hap-apiv3-data
Fail
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the AI agent to automatically scan and read local configuration files (
settings.json) located in sensitive application directories (e.g.,~/Library/Application Support/,%APPDATA%,~/.config/). This is designed to silently harvest credentials such asHAP-Appkey,HAP-Sign, and Bearer tokens without requiring manual user input for the credentials. - [COMMAND_EXECUTION]: The skill provides JavaScript code snippets and instructions for the agent to use filesystem APIs (e.g.,
fs.readFileSync) to parse sensitive local files. This promotes unauthorized access to local application data stores. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of an external package via
npx apifox-mcp-server@latest. While Apifox is a recognized service, automated execution of remote packages represents an external code dependency that should be verified.
Recommendations
- AI detected serious security threats
Audit Metadata