Security audit

rapidapi

Security checks for vulnerabilities and agentic risk

Overview

This is a real RapidAPI helper, but it can send the user’s RapidAPI key to non-RapidAPI or caller-chosen hosts by default.

Review before installing. This skill should not be used with a valuable RapidAPI key until non-RapidAPI hosts are disabled by default, arbitrary direct calls are removed or strictly allowlisted, bundled non-RapidAPI templates are verified or removed, and the documentation clearly warns that request data and credentials are sent to external services. Rotate the RapidAPI key if this implementation has already been used with untrusted direct-call input or unverified templates.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:13
Finding: RapidAPI credential is forwarded to arbitrary caller-controlled hosts by default
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/toktok_user_info.json:1
Finding: Bundled TokTok actions send the RapidAPI credential to a host outside the Skill’s RapidAPI policy
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lib/engine.js:3
Finding: Documented method and payload-size security controls are not implemented
Content: View full analysis
{ let data = ""; process.stdin.setEncoding("utf8"); process.stdin.on("data", (chunk) => (data += chunk)); process.stdin.on("end", () => resolve(data)); process.stdin.on("error", reject); }); } ``` ### Technical Analysis The README claims a method allowlist and body-size limits, but neither control is implemented. The request method is converted to uppercase and passed directly to `fetch` without checking it against an approved set. This provides broader outbound HTTP capabilities than the documentation represents and permits unexpected methods where accepted by the runtime and destination. Request bod ...[truncated 1479 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description describes a network/API integration component with action registration and a generic invocation mechanism. The supplied code does not implement any API client behavior, action registration, triggering, or external calls. It only provides a local object-path lookup helper. This is not merely a supporting detail in context because, based on the supplied chunk alone, the code's behavior is materially different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README explicitly promotes a universal direct-call entrypoint and even shows configuration with allowNonRapidApiHosts: true, but it does not clearly warn that user-supplied parameters may be transmitted to arbitrary third-party services. In an agent setting, this increases the risk of unintended data exfiltration, especially if prompts, secrets, personal data, or internal URLs are passed through ad-hoc API calls without strong host controls or user consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises use of an environment secret and clearly enables outbound network access to arbitrary RapidAPI hosts, but it does not declare an explicit tool scope such as allowed tools or permissions. That weakens containment and reviewability, making it easier for a broadly invocable skill to exfiltrate data or use credentials in ways the user did not clearly authorize.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description explains functionality but does not prominently warn users that it sends data to external RapidAPI endpoints and uses an API credential from the environment. That omission can cause users or upstream agents to pass sensitive inputs without understanding that the data will leave the local environment and be transmitted to third-party services.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example configuration explicitly enables requests to non-RapidAPI hosts, which expands the skill from a constrained RapidAPI client into a generic outbound HTTP caller. In agent contexts, this can enable SSRF-style access to unintended internal or attacker-controlled endpoints and weakens the trust boundary implied by the skill's description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file reads an API credential from options or environment variables and uses it to make outbound HTTP requests, including a direct-call wrapper that accepts arbitrary input for the request. There is no confirmation prompt, logging, comment, or docstring in this file warning that the skill will access credentials and transmit request data to external services.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code enables non-RapidAPI hosts by default via ALLOW_NON_RAPIDAPI_HOSTS || "true", which means a supposed RapidAPI client will permit arbitrary external destinations unless explicitly disabled. Combined with dynamic request construction, this broadens the trust boundary and makes outbound request abuse substantially easier.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The exported callRapidApi direct entrypoint bypasses the registry/template allowlist and accepts arbitrary request input, enabling callers to choose host, path, method, headers, and payload. In a skill meant to be template-driven, this defeats the main safety boundary and can be abused for SSRF-like outbound access, unintended third-party requests, or use of the bound RapidAPI credential against unreviewed endpoints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function places the RapidAPI key into the X-RapidAPI-Key header for every request, which is a credential-bearing operation. There is no visible disclosure in this file explaining that a sensitive API key is attached to outbound requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code performs an outbound HTTP request using caller-supplied URL components and headers, which can transmit user or system data to an external service. In this file there is no confirmation prompt, logging, print statement, or comment/docstring warning that the function sends data off-box.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The invocation guidance says to prefer this skill whenever a task involves RapidAPI endpoints or template-defined actions, which is broad enough to trigger use in many loosely related situations. Because the skill can make external requests with a credential and includes a universal direct-call entrypoint, over-broad routing increases the chance of unintended data transfer or unreviewed third-party API use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code writes a JSON file to disk with fs.writeFile, which is a safety-relevant operation under the code-file warning criteria. Although the script reports success afterward, there is no confirmation prompt and no comment or docstring near the write explaining that running the script will create or overwrite a file in ./templates.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.