api-pro
Expertly integrates third-party APIs with advanced authentication and orchestration, optimizing for Edge performance and autonomous agents.
Install this skill
Security score
The api-pro skill was audited on Jun 1, 2026 and we found 22 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 137 | console.log(`[Research Progress]: ${update.message}`); |
Template literal with variable interpolation in command context
| 167 | console.log(`Processing sub: ${sub.id}`); |
Template literal with variable interpolation in command context
| 172 | console.log(`Cancelling sub: ${sub.id} for customer ${sub.customer}`); |
Template literal with variable interpolation in command context
| 191 | console.log(`Customer Email: ${paymentIntent.customer.email}`); |
Template literal with variable interpolation in command context
| 286 | throw new Error(`API_ERROR_${response.status}`); |
Template literal with variable interpolation in command context
| 441 | - **Fix**: Ensure `AUTH_URL` matches the request origin exactly. In Vercel, use `AUTH_URL=${VERCEL_URL}`. |
Template literal with variable interpolation in command context
| 484 | const response = await fetch(`${this.baseURL}${endpoint}`, { |
Template literal with variable interpolation in command context
| 487 | 'Authorization': `Bearer ${this.apiKey}`, |
Template literal with variable interpolation in command context
| 495 | console.log(`[API] ${options.method || 'GET'} ${endpoint} - ${response.status} (${duration}ms)`); |
Template literal with variable interpolation in command context
| 499 | throw new Error(`API Request Failed: ${response.status} - ${JSON.stringify(errorData)}`); |
Template literal with variable interpolation in command context
| 515 | return this.request(`/users/${id}`, UserSchema); |
Webhook reference - potential data exfiltration
| 311 | ### 4.2 Webhook Signature Verification (Edge Ready) |
Webhook reference - potential data exfiltration
| 317 | * Verifies a webhook signature using Web Crypto API. |
Webhook reference - potential data exfiltration
| 417 | 3. **DO NOT** perform heavy processing in Webhook handlers. Acknowledge the receipt (200 OK) and queue the work (e.g., using Inngest or BullMQ). |
Webhook reference - potential data exfiltration
| 525 | | **Security** | Webhook signatures verified using `crypto.subtle`? | [ ] | |
Access to .env file
| 28 | # .env.local |
Access to .env file
| 154 | const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, { |
Access to .env file
| 382 | process.env.SECRET |
Access to .env file
| 475 | this.baseURL = process.env.API_BASE_URL!; |
Access to .env file
| 476 | this.apiKey = process.env.API_SECRET_KEY!; |
Access to .env file
| 529 | | **AI Readiness** | Repomix config updated to exclude `.env` and `dist`? | [ ] | |
External URL reference
| 30 | AUTH_URL=https://myapp.com/api/auth # Base URL for the auth system |