{
  "skill_name": "api-gateway",
  "skill_path": "/workspace/skills/clawhub-api-gateway",
  "skill_directory": "/workspace/skills/clawhub-api-gateway",
  "is_safe": false,
  "max_severity": "HIGH",
  "findings_count": 3,
  "findings": [
    {
      "id": "llm_finding_api-gateway_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Hardcoded API Key Requirement Without Secure Storage Guidance",
      "description": "The skill requires users to set a MATON_API_KEY environment variable or pass it in Authorization headers, but provides no guidance on secure storage, rotation, or protection of this credential. The instructions encourage users to copy API keys directly from the web interface and set them as environment variables, which could lead to credential exposure in shell history, process listings, or configuration files. There is no mention of using secure credential managers, encrypted storage, or temporary credentials.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "**Environment Variable:** You can set your API key as the `MATON_API_KEY` environment variable:\n\n```bash\nexport MATON_API_KEY=\"YOUR_API_KEY\"\n```",
      "remediation": "Add security guidance: (1) Recommend using secure credential managers (e.g., system keychains, secret management tools), (2) Warn against committing API keys to version control, (3) Suggest using temporary or scoped credentials where possible, (4) Provide instructions for secure credential rotation, (5) Warn about shell history exposure when using export commands.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and transitive trust. The skill acts as a client for a third-party API gateway service (maton.ai) that manages OAuth credentials for multiple external services. Key concerns include: (1) Inadequate guidance on secure API key storage, potentially leading to credential exposure, (2) Transitive trust in an external gateway service without validation or security controls, (3) Incomplete disclosure of the security implications of routing all API traffic through a third-party service. The skill does not contain malicious code or direct data exfiltration, but the architecture creates security dependencies on external infrastructure. Users should carefully evaluate the trust model and ensure the maton.ai service meets their security requirements before use. The skill would benefit from enhanced security documentation, credential management guidance, and transparency about data flows.",
        "primary_threats": [
          "Data Exfiltration/Exposure (credential management)",
          "Indirect Prompt Injection (transitive trust)",
          "Social Engineering (incomplete security disclosure)"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly instructs users to use `export` for API keys, which is a well-known security anti-pattern. The LLM analyzer correctly identified this as a credential management issue. While the skill itself doesn't exfiltrate data, the poor guidance could lead to credential exposure.",
        "meta_exploitability": "Medium - Requires user to follow insecure instructions, but shell history exposure is a common attack vector",
        "meta_impact": "High - Exposed API keys grant full access to user's Maton account and all connected OAuth services (Slack, Salesforce, etc.)"
      }
    },
    {
      "id": "llm_finding_api-gateway_1",
      "rule_id": "LLM_PROMPT_INJECTION",
      "category": "prompt_injection",
      "severity": "MEDIUM",
      "title": "Transitive Trust in External API Gateway Service",
      "description": "The skill acts as a passthrough proxy to a third-party API gateway service (gateway.maton.ai and ctrl.maton.ai) that manages OAuth tokens and credentials for multiple services. The agent is instructed to trust and forward requests through this external service without any validation of responses or security controls. This creates a transitive trust relationship where the agent delegates authentication and authorization decisions to an external service, potentially exposing users to man-in-the-middle attacks, credential theft, or malicious API responses if the gateway service is compromised.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Base URL: https://gateway.maton.ai/{app}/{native-api-path}\nConnection management: https://ctrl.maton.ai\nThe API gateway automatically injects the appropriate OAuth token for the target service.",
      "remediation": "(1) Add explicit warnings about the security implications of using a third-party API gateway, (2) Implement response validation to detect anomalous behavior, (3) Provide guidance on verifying the gateway service's security posture, (4) Consider implementing certificate pinning or other transport security measures, (5) Add monitoring/logging recommendations to detect unauthorized API usage, (6) Provide alternative direct API integration options for security-sensitive use cases.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and transitive trust. The skill acts as a client for a third-party API gateway service (maton.ai) that manages OAuth credentials for multiple external services. Key concerns include: (1) Inadequate guidance on secure API key storage, potentially leading to credential exposure, (2) Transitive trust in an external gateway service without validation or security controls, (3) Incomplete disclosure of the security implications of routing all API traffic through a third-party service. The skill does not contain malicious code or direct data exfiltration, but the architecture creates security dependencies on external infrastructure. Users should carefully evaluate the trust model and ensure the maton.ai service meets their security requirements before use. The skill would benefit from enhanced security documentation, credential management guidance, and transparency about data flows.",
        "primary_threats": [
          "Data Exfiltration/Exposure (credential management)",
          "Indirect Prompt Injection (transitive trust)",
          "Social Engineering (incomplete security disclosure)"
        ],
        "aitech": "AITech-1.2",
        "aitech_name": "Indirect Prompt Injection",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "PROMPT INJECTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The LLM analyzer correctly identified this as a transitive trust issue (AITech-1.2). The skill's architecture inherently requires trusting a third-party service with OAuth credentials, which is a legitimate security consideration that should be disclosed to users.",
        "meta_exploitability": "Low - Requires compromise of Maton's infrastructure, not the skill itself",
        "meta_impact": "High - If Maton's gateway is compromised, attackers could access OAuth tokens for all connected services"
      }
    },
    {
      "id": "llm_finding_api-gateway_2",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Incomplete Security Context in Skill Description",
      "description": "The skill description presents itself as a simple 'API gateway for calling third-party APIs with managed auth' without adequately disclosing the security implications of routing all API traffic through a third-party service (maton.ai). Users may not understand that their API credentials and data are being managed by an external service, or that all API requests are proxied through this service. This lack of transparency could mislead users about the trust model and data flow.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "description: API gateway for calling third-party APIs with managed auth. Use this skill when users want to interact with external services like Slack, HubSpot, Salesforce, Google Workspace, Stripe, and more.",
      "remediation": "Update the description to clearly state: (1) All API requests are proxied through maton.ai infrastructure, (2) OAuth tokens are stored and managed by the maton.ai service, (3) The security and privacy implications of this architecture, (4) Data handling and retention policies, (5) Compliance considerations for sensitive data (GDPR, HIPAA, etc.).",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MEDIUM-HIGH security risks primarily related to credential management and transitive trust. The skill acts as a client for a third-party API gateway service (maton.ai) that manages OAuth credentials for multiple external services. Key concerns include: (1) Inadequate guidance on secure API key storage, potentially leading to credential exposure, (2) Transitive trust in an external gateway service without validation or security controls, (3) Incomplete disclosure of the security implications of routing all API traffic through a third-party service. The skill does not contain malicious code or direct data exfiltration, but the architecture creates security dependencies on external infrastructure. Users should carefully evaluate the trust model and ensure the maton.ai service meets their security requirements before use. The skill would benefit from enhanced security documentation, credential management guidance, and transparency about data flows.",
        "primary_threats": [
          "Data Exfiltration/Exposure (credential management)",
          "Indirect Prompt Injection (transitive trust)",
          "Social Engineering (incomplete security disclosure)"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The description is not actively deceptive, but could be more transparent about the architecture. This is more of a disclosure issue than social engineering.",
        "meta_exploitability": "N/A - This is a transparency issue, not an exploitable vulnerability",
        "meta_impact": "Low - Users may not fully understand the trust model, but the skill functions as described"
      }
    }
  ],
  "scan_duration_seconds": 953.2134101390839,
  "duration_ms": 953213,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-05T19:55:10.716051"
}