Security audit

Keyapi Pinterest

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Pinterest/KeyAPI integration, with the main risk that its setup can store a KeyAPI token in your shell profile.

Install only if you intend to use KeyAPI for Pinterest API workflows and are comfortable providing a KeyAPI token locally. Avoid passing the token with --token; prefer a safer local environment or secret-store workflow when available, and review or remove the managed KEYAPI_TOKEN block from your shell profile if you no longer use the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script persistently modifies the user's shell startup profile to store KEYAPI_TOKEN and activation instructions. While this is a common convenience pattern for CLI setup, it exceeds the narrow Pinterest analysis scope and creates a lasting change to the user's environment that can affect future shells and increase secret exposure if the profile is later read, synced, or inspected.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The script automatically detects, reads, creates directories for, and writes to shell startup files such as .zshrc, .bashrc, .profile, or PowerShell profiles. That file-system access is broader than necessary for performing Pinterest data discovery and introduces risk of unintended persistence, profile corruption, or abuse if similar logic were repurposed to inject additional commands.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script reads KEYAPI_TOKEN not only from the current process environment but also from the user's shell profile file, parsing a managed block from .zshrc/.bashrc/.profile or a PowerShell profile. That expands the skill's access beyond the immediate execution context and creates unnecessary exposure to secrets stored on disk, which is risky in an agent-skill setting because the tool can silently consume credentials the user did not explicitly provide for this run.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The rule explicitly directs the agent to write full API responses to temporary or workspace files for internal analysis, which can persist sensitive third-party data beyond the immediate task. Even though it advises not to present temp files to users and to clean them up when practical, it lacks strict safeguards such as mandatory deletion, redaction, or user consent, so retrieved Pinterest/KeyAPI data may remain on disk and be exposed to other processes, users, or later workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The token is accepted either via --token on the command line or through readline question input, which does not mask input and may visibly echo the secret on screen. Command-line arguments can also be exposed through shell history, process listings, logs, or telemetry, making accidental credential disclosure likely.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/keyapi-api.mjs:127

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/setup-and-auth.md:42