TinyOps Automation Preflight

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but its bundled Action/CLI has under-disclosed credential and URL-handling risks that users should review before installing.

Install only if you are comfortable with a paid third-party page-analysis service receiving the target URL and with the bundled Action/CLI handling a RapidAPI key. Avoid setting AUTOMATION_PREFLIGHT_API_BASE_URL outside controlled tests, do not submit private or credential-bearing URLs, and prefer pinned commits or exact release versions when installing or using the Action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:78

Finding

RapidAPI Credential Exfiltration Through Attacker-Controlled API Base URL

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:25

Finding

Public-Target Validation Accepts Private and Credential-Bearing URLs

Content

View full analysis

2048) throw new Error('url exceeds 2048 characters'); return target.toString(); } ``` The accepted value is transmitted to the hosted service: ```js const target = validateTarget(url); const normalizedMode = String(mode).toLowerCase(); if (!['analyze', 'acceptance-pack'].includes(normalizedMode)) { throw new Error('mode must be analyze or acceptance-pack'); } if (objective.length > 500) throw new Error('objective exceeds 500 characters'); const endpoint = '/rapidapi/analyze'; const body = { url: target, ...(normalizedMode === 'acceptance-pack' ? { mode: normalizedMode } : {}), ...(objective ? { objective } : {}), }; const response = await fetch(`${apiBase}${endpoint}`, { ``` ### Technical Analysis Despite describing the input as a “public HTTP or HTTPS URL,” `validateTarget` only checks the URL syntax, protocol, and original string length. It does not reject: - Embedded usernames or passwords. - Loopback hosts such as `localhost` or `127.0.0.1`. - Private IPv4 or IPv6 ranges. - Link-local addresses such as `169.254.169.254`. - Cloud metadata destinations. - Reserved or special-use network ranges. - DNS names that resolve to private or reserved addresses. This conflicts with the safeguards documented in `SKILL.md`, which prohibit private-network and credential-bearing URLs. The local client transmits any accepted URL to a third-party service. The repository states that the hosted API independently rejects private targets, but that ser ...[truncated 1540 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:49

Finding

Untrusted Service Response Can Inject GitHub Action Outputs and Summary Content

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Documentation Recommends Executing Mutable, Unpinned Remote Packages

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/action.test.js (reported line 18)May include surrounding context.

js

return new Promise((resolve, reject) => {
    const child = spawn(process.execPath, ['index.js'], {
      cwd: ROOT,
      env: { ...process.env, ...env },
      stdio: ['ignore', 'pipe', 'pipe'],
    });
    let stdout = '';

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/action.test.js (reported line 34)May include surrounding context.

js

return new Promise((resolve, reject) => {
    const child = spawn(process.execPath, ['index.js'], {
      cwd: ROOT,
      env: { ...process.env, ...env },
      stdio: ['ignore', 'pipe', 'pipe'],
    });
    let stdout = '';

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx skills add tinyopsstudio/automation-integration-preflight-action without pinning an immutable version or commit. This creates a supply-chain risk because the package or referenced installer behavior could change over time, causing users to execute unexpected code when installing the skill; in the context of an agent skill install path, this is more dangerous because installation typically grants immediate code execution on the operator's machine or runner.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx --yes github:tinyopsstudio/automation-integration-preflight-action executes code fetched directly from GitHub without pinning to a commit SHA or other immutable reference. That exposes users to repository compromise, tag movement, or future malicious changes, and the risk is heightened here because the README explicitly encourages direct execution from a public repository and requires an API key in the environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to perform outbound network requests, including reading an OpenAPI document and calling paid external endpoints, but it does not declare any explicit tool scope or allowed-tools boundary. This creates a governance and safety gap: an agent runtime may permit broader network or environment access than the skill actually needs, increasing the chance of unintended data exposure, unauthorized external calls, or misuse of ambient credentials.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The package metadata describes the skill as a generic 'CLI and GitHub Action for bounded automation integration preflight checks,' which is broader and materially different from the manifest's narrower purpose of auditing a public webpage via the TinyOps paid x402 service with explicit exclusions. This creates a semantic mismatch about what the skill is for and how it operates.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test/action.test.js:16

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:11