Fabric.co API skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:49 AM UTC
• Version: 1.0.1

Overview

This Fabric API skill is mostly purpose-aligned, but its helpers can send the user's Fabric API key to untrusted URLs and the bundled API surface includes destructive workspace actions without strong guardrails.

Review this skill carefully before installing. It needs a Fabric API key and can make lasting changes to your Fabric workspace, including deletes through the exposed API. Do not use custom FABRIC_BASE or --base values unless you fully trust the endpoint, avoid --with-key for absolute URLs, and require explicit review before delete, recover, space, or bulk operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fabric.mjs:164

Finding

Fabric API Key Can Be Exfiltrated Through a User-Controlled Base URL in the Node.js Helper

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fabric.py:84

Finding

Fabric API Key Can Be Exfiltrated Through a User-Controlled Base URL in the Python Helper

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly uses sensitive capabilities—environment access for FABRIC_API_KEY, file reads for local helper/spec files, and network access to the Fabric API—but does not declare permissions. Missing permission declarations reduce transparency and policy enforcement, making it easier for an agent or user to invoke a capability-rich skill without understanding its access scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented skill scope says it manages Fabric resources such as notepads, folders, bookmarks, files, and tags, but the OpenAPI also exposes space management and subscription/profile endpoints. This scope expansion can cause an agent or user to invoke account- or workspace-level actions they would not reasonably expect from the manifest description, increasing the risk of unintended data exposure or administrative changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises management of specific content types, but it also exposes generic bulk resource delete and recover operations. Because these actions are broad and destructive, an agent may apply them to arbitrary resources beyond what the user intended, especially when the manifest does not prominently disclose this capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The --with-key option allows the Fabric API key to be attached to any attacker-controlled absolute URL, which can exfiltrate the secret via a normal HTTP request. In an agent skill context, this is especially dangerous because an LLM or downstream tool invocation could be induced to call an arbitrary URL and leak the credential without additional safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is designed to create and modify remote Fabric resources, but it does not provide an explicit user-facing warning that actions may change persistent data in the user's workspace. Without a clear warning or confirmation requirement, an agent could perform destructive or unintended writes based on ambiguous prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The bulk delete endpoint performs destructive operations and the specification provides no warning, confirmation guidance, or guardrails. In an agent setting, lack of explicit confirmation requirements materially increases the chance of accidental mass deletion from prompt misunderstanding, ambiguous user intent, or overbroad automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The space deletion endpoint is a clearly destructive workspace-level action, yet the API description does not include warnings or confirmation expectations. In an agent-integrated skill, this omission makes accidental deletion of an entire space more plausible and more damaging than ordinary content edits.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill explicitly supports writing to a user's Fabric workspace, which introduces session persistence and lasting side effects beyond the current interaction. Persistent remote-state changes are not inherently malicious, but they are risky when guardrails such as confirmation, change preview, or rollback guidance are absent.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

# Fabric API (HTTP via Node/Python)

Use this skill when you need to **read or write content in a user's Fabric workspace** using the Fabric HTTP API (`https://api.fabric.so`).

This version avoids bash-only wrapper scripts. It ships **cross-platform** helpers:

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/fabric.mjs:96