📦
История аудитов
ask-graphql-mcp - 5 аудиты
Сравнение версий
Изменения возможностей и находок между проверенными версиями, сначала новые.
| Версия | Дата | Результат | Пункты проверки | Изменение к предыдущей |
|---|---|---|---|---|
| v5 Последняя | 7 июл. 2026 г., 06:06 | 2 подтверждено | 9 | Возможности не изменились |
| v4 | 7 июл. 2026 г., 06:06 | 2 подтверждено | 9 | Возможности не изменились |
| v3 | 30 июн. 2026 г., 20:13 | Подтверждённых находок нет | 3 | Возможности не изменились |
| v2 | 30 июн. 2026 г., 20:13 | Подтверждённых находок нет | 3 | Переменные окруженияВнешние команды |
| v1 | 25 мар. 2026 г., 06:52 | Подтверждённых находок нет | 0 | Базовая |
Версия аудита 5 Последняя
7 июл. 2026 г., 06:06
Most static command-execution and system-reconnaissance alerts are Markdown false positives. The skill still routes data to an external MCP gateway and includes instructions that can expose API keys or private endpoint authorization headers. No prompt injection attempt was found in the reviewed files.
4
Просканировано файлов
299
Проанализировано строк
14
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (2)
Высокий
Chat-Based API Key Collection
The skill tells the agent to ask users to create an API key and send it in chat so execution can continue. This can expose paid service credentials in conversation logs.
Multiple files require API key requests as first or high-priority guidance, including wording that asks users to send the key here.
Высокий
SKILL.md:54-64references/config-templates.md:17-20references/config-templates.md:36-40references/tools-and-prompts.md:20-23
Forwarding Endpoint Authorization To Third-Party Gateway
The skill sends X-ENDPOINT-AUTHORIZATION through Ask MCP when upstream endpoints are private. That can disclose private endpoint bearer tokens or session credentials to the external gateway.
The reviewed files explicitly combine private endpoint authorization headers with the external Ask MCP HTTP gateway path.
Пункты проверки возможностей (9)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Средний
Hardcoded URL
url: "https://ask-api.hermes-subnet.ai/mcp/graphql-agent"
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp/graphql-agent",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
1. Default to free gateway: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
2. Use paid gateway only when needed: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
- Free: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
- Paid: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
- Switch user to paid gateway `https://ask-api.hermes-subnet.ai/mcp` with `X-API-KEY`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
1. Paid gateway URL: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Факторы риска
🌐 Доступ к сети (19)
agents/openai.yaml:4 agents/openai.yaml:12 references/config-templates.md:17 references/config-templates.md:19 references/config-templates.md:36 references/config-templates.md:38 SKILL.md:40 SKILL.md:52 SKILL.md:53 SKILL.md:73 SKILL.md:74 SKILL.md:94 SKILL.md:95 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:132 SKILL.md:135 SKILL.md:137
🔑 Переменные окружения (1)
⚙️ Внешние команды (45)
SKILL.md:18 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:32 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:73 SKILL.md:74 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:94 SKILL.md:95 SKILL.md:97 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135 SKILL.md:136 SKILL.md:137 SKILL.md:139
Аудитор:: codex
7 июл. 2026 г., 06:06
Most static command-execution and system-reconnaissance alerts are Markdown false positives. The skill still routes data to an external MCP gateway and includes instructions that can expose API keys or private endpoint authorization headers. No prompt injection attempt was found in the reviewed files.
4
Просканировано файлов
299
Проанализировано строк
14
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (2)
Высокий
Chat-Based API Key Collection
The skill tells the agent to ask users to create an API key and send it in chat so execution can continue. This can expose paid service credentials in conversation logs.
Multiple files require API key requests as first or high-priority guidance, including wording that asks users to send the key here.
Высокий
SKILL.md:54-64references/config-templates.md:17-20references/config-templates.md:36-40references/tools-and-prompts.md:20-23
Forwarding Endpoint Authorization To Third-Party Gateway
The skill sends X-ENDPOINT-AUTHORIZATION through Ask MCP when upstream endpoints are private. That can disclose private endpoint bearer tokens or session credentials to the external gateway.
The reviewed files explicitly combine private endpoint authorization headers with the external Ask MCP HTTP gateway path.
Пункты проверки возможностей (9)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Средний
Hardcoded URL
url: "https://ask-api.hermes-subnet.ai/mcp/graphql-agent"
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp/graphql-agent",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
1. Default to free gateway: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
2. Use paid gateway only when needed: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
- Free: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
- Paid: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
- Switch user to paid gateway `https://ask-api.hermes-subnet.ai/mcp` with `X-API-KEY`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Средний
Hardcoded URL
1. Paid gateway URL: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
Факторы риска
🌐 Доступ к сети (19)
agents/openai.yaml:4 agents/openai.yaml:12 references/config-templates.md:17 references/config-templates.md:19 references/config-templates.md:36 references/config-templates.md:38 SKILL.md:40 SKILL.md:52 SKILL.md:53 SKILL.md:73 SKILL.md:74 SKILL.md:94 SKILL.md:95 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:132 SKILL.md:135 SKILL.md:137
🔑 Переменные окружения (1)
⚙️ Внешние команды (45)
SKILL.md:18 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:32 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:73 SKILL.md:74 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:94 SKILL.md:95 SKILL.md:97 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135 SKILL.md:136 SKILL.md:137 SKILL.md:139
Аудитор:: codex
30 июн. 2026 г., 20:13
Static code-execution and weak-crypto findings are false positives caused by Markdown backticks, JSON examples, and GraphQL text. The network and credential findings are true positives because the skill routes user endpoints, optional endpoint authorization, and paid API keys through a third-party MCP gateway.
4
Просканировано файлов
299
Проанализировано строк
6
Пункты проверки
3
Ложные срабатывания проигнорированы
Пункты проверки возможностей (3)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
SKILL.md:52-56SKILL.md:93-97SKILL.md:131-136references/config-templates.md:32-40references/tools-and-prompts.md:20-23
Credential Collection And Third-Party Forwarding
TRUE_POSITIVE. The skill tells agents to request paid API keys and to include X-API-KEY and optional X-ENDPOINT-AUTHORIZATION headers when calling the Hermes MCP gateway. This can expose user credentials or private endpoint tokens to a third-party service. Confidence: 0.88. Confidence reasoning: Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat, so the credential-handling risk is clear. It is not confirmed malicious because the behavior is documented as part of the service workflow.
Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat. The behavior is documented, so malicious intent is not proven.
Высокий
Forced Routing Through External MCP Gateway
TRUE_POSITIVE. The skill requires Ask GraphQL MCP as the default path and discourages direct GraphQL calls, even when the model could answer locally or query an endpoint directly. This means user questions and endpoint metadata are intentionally sent to the Hermes gateway. Confidence: 0.82. Confidence reasoning: The routing policy is repeated in SKILL.md and agents/openai.yaml, and the gateway URL is hardcoded. The risk is high for privacy-sensitive endpoints, although the workflow is transparent.
The files repeatedly require use of the external MCP gateway and provide a hardcoded remote URL. The concern is privacy exposure, not covert execution.
Средний
SKILL.md:52-55SKILL.md:87-90references/config-templates.md:17-20references/tools-and-prompts.md:20-22
User-Controlled Endpoint Proxying
TRUE_POSITIVE. The skill instructs agents to pass a user-provided GraphQL endpoint in the X-ENDPOINT header to the MCP gateway. A remote service will likely connect to that endpoint, which creates validation and abuse concerns for private or attacker-controlled URLs. Confidence: 0.74. Confidence reasoning: The endpoint forwarding behavior is explicit, but the actual network request is performed by the external gateway rather than local skill code.
The instructions clearly forward arbitrary user endpoint URLs to the MCP gateway. Impact depends on gateway-side validation that is not visible in this skill.
Статические ложные срабатывания проигнорированы (3)
Эти статические совпадения были отклонены семантической проверкой или совпадали только со схемными токенами, поэтому они показываются для прозрачности, но не влияют на оценку качества.
Низкий
Markdown Backticks Flagged As External Commands
FALSE_POSITIVE. Static analysis reported many Ruby or shell backtick executions, but the reviewed files are Markdown and YAML instructions with inline code labels and JSON configuration examples. No executable script, command runner, or shell invocation was found. Confidence: 0.96. Confidence reasoning: The cited lines contain documentation syntax such as tool names, headers, or JSON blocks, not executable code.
The cited lines are documentation and JSON examples. No shell execution primitive appears in the scanned files.
Низкий
Weak Cryptography Alerts Are Text Matches
FALSE_POSITIVE. Static analysis flagged weak cryptographic algorithm patterns, but the cited locations describe GraphQL or endpoint behavior and do not call cryptographic APIs. No evidence found of MD5, SHA1, DES, or similar weak crypto usage. Confidence: 0.93. Confidence reasoning: The files are declarative instructions and documentation, and the cited lines do not implement cryptography.
The cited text is descriptive and contains no cryptographic implementation. The scanner likely matched substrings in GraphQL-related prose.
Низкий
Troubleshooting Text Flagged As System Reconnaissance
FALSE_POSITIVE. The cited checks ask the agent to validate gateway URLs, endpoint reachability, headers, and configuration shape. They do not instruct the agent to inspect host files, environment variables, processes, or system information. Confidence: 0.90. Confidence reasoning: The surrounding context is connection troubleshooting for a declared MCP service, not host reconnaissance.
The cited lines are service troubleshooting instructions. No host enumeration commands or sensitive local inspection steps are present.
Факторы риска
🌐 Доступ к сети (6)
🔑 Переменные окружения (5)
⚙️ Внешние команды (4)
Обнаруженные паттерны
API Key Requested In Chat FlowPrivate Endpoint Authorization Forwarded To Gateway
Аудитор:: codex
30 июн. 2026 г., 20:13
Static code-execution and weak-crypto findings are false positives caused by Markdown backticks, JSON examples, and GraphQL text. The network and credential findings are true positives because the skill routes user endpoints, optional endpoint authorization, and paid API keys through a third-party MCP gateway.
4
Просканировано файлов
299
Проанализировано строк
6
Пункты проверки
3
Ложные срабатывания проигнорированы
Пункты проверки возможностей (3)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
SKILL.md:52-56SKILL.md:93-97SKILL.md:131-136references/config-templates.md:32-40references/tools-and-prompts.md:20-23
Credential Collection And Third-Party Forwarding
TRUE_POSITIVE. The skill tells agents to request paid API keys and to include X-API-KEY and optional X-ENDPOINT-AUTHORIZATION headers when calling the Hermes MCP gateway. This can expose user credentials or private endpoint tokens to a third-party service. Confidence: 0.88. Confidence reasoning: Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat, so the credential-handling risk is clear. It is not confirmed malicious because the behavior is documented as part of the service workflow.
Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat. The behavior is documented, so malicious intent is not proven.
Высокий
Forced Routing Through External MCP Gateway
TRUE_POSITIVE. The skill requires Ask GraphQL MCP as the default path and discourages direct GraphQL calls, even when the model could answer locally or query an endpoint directly. This means user questions and endpoint metadata are intentionally sent to the Hermes gateway. Confidence: 0.82. Confidence reasoning: The routing policy is repeated in SKILL.md and agents/openai.yaml, and the gateway URL is hardcoded. The risk is high for privacy-sensitive endpoints, although the workflow is transparent.
The files repeatedly require use of the external MCP gateway and provide a hardcoded remote URL. The concern is privacy exposure, not covert execution.
Средний
SKILL.md:52-55SKILL.md:87-90references/config-templates.md:17-20references/tools-and-prompts.md:20-22
User-Controlled Endpoint Proxying
TRUE_POSITIVE. The skill instructs agents to pass a user-provided GraphQL endpoint in the X-ENDPOINT header to the MCP gateway. A remote service will likely connect to that endpoint, which creates validation and abuse concerns for private or attacker-controlled URLs. Confidence: 0.74. Confidence reasoning: The endpoint forwarding behavior is explicit, but the actual network request is performed by the external gateway rather than local skill code.
The instructions clearly forward arbitrary user endpoint URLs to the MCP gateway. Impact depends on gateway-side validation that is not visible in this skill.
Статические ложные срабатывания проигнорированы (3)
Эти статические совпадения были отклонены семантической проверкой или совпадали только со схемными токенами, поэтому они показываются для прозрачности, но не влияют на оценку качества.
Низкий
Markdown Backticks Flagged As External Commands
FALSE_POSITIVE. Static analysis reported many Ruby or shell backtick executions, but the reviewed files are Markdown and YAML instructions with inline code labels and JSON configuration examples. No executable script, command runner, or shell invocation was found. Confidence: 0.96. Confidence reasoning: The cited lines contain documentation syntax such as tool names, headers, or JSON blocks, not executable code.
The cited lines are documentation and JSON examples. No shell execution primitive appears in the scanned files.
Низкий
Weak Cryptography Alerts Are Text Matches
FALSE_POSITIVE. Static analysis flagged weak cryptographic algorithm patterns, but the cited locations describe GraphQL or endpoint behavior and do not call cryptographic APIs. No evidence found of MD5, SHA1, DES, or similar weak crypto usage. Confidence: 0.93. Confidence reasoning: The files are declarative instructions and documentation, and the cited lines do not implement cryptography.
The cited text is descriptive and contains no cryptographic implementation. The scanner likely matched substrings in GraphQL-related prose.
Низкий
Troubleshooting Text Flagged As System Reconnaissance
FALSE_POSITIVE. The cited checks ask the agent to validate gateway URLs, endpoint reachability, headers, and configuration shape. They do not instruct the agent to inspect host files, environment variables, processes, or system information. Confidence: 0.90. Confidence reasoning: The surrounding context is connection troubleshooting for a declared MCP service, not host reconnaissance.
The cited lines are service troubleshooting instructions. No host enumeration commands or sensitive local inspection steps are present.
Факторы риска
🌐 Доступ к сети (6)
🔑 Переменные окружения (5)
⚙️ Внешние команды (4)
Обнаруженные паттерны
API Key Requested In Chat FlowPrivate Endpoint Authorization Forwarded To Gateway
Аудитор:: codex
25 мар. 2026 г., 06:52
All 146 static analyzer findings were evaluated and determined to be false positives. The skill is a legitimate Web3 GraphQL query tool that connects to user-provided endpoints via the Ask GraphQL MCP gateway. Network URLs are documented service endpoints. Markdown backticks in documentation were incorrectly flagged as shell execution. API key references are template placeholders for user configuration.
4
Просканировано файлов
299
Проанализировано строк
1
Пункты проверки
0
Ложные срабатывания проигнорированы
Факторы риска
🌐 Доступ к сети (5)
Аудитор:: claude