Skip to content
skillsafebeta
← Report library
Purpose / Other

Extension Http Outcalls Skill Security Audit

What the author says it does (original text)

HTTP outcalls performed by the backend canister (not in the frontend), including mandatory local verification of external REST API requests.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

Mandatory curl replay can repeat real mutations or deletions

Source references: 3
What we found

The Skill supports POST, PUT, DELETE, and PATCH while requiring curl to replay the exact method, headers, and body. Its PATCH example activates an external item. It does not require a test environment, disposable resource, idempotency key, or provider dry-run mode.

Why this matters

Against a production API, verification could create, alter, or delete real records twice, or repeat orders, payments, messages, and other irreversible actions.

The skill requires replaying the implemented request with curl using the same method, headers, and body, while its scope includes POST, PUT, DELETE, and PATCH. Its PATCH example changes an external item's active state to true. If development targets a live service and the request mutates or deletes data, verification would perform another real operation. Users can ask for a test environment, dry-run support, disposable resources, or idempotency safeguards. This supports a plausible risk, not proof that the example ran.

SKILL.md:16In the instructionsOpen original file
This skill covers the requirements for HTTP requests from the backend canister,including GET, HEAD, POST, PUT, DELETE, and PATCH. Use it whenever integratingwith an external API or service.
Show 2 other places
SKILL.md:146In the instructionsOpen original file
  func setItemActive() : async OutCall.Response {    await OutCall.httpRequest({      url = "https://api.example.com/items/123";      method = #patch;      headers = [{ name = "Content-Type"; value = "application/json" }];      body = ?("{\"active\":true}".encodeUtf8());      maxResponseBytes = 100_000;      transform;    });  };
SKILL.md:167In the instructionsOpen original file
Before considering an HTTP outcall complete, execute the equivalent requestlocally with `curl`. Do not rely only on remembered API documentation or on theMotoko code compiling. Every check below is required. If any check fails, theHTTP outcall is incomplete and MUST NOT proceed to deployment.1. **MUST test the exact request implemented in Motoko:** the same HTTP method,   API version, endpoint path, query parameters, headers, and body. Testing a   related endpoint or adding parameters that the implementation does not use   is not valid verification.2. **MUST trace one representative user input end to end** through every
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The example permits an unrestricted URL to reach a backend network request

Source references: 3
What we found

The request interface accepts any Text URL, and the example helper passes its url argument directly to the backend HTTP client without showing validation of allowed hosts, schemes, ports, or redirect targets.

Why this matters

If an application connects user input to this parameter, a user could make the canister contact unintended or attacker-controlled endpoints, consume canister resources, and send URL data or subsequently added credentials to the wrong host.

What this evidence establishes

The API and example accept a Text URL and pass it directly to the HTTP client, with no host, scheme, port, or redirect validation shown. However, these are a documented generic interface and a non-public helper example; the source does not show that an untrusted user controls the URL, nor does it include the module implementation or redirect behavior. These lines therefore do not establish a user-exploitable arbitrary backend request. If an application accepts user URLs, users should require an HTTPS host allowlist and validation of redirect destinations.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:105In the instructionsOpen original file
  };  public type Request = {    url : Text;    method : Method;    headers : [Header];    body : ?Blob;    maxResponseBytes : Nat64;    transform : Transform;  };  public type Response = IC.HttpRequestResult;
Show 2 other places
SKILL.md:157In the instructionsOpen original file
  func makeGetOutcall(url: Text) : async Text {    await OutCall.httpGetRequest(url, [], transform);  };};
SKILL.md:119In the instructionsOpen original file
  // Generic bounded request supporting GET, HEAD, POST, PUT, DELETE, and PATCH.  public func httpRequest(request : Request) : async Response;  // HTTP GET request with a transform callback function.  public func httpGetRequest(url : Text, extraHeaders: [Header], transform : Transform) : async Text;  // HTTP POST request, specifying a transform callback.  public func httpPostRequest(url : Text, extraHeaders: [Header], body : Text, transform : Transform) : async Text;};
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill enables a backend canister to call external REST APIs, including read requests and state-changing methods such as POST, PUT, DELETE, and PATCH.

View source
SKILL.md:16In the instructionsOpen original file
This skill covers the requirements for HTTP requests from the backend canister,including GET, HEAD, POST, PUT, DELETE, and PATCH. Use it whenever integratingwith an external API or service.

It requires provider-enforced response bounds of at most 10,000 entries and 1 MB per response, and forbids downloading an unbounded collection for local filtering in the canister.

View source
SKILL.md:23In the instructionsOpen original file
Follow these rules:- **MUST use a provider-enforced bounded API request.** The request must limit  the response by identifier, pagination, time range, geographic area, result  count, or another server-side bound appropriate to the feature.  Limit each response to both at most 10_000 entries and at most 1 MB, then  paginate if needed.- **MUST pick the bound that matches the feature.** The five bounds are not
SKILL.md:35In the instructionsOpen original file
  a list the user deliberately pages through, not for searching.- **MUST put every bound in the actual Motoko http request.** A bound used only by a  local test does not protect the canister.- **NEVER fetch an unbounded collection and filter it in the canister.**  Expected response size, typical traffic, or a currently small dataset is not  a bound.- **MUST reject the API or narrow the feature if the provider cannot enforce a

The Skill requires locally replaying the exact Motoko method, path, parameters, headers, and body with curl, followed by a separate compliance check before deployment.

View source
SKILL.md:167In the instructionsOpen original file
Before considering an HTTP outcall complete, execute the equivalent requestlocally with `curl`. Do not rely only on remembered API documentation or on theMotoko code compiling. Every check below is required. If any check fails, theHTTP outcall is incomplete and MUST NOT proceed to deployment.1. **MUST test the exact request implemented in Motoko:** the same HTTP method,   API version, endpoint path, query parameters, headers, and body. Testing a   related endpoint or adding parameters that the implementation does not use   is not valid verification.2. **MUST trace one representative user input end to end** through every
SKILL.md:185In the instructionsOpen original file
   app. A response that is merely valid JSON is not sufficient.4. **MUST run `check_canister_api_compliance` on the exact URL and method the   implementation uses.** It measures the response against the outcall byte   ceiling and entry bound and reports whether the URL is bounded server-side,   mechanically and behind the deploy gate, so an outcall to a host it never   cleared cannot ship. When it refuses an endpoint, choose a compatible public   API or narrow the feature honestly; do not implement an unbounded fetch-all   request and filter it in the canister.

The document shows only the external outcall module's types and function declarations; its claimed 1 MB cap and non-replicated execution cannot be independently verified from the supplied source.

View source
SKILL.md:105In the instructionsOpen original file
  };  public type Request = {    url : Text;    method : Method;    headers : [Header];    body : ?Blob;    maxResponseBytes : Nat64;    transform : Transform;  };  public type Response = IC.HttpRequestResult;  public let defaultMaxResponseBytes : Nat64;  // Helper function for the transform callback used by the IC on HTTP outcalls.  public func transform(input : TransformationInput) : TransformationOutput;  // Generic bounded request supporting GET, HEAD, POST, PUT, DELETE, and PATCH.  public func httpRequest(request : Request) : async Response;
SKILL.md:130In the instructionsOpen original file
Use `httpRequest` when the status, headers, a custom response limit, or a methodother than GET or POST is needed. `maxResponseBytes` may set a lower limit; themodule caps every request at `defaultMaxResponseBytes` (1 MB). The moduleexecutes every HTTP outcall with `is_replicated = ?false`; callers cannot enablereplicated execution. The backward-compatible helper stays the shortest path fora simple GET:
Start here · InstructionsSKILL.md
extension-http-outcalls
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:3In the instructionsOpen original file
name: extension-http-outcallsdescription: HTTP outcalls performed by the backend canister (not in the frontend), including mandatory local verification of external REST API requests.version: 0.1.9
SKILL.md:12In the instructionsOpen original file
# HTTP OutcallsHTTP outcalls extension for [Caffeine AI](https://caffeine.ai?utm_source=caffeine-skill&utm_medium=referral).
SKILL.md:43In the instructionsOpen original file
  unsafe fallback.- **Test locally against curl implementation.** Ensure the 1:1 curl call succeeds  and returns every field the app consumes. When Motoko code changes, redo the
Lines read
210
File checksum (to compare versions)
2fee050d5c33465293bdcef0b4be49880d64cd3d091bc6c1e8782b7cf61752e0