📦
Audit-Verlauf
ask-graphql-mcp - 5 Audits
Versionsvergleich
Änderungen an Fähigkeiten und Befunden über geprüfte Versionen hinweg, neueste zuerst.
| Version | Datum | Ergebnis | Prüfelemente | Änderung ggü. vorheriger |
|---|---|---|---|---|
| v5 Neueste | 7. Juli 2026, 06:06 | 2 bestätigt | 9 | Keine Änderung der Fähigkeiten |
| v4 | 7. Juli 2026, 06:06 | 2 bestätigt | 9 | Keine Änderung der Fähigkeiten |
| v3 | 30. Juni 2026, 20:13 | Keine bestätigten Befunde | 3 | Keine Änderung der Fähigkeiten |
| v2 | 30. Juni 2026, 20:13 | Keine bestätigten Befunde | 3 | UmgebungsvariablenExterne Befehle |
| v1 | 25. März 2026, 06:52 | Keine bestätigten Befunde | 0 | Ausgangsbasis |
Audit-Version 5 Neueste
7. Juli 2026, 06:06
Most static command-execution and system-reconnaissance alerts are Markdown false positives. The skill still routes data to an external MCP gateway and includes instructions that can expose API keys or private endpoint authorization headers. No prompt injection attempt was found in the reviewed files.
4
Gescannte Dateien
299
Analysierte Zeilen
14
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Chat-Based API Key Collection
The skill tells the agent to ask users to create an API key and send it in chat so execution can continue. This can expose paid service credentials in conversation logs.
Multiple files require API key requests as first or high-priority guidance, including wording that asks users to send the key here.
Hoch
SKILL.md:54-64references/config-templates.md:17-20references/config-templates.md:36-40references/tools-and-prompts.md:20-23
Forwarding Endpoint Authorization To Third-Party Gateway
The skill sends X-ENDPOINT-AUTHORIZATION through Ask MCP when upstream endpoints are private. That can disclose private endpoint bearer tokens or session credentials to the external gateway.
The reviewed files explicitly combine private endpoint authorization headers with the external Ask MCP HTTP gateway path.
Elemente der Fähigkeitsprüfung (9)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Mittel
Hardcoded URL
url: "https://ask-api.hermes-subnet.ai/mcp/graphql-agent"
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp/graphql-agent",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
1. Default to free gateway: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
2. Use paid gateway only when needed: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
- Free: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
- Paid: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
- Switch user to paid gateway `https://ask-api.hermes-subnet.ai/mcp` with `X-API-KEY`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
1. Paid gateway URL: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Risikofaktoren
🌐 Netzwerkzugriff (19)
agents/openai.yaml:4 agents/openai.yaml:12 references/config-templates.md:17 references/config-templates.md:19 references/config-templates.md:36 references/config-templates.md:38 SKILL.md:40 SKILL.md:52 SKILL.md:53 SKILL.md:73 SKILL.md:74 SKILL.md:94 SKILL.md:95 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:132 SKILL.md:135 SKILL.md:137
🔑 Umgebungsvariablen (1)
⚙️ Externe Befehle (45)
SKILL.md:18 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:32 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:73 SKILL.md:74 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:94 SKILL.md:95 SKILL.md:97 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135 SKILL.md:136 SKILL.md:137 SKILL.md:139
Geprüft von: codex
7. Juli 2026, 06:06
Most static command-execution and system-reconnaissance alerts are Markdown false positives. The skill still routes data to an external MCP gateway and includes instructions that can expose API keys or private endpoint authorization headers. No prompt injection attempt was found in the reviewed files.
4
Gescannte Dateien
299
Analysierte Zeilen
14
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Chat-Based API Key Collection
The skill tells the agent to ask users to create an API key and send it in chat so execution can continue. This can expose paid service credentials in conversation logs.
Multiple files require API key requests as first or high-priority guidance, including wording that asks users to send the key here.
Hoch
SKILL.md:54-64references/config-templates.md:17-20references/config-templates.md:36-40references/tools-and-prompts.md:20-23
Forwarding Endpoint Authorization To Third-Party Gateway
The skill sends X-ENDPOINT-AUTHORIZATION through Ask MCP when upstream endpoints are private. That can disclose private endpoint bearer tokens or session credentials to the external gateway.
The reviewed files explicitly combine private endpoint authorization headers with the external Ask MCP HTTP gateway path.
Elemente der Fähigkeitsprüfung (9)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Mittel
Hardcoded URL
url: "https://ask-api.hermes-subnet.ai/mcp/graphql-agent"
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp/graphql-agent",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
1. Default to free gateway: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
2. Use paid gateway only when needed: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
- Free: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
- Paid: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
- Switch user to paid gateway `https://ask-api.hermes-subnet.ai/mcp` with `X-API-KEY`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Mittel
Hardcoded URL
1. Paid gateway URL: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Risikofaktoren
🌐 Netzwerkzugriff (19)
agents/openai.yaml:4 agents/openai.yaml:12 references/config-templates.md:17 references/config-templates.md:19 references/config-templates.md:36 references/config-templates.md:38 SKILL.md:40 SKILL.md:52 SKILL.md:53 SKILL.md:73 SKILL.md:74 SKILL.md:94 SKILL.md:95 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:132 SKILL.md:135 SKILL.md:137
🔑 Umgebungsvariablen (1)
⚙️ Externe Befehle (45)
SKILL.md:18 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:32 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:73 SKILL.md:74 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:94 SKILL.md:95 SKILL.md:97 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135 SKILL.md:136 SKILL.md:137 SKILL.md:139
Geprüft von: codex
30. Juni 2026, 20:13
Static code-execution and weak-crypto findings are false positives caused by Markdown backticks, JSON examples, and GraphQL text. The network and credential findings are true positives because the skill routes user endpoints, optional endpoint authorization, and paid API keys through a third-party MCP gateway.
4
Gescannte Dateien
299
Analysierte Zeilen
6
Prüfelemente
3
Falschmeldungen ignoriert
Elemente der Fähigkeitsprüfung (3)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
SKILL.md:52-56SKILL.md:93-97SKILL.md:131-136references/config-templates.md:32-40references/tools-and-prompts.md:20-23
Credential Collection And Third-Party Forwarding
TRUE_POSITIVE. The skill tells agents to request paid API keys and to include X-API-KEY and optional X-ENDPOINT-AUTHORIZATION headers when calling the Hermes MCP gateway. This can expose user credentials or private endpoint tokens to a third-party service. Confidence: 0.88. Confidence reasoning: Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat, so the credential-handling risk is clear. It is not confirmed malicious because the behavior is documented as part of the service workflow.
Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat. The behavior is documented, so malicious intent is not proven.
Hoch
Forced Routing Through External MCP Gateway
TRUE_POSITIVE. The skill requires Ask GraphQL MCP as the default path and discourages direct GraphQL calls, even when the model could answer locally or query an endpoint directly. This means user questions and endpoint metadata are intentionally sent to the Hermes gateway. Confidence: 0.82. Confidence reasoning: The routing policy is repeated in SKILL.md and agents/openai.yaml, and the gateway URL is hardcoded. The risk is high for privacy-sensitive endpoints, although the workflow is transparent.
The files repeatedly require use of the external MCP gateway and provide a hardcoded remote URL. The concern is privacy exposure, not covert execution.
Mittel
SKILL.md:52-55SKILL.md:87-90references/config-templates.md:17-20references/tools-and-prompts.md:20-22
User-Controlled Endpoint Proxying
TRUE_POSITIVE. The skill instructs agents to pass a user-provided GraphQL endpoint in the X-ENDPOINT header to the MCP gateway. A remote service will likely connect to that endpoint, which creates validation and abuse concerns for private or attacker-controlled URLs. Confidence: 0.74. Confidence reasoning: The endpoint forwarding behavior is explicit, but the actual network request is performed by the external gateway rather than local skill code.
The instructions clearly forward arbitrary user endpoint URLs to the MCP gateway. Impact depends on gateway-side validation that is not visible in this skill.
Statische falsch positive Treffer ignoriert (3)
Diese statischen Treffer wurden durch semantische Prüfung verworfen oder entsprachen reinen Schema-Tokens; daher werden sie aus Transparenzgründen angezeigt, beeinflussen jedoch nicht die Qualitätsbewertung.
Niedrig
Markdown Backticks Flagged As External Commands
FALSE_POSITIVE. Static analysis reported many Ruby or shell backtick executions, but the reviewed files are Markdown and YAML instructions with inline code labels and JSON configuration examples. No executable script, command runner, or shell invocation was found. Confidence: 0.96. Confidence reasoning: The cited lines contain documentation syntax such as tool names, headers, or JSON blocks, not executable code.
The cited lines are documentation and JSON examples. No shell execution primitive appears in the scanned files.
Niedrig
Weak Cryptography Alerts Are Text Matches
FALSE_POSITIVE. Static analysis flagged weak cryptographic algorithm patterns, but the cited locations describe GraphQL or endpoint behavior and do not call cryptographic APIs. No evidence found of MD5, SHA1, DES, or similar weak crypto usage. Confidence: 0.93. Confidence reasoning: The files are declarative instructions and documentation, and the cited lines do not implement cryptography.
The cited text is descriptive and contains no cryptographic implementation. The scanner likely matched substrings in GraphQL-related prose.
Niedrig
Troubleshooting Text Flagged As System Reconnaissance
FALSE_POSITIVE. The cited checks ask the agent to validate gateway URLs, endpoint reachability, headers, and configuration shape. They do not instruct the agent to inspect host files, environment variables, processes, or system information. Confidence: 0.90. Confidence reasoning: The surrounding context is connection troubleshooting for a declared MCP service, not host reconnaissance.
The cited lines are service troubleshooting instructions. No host enumeration commands or sensitive local inspection steps are present.
Risikofaktoren
🌐 Netzwerkzugriff (6)
🔑 Umgebungsvariablen (5)
⚙️ Externe Befehle (4)
Erkannte Muster
API Key Requested In Chat FlowPrivate Endpoint Authorization Forwarded To Gateway
Geprüft von: codex
30. Juni 2026, 20:13
Static code-execution and weak-crypto findings are false positives caused by Markdown backticks, JSON examples, and GraphQL text. The network and credential findings are true positives because the skill routes user endpoints, optional endpoint authorization, and paid API keys through a third-party MCP gateway.
4
Gescannte Dateien
299
Analysierte Zeilen
6
Prüfelemente
3
Falschmeldungen ignoriert
Elemente der Fähigkeitsprüfung (3)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
SKILL.md:52-56SKILL.md:93-97SKILL.md:131-136references/config-templates.md:32-40references/tools-and-prompts.md:20-23
Credential Collection And Third-Party Forwarding
TRUE_POSITIVE. The skill tells agents to request paid API keys and to include X-API-KEY and optional X-ENDPOINT-AUTHORIZATION headers when calling the Hermes MCP gateway. This can expose user credentials or private endpoint tokens to a third-party service. Confidence: 0.88. Confidence reasoning: Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat, so the credential-handling risk is clear. It is not confirmed malicious because the behavior is documented as part of the service workflow.
Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat. The behavior is documented, so malicious intent is not proven.
Hoch
Forced Routing Through External MCP Gateway
TRUE_POSITIVE. The skill requires Ask GraphQL MCP as the default path and discourages direct GraphQL calls, even when the model could answer locally or query an endpoint directly. This means user questions and endpoint metadata are intentionally sent to the Hermes gateway. Confidence: 0.82. Confidence reasoning: The routing policy is repeated in SKILL.md and agents/openai.yaml, and the gateway URL is hardcoded. The risk is high for privacy-sensitive endpoints, although the workflow is transparent.
The files repeatedly require use of the external MCP gateway and provide a hardcoded remote URL. The concern is privacy exposure, not covert execution.
Mittel
SKILL.md:52-55SKILL.md:87-90references/config-templates.md:17-20references/tools-and-prompts.md:20-22
User-Controlled Endpoint Proxying
TRUE_POSITIVE. The skill instructs agents to pass a user-provided GraphQL endpoint in the X-ENDPOINT header to the MCP gateway. A remote service will likely connect to that endpoint, which creates validation and abuse concerns for private or attacker-controlled URLs. Confidence: 0.74. Confidence reasoning: The endpoint forwarding behavior is explicit, but the actual network request is performed by the external gateway rather than local skill code.
The instructions clearly forward arbitrary user endpoint URLs to the MCP gateway. Impact depends on gateway-side validation that is not visible in this skill.
Statische falsch positive Treffer ignoriert (3)
Diese statischen Treffer wurden durch semantische Prüfung verworfen oder entsprachen reinen Schema-Tokens; daher werden sie aus Transparenzgründen angezeigt, beeinflussen jedoch nicht die Qualitätsbewertung.
Niedrig
Markdown Backticks Flagged As External Commands
FALSE_POSITIVE. Static analysis reported many Ruby or shell backtick executions, but the reviewed files are Markdown and YAML instructions with inline code labels and JSON configuration examples. No executable script, command runner, or shell invocation was found. Confidence: 0.96. Confidence reasoning: The cited lines contain documentation syntax such as tool names, headers, or JSON blocks, not executable code.
The cited lines are documentation and JSON examples. No shell execution primitive appears in the scanned files.
Niedrig
Weak Cryptography Alerts Are Text Matches
FALSE_POSITIVE. Static analysis flagged weak cryptographic algorithm patterns, but the cited locations describe GraphQL or endpoint behavior and do not call cryptographic APIs. No evidence found of MD5, SHA1, DES, or similar weak crypto usage. Confidence: 0.93. Confidence reasoning: The files are declarative instructions and documentation, and the cited lines do not implement cryptography.
The cited text is descriptive and contains no cryptographic implementation. The scanner likely matched substrings in GraphQL-related prose.
Niedrig
Troubleshooting Text Flagged As System Reconnaissance
FALSE_POSITIVE. The cited checks ask the agent to validate gateway URLs, endpoint reachability, headers, and configuration shape. They do not instruct the agent to inspect host files, environment variables, processes, or system information. Confidence: 0.90. Confidence reasoning: The surrounding context is connection troubleshooting for a declared MCP service, not host reconnaissance.
The cited lines are service troubleshooting instructions. No host enumeration commands or sensitive local inspection steps are present.
Risikofaktoren
🌐 Netzwerkzugriff (6)
🔑 Umgebungsvariablen (5)
⚙️ Externe Befehle (4)
Erkannte Muster
API Key Requested In Chat FlowPrivate Endpoint Authorization Forwarded To Gateway
Geprüft von: codex
25. März 2026, 06:52
All 146 static analyzer findings were evaluated and determined to be false positives. The skill is a legitimate Web3 GraphQL query tool that connects to user-provided endpoints via the Ask GraphQL MCP gateway. Network URLs are documented service endpoints. Markdown backticks in documentation were incorrectly flagged as shell execution. API key references are template placeholders for user configuration.
4
Gescannte Dateien
299
Analysierte Zeilen
1
Prüfelemente
0
Falschmeldungen ignoriert
Risikofaktoren
🌐 Netzwerkzugriff (5)
Geprüft von: claude