ask-graphql-mcp Sicherheitsbewertung v2

TRUE_POSITIVE. The skill tells agents to request paid API keys and to include X-API-KEY and optional X-ENDPOINT-AUTHORIZATION headers when calling the Hermes MCP gateway. This can expose user credentials or private endpoint tokens to a third-party service. Confidence: 0.88. Confidence reasoning: Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat, so the credential-handling risk is clear. It is not confirmed malicious because the behavior is documented as part of the service workflow.

Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat. The behavior is documented, so malicious intent is not proven.

TRUE_POSITIVE. The skill requires Ask GraphQL MCP as the default path and discourages direct GraphQL calls, even when the model could answer locally or query an endpoint directly. This means user questions and endpoint metadata are intentionally sent to the Hermes gateway. Confidence: 0.82. Confidence reasoning: The routing policy is repeated in SKILL.md and agents/openai.yaml, and the gateway URL is hardcoded. The risk is high for privacy-sensitive endpoints, although the workflow is transparent.

The files repeatedly require use of the external MCP gateway and provide a hardcoded remote URL. The concern is privacy exposure, not covert execution.

TRUE_POSITIVE. The skill instructs agents to pass a user-provided GraphQL endpoint in the X-ENDPOINT header to the MCP gateway. A remote service will likely connect to that endpoint, which creates validation and abuse concerns for private or attacker-controlled URLs. Confidence: 0.74. Confidence reasoning: The endpoint forwarding behavior is explicit, but the actual network request is performed by the external gateway rather than local skill code.

The instructions clearly forward arbitrary user endpoint URLs to the MCP gateway. Impact depends on gateway-side validation that is not visible in this skill.