APITester Agent-Driven API Testing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:33 PM UTC
• Version: 1.0.0

Overview

This API-testing skill matches its stated purpose, but it gives the agent broad ability to send arbitrary API requests without clear guardrails.

Install only if you intentionally want the agent to run API calls from your environment. Use sandbox or staging endpoints, avoid production credentials unless necessary, review generated tests before running POST/PUT/PATCH/DELETE, and do not run tests from untrusted files or prompts without checking the target URLs and headers.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/api-tester.js:41

Finding

Unrestricted outbound requests enable server-side request forgery

Content

View full analysis

Vulnerability Details

File Location: src/api-tester.js, lines 41 and 69-76
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: High

Vulnerable Code

js

const url = this._interpolate((this.baseUrl + (test.url || '')));

js

_request(url, method, body, headers) {
  const client = url.startsWith('https') ? https : http;
  const parsed = new URL(url);
  return new Promise((resolve, reject) => {
    const req = client.request({
      hostname: parsed.hostname, port: parsed.port, path: parsed.pathname + parsed.search,
      method, headers: { 'Content-Type': 'application/json', ...headers }, timeout: 10000
    }, res => {

Technical Analysis

The destination URL is derived directly from a test definition and interpolated variables. The implementation then sends a request to the parsed hostname and port without applying an origin allowlist, protocol validation, DNS or IP-address validation, or restrictions for loopback, private, link-local, and cloud metadata networks.

The client selection only checks whether the string starts with https; all other parseable URL forms are assigned to the HTTP client. Although new URL() rejects many unsupported inputs, the code should explicitly permit only http: and https: rather than relying on indirect behavior.

Request methods, headers, and bodies are also test-configurable. Consequently, an attacker who can influence test definitions can issue authenticated or state-changing requests from the network context of the process. Response bodies are returned through test results, allowing readable internal endpoints to disclose their content.

Attack Path

1. An attacker supplies or modifies a test definition accepted by the API tester.
2. The attacker sets test.url, or an interpolated URL component, to an internal destination such as a loopback service, private-network host, or link-local metadata endpoint.
3. The atta ...[truncated 1386 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly reject every protocol other than http: and https:.
2. Require a destination allowlist containing approved hostnames, ports, and schemes. Prefer exact origin matching over suffix or substring checks.
3. Resolve destination hostnames before connecting and reject all loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
4. Validate every resolved address and ensure the validated address is the address used for the connection to reduce DNS-rebinding and time-of-check/time-of-use risks.
5. Block known metadata destinations, including link-local metadata addresses and provider-specific metadata hostnames.
6. Apply the same validation to every redirect if redirect support is introduced.
7. Require explicit user approval when a test introduces a new origin or sensitive method.
8. Do not forward global authorization, cookie, or API-key headers across origins. Bind sensitive headers to explicitly approved origins.
9. Consider running the tester in a sandbox with outbound firewall rules that deny internal and metadata networks.
10. Add automated tests covering loopback, private IPv4, private IPv6, link-local, encoded IP representations, DNS rebinding, nonstandard ports, and unsupported schemes.

T09 · Insecure Skill Coding Practices

Warning

• Location: src/api-tester.js:77

Finding

Unbounded response buffering permits memory exhaustion

Content

View full analysis

Vulnerability Details

File Location: src/api-tester.js, lines 77-79
Vulnerability Type: Uncontrolled Resource Consumption
Risk Level: Medium

Vulnerable Code

js

}, res => {
  let data = '';
  res.on('data', c => data += c);
  res.on('end', () => resolve({ statusCode: res.statusCode, headers: res.headers, body: data }));
});

Technical Analysis

The implementation appends every response chunk to a single in-memory string without enforcing a maximum response size. A remote server can therefore cause the process to retain an arbitrarily large response.

The configured ten-second request timeout does not provide an adequate size control. In Node.js, socket timeouts generally concern inactivity; an endpoint that continuously transmits data can remain active while memory usage keeps increasing. String concatenation and character decoding may also create additional temporary allocations beyond the raw response size.

Because tests run sequentially and complete response bodies remain in this.results, memory consumed by previous responses can remain reachable for the duration of the test run.

Attack Path

1. An attacker controls an endpoint referenced by a test or influences a tested service.
2. The endpoint returns a very large response or continuously emits chunks frequently enough to avoid an inactivity timeout.
3. The data handler concatenates every chunk into the data string.
4. No byte limit causes the accumulated body and related allocations to consume increasing amounts of heap memory.
5. The Node.js process experiences garbage-collection pressure, severe performance degradation, or termination due to heap exhaustion.
6. If several large responses complete, retaining their bodies in this.results can compound resource consumption.

Impact Assessment

Exploitation does not grant additional privileges or direct code execution. Its primary impact is availability within t ...[truncated 433 chars]

Remediation

View remediation

Remediation Suggestions

1. Define a conservative, configurable maximum response size.
2. Count raw bytes received in every data event rather than relying on the resulting string length.
3. Immediately destroy the response or request and reject the operation when the limit is exceeded.
4. Validate Content-Length when present, while still enforcing the runtime byte counter because the header can be absent or dishonest.
5. Stream large responses to a bounded parser or controlled output sink instead of retaining them entirely in memory.
6. Store only the portion of a response required for assertions and reporting, such as a truncated preview.
7. Avoid retaining full response bodies in this.results unless explicitly requested.
8. Add total-duration, inactivity, and overall test-suite limits in addition to the response-size limit.
9. Run the process with memory and CPU limits so a single test cannot exhaust shared host resources.
10. Add regression tests for oversized declared responses, chunked responses, compressed responses, and indefinitely streaming endpoints.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

md

tests:
  - name: "Get all users"
    method: GET
    url: "https://api.example.com/users"
    expect:
      status: 200
      body_contains: "users"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

tests:
  - name: "Get all users"
    method: GET
    url: "https://api.example.com/users"
    expect:
      status: 200
      body_contains: "users"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

tests:
  - name: "Get all users"
    method: GET
    url: "https://api.example.com/users"
    expect:
      status: 200
      body_contains: "users"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

tests:
  - name: "Get all users"
    method: GET
    url: "https://api.example.com/users"
    expect:
      status: 200
      body_contains: "users"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README includes a POST example that creates a user against a realistic-looking HTTPS API endpoint, but it does not clearly warn that example tests may perform real state-changing operations when pointed at live environments. In an agent-driven testing tool, users may copy examples directly, increasing the risk of unintended writes, test data pollution, or changes in production systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says users can 'Define tests in plain English, run them' and presents the tool as an 'Agent-driven Postman alternative,' but it does not specify concrete trigger phrases, activation boundaries, or exclusion conditions. For a markdown skill description, this is ambiguous enough that common requests about testing APIs could unintentionally match the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs outbound HTTP/HTTPS requests and sends interpolated request bodies and merged headers, which can include user or system data. While the file contains implementation comments, it lacks any user-facing warning, confirmation, or disclosure that API tests will transmit supplied data to remote endpoints.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Static analysis

No suspicious patterns detected.