerable Content

markdown

| Insufficient permissions | The current user lacks read/write permission | Check file permissions and run as administrator |

The same guidance is duplicated at SKILL.md:413.

Technical Analysis

The troubleshooting guidance recommends running the operation as an administrator whenever a file permission problem occurs. This elevates the entire agent or command instead of identifying the specific resource and granting only the minimum permission required.

The skill declares execution and write capabilities and is intended to process user-directed integrations. Running such operations with administrative authority expands the consequences of unsafe commands, malicious input, compromised dependencies, or ordinary implementation errors.

This is not an automatic privilege-escalation exploit in the supplied project. It is unsafe operational guidance that may cause an operator to cross a least-privilege boundary unnecessarily.

Attack Path

1. A task encounters a file permission error.
2. The operator follows the skill's troubleshooting guidance.
3. The agent, terminal, or integration process is restarted with administrator or root privileges.
4. A subsequent untrusted command, file operation, or API-driven task executes in that elevated context.
5. The operation can modify resources that were previously protected from the ordinary user account.

Impact Assessment

If the guidance is followed, subsequent agent operations may inherit administrator-level access. Depending on the operating system and execution environment, this could permit modification or deletion of protected files, access to other users' data, system-wide configuration changes, or installation of software.

The attainable scope is limited by the privileges granted ...[truncated 119 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the blanket instruction to run the agent or command as administrator.
• Diagnose the exact file, directory, device, or service requiring access.
• Grant narrowly scoped read or write permission only to the required resource.
• Prefer dedicated, unprivileged service accounts for automated integrations.
• Correct resource ownership or access-control entries rather than elevating the entire process.
• If a privileged operation is unavoidable, isolate it in a small, audited helper with a fixed command and validated arguments.
• Never allow user-controlled commands, paths, URLs, or scripts to execute in an elevated context.
• Document how to restore permissions and record privileged actions in an audit log.
• Apply the same correction to the duplicated guidance at line 413.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Write access is not justified by a basic API helper and expands the blast radius from read-only guidance into filesystem modification. A malicious prompt or accidental activation could cause file overwrite, data corruption, or persistence of sensitive API material into insecure locations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Write access is not justified by a basic API helper and expands the blast radius from read-only guidance into filesystem modification. A malicious prompt or accidental activation could cause file overwrite, data corruption, or persistence of sensitive API material into insecure locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises exec and write capabilities without a prominent warning about the potential impact on the local system and files. In an agent setting, users may assume a benign documentation helper, while the actual toolset can perform materially risky actions if prompted or misactivated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly states rate-limit handling with 429 exponential backoff is a paid-only feature, and the capability boundary reiterates that it is absent. Later sections contradict this by recommending that users 'enable retry backoff strategy' when rate-limited, implying support for a feature earlier declared unavailable.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

import requests
# ...
response = requests.get(
    'https://api.example.com/v1/users',
    headers={'Authorization': 'Bearer your_api_key_here'}
)
response.raise_for_status()

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition is so broad that the skill could auto-activate for general development tasks unrelated to API integration. In context, this is more dangerous because the skill also declares exec and write tools, so accidental activation could expose users to unnecessary command execution or file modification risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is marketed as a basic API integration helper, but later documentation expands its scope into file processing, command execution, and broader automation workflows. This mismatch can mislead users and reviewers about the actual power of the skill, increasing the chance that high-risk capabilities are enabled and invoked without appropriate scrutiny.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Earlier sections say connection timeout and connection-error handling are advanced, paid-only capabilities, and the free version only provides raise_for_status(). Later troubleshooting tables include timeout-specific diagnosis and remediation guidance, which suggests support for handling scenarios previously declared out of scope.

Content

No source excerpt is available for this finding.