Skills/npm/api-anything

api-anything@0.4.0

VERIFIED· startup only

Publisher claims: "Learn reusable operations from a website's browser traffic and call them from a CLI, library or MCP server." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher goodnight000 · publishing for 18 daysInstalls 10,250Last detonated 5d ago
$claude mcp add api-anything -- npx -y api-anything
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
API_ANYTHING_TOKENConfiguration, not credentials: API_ANYTHING_ALLOW_IMPORT, API_ANYTHING_BROWSER, API_ANYTHING_BROWSER_ROOTS, API_ANYTHING_HOME, API_ANYTHING_KEY, API_ANYTHING_PACE, API_ANYTHING_PLAINTEXT, CODEX_HOME, DBUS_SESSION_BUS_ADDRESS, HERMES_HOME, NODE_TEST_CONTEXT, PATHEXT, XDG_RUNTIME_DIR
Where it talks to
no vendor host named in the codeAlso site.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names site.com as well as its own vendor. The guard injects API_ANYTHING_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y api-anything

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.5sprocessdependency install exit 0
29sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-tLYqRI/task/home/work/acme-api/.claude/skills/api-anything/dist/browser.js' } Node.js v22.23.4
29sprocessscript backend runs setup only
29sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/setup.js:26 · npx invocation of non-well-known package — may execute untrusted code* Whether an entry is the npx one setup writes, pinned or not: only such an entry may have its pinFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/stats.js:98 · npx invocation of non-well-known package — may execute untrusted codelines.push("npx -y api-anything setup", REPO);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/setup.ts:46 · npx invocation of non-well-known package — may execute untrusted code* Whether an entry is the npx one setup writes, pinned or not: only such an entry may have its pinFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:18 · npx invocation of non-well-known package — may execute untrusted code/** The npx entry, unpinned (`npx` fetches the newest release at each start) or pinned to this version. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:23 · npx invocation of non-well-known package — may execute untrusted code/** The entry for agents that start from the user's shell (Claude Code, Codex) and so find npx on PATH. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:1671 · npx invocation of non-well-known package — may execute untrusted code// pinned: npx fetches exactly this version at each start, not the newest releaseFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/cli.ts:370 · npx invocation of non-well-known package — may execute untrusted code--pin with --print-config: the npx form pinned to this version (api-anything@<version>)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/store.js:261 · File type combined with upload action — agent may exfiltrate local data files* last request of an hour. The slots are kept in pace.json and the counts in sends.json, both underFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/setup.ts:175 · npx invocation of non-well-known package — may execute untrusted code* The entry for a GUI app (Cursor, Claude Desktop, VS Code). It starts with a minimal PATH, where npx from nvm orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/skill.js:5 · npx invocation of non-well-known package — may execute untrusted code* runs through `npx -y api-anything` and so is always the latest release while a copy is not:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/cli.ts:395 · npx invocation of non-well-known package — may execute untrusted codeConnects the MCP server (npx -y api-anything mcp) to the agents you choose: Claude Code, Codex,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:119 · npx invocation of non-well-known package — may execute untrusted code* Homebrew is not found: so the npx setup would run, by its absolute path, with node's directory on PATHFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:311 · npx invocation of non-well-known package — may execute untrusted code--pin with --print-config: the npx form pinned to this version (api-anything@<version>)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/setup.ts:279 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesnext = { ...cur, ...(r.args ? { args: r.args } : {}), ...(r.path ? { env: { ...env, PATH: r.path } } : {}) };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/setup.js:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesnext = { ...cur, ...(r.args ? { args: r.args } : {}), ...(r.path ? { env: { ...env, PATH: r.path } } : {}) };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/setup.ts:37 · npx invocation of non-well-known package — may execute untrusted code/** The npx entry, unpinned (`npx` fetches the newest release at each start) or pinned to this version. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/cli.ts:1823 · npx invocation of non-well-known package — may execute untrusted code// pinned: npx fetches exactly this version at each start, not the newest releaseFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:118 · npx invocation of non-well-known package — may execute untrusted code* The entry for a GUI app (Cursor, Claude Desktop, VS Code). It starts with a minimal PATH, where npx from nvm orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcp.ts:180 · npx invocation of non-well-known package — may execute untrusted code? `${out} (api-anything is a CLI: run it in your shell, as npx -y api-anything when the command is not installed; with no shell, ask the user)`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/mcp.js:136 · npx invocation of non-well-known package — may execute untrusted code? `${out} (api-anything is a CLI: run it in your shell, as npx -y api-anything when the command is not installed; with no shell, ask the user)`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/setup.ts:144 · npx invocation of non-well-known package — may execute untrusted code* `added`: connected now. `unchanged`: already exactly this. `updated`: setup's npx entry, its pin movedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/skill.ts:5 · npx invocation of non-well-known package — may execute untrusted code* runs through `npx -y api-anything` and so is always the latest release while a copy is not:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/setup.ts:42 · npx invocation of non-well-known package — may execute untrusted code/** The entry for agents that start from the user's shell (Claude Code, Codex) and so find npx on PATH. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/stats.ts:128 · npx invocation of non-well-known package — may execute untrusted codelines.push("npx -y api-anything setup", REPO);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:336 · npx invocation of non-well-known package — may execute untrusted codeConnects the MCP server (npx -y api-anything mcp) to the agents you choose: Claude Code, Codex,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionsrc/store.ts:372 · File type combined with upload action — agent may exfiltrate local data files* last request of an hour. The slots are kept in pace.json and the counts in sends.json, both underFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈63 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for api-anything@0.4.0 as of 5d ago. This is the package itself, not its dependencies.