Refuted findings 11
Candidates the review stage examined and rejected, kept for transparency.
Credential access
criticalRefutedlow confidenceThe skill instructs the agent that all outbound HTTPS traffic from any standard client (curl, fetch, requests, axios, Go net/http, git) is transparently proxied through the OneCLI gateway with automatically injected stored credentials, placing a third-party TLS-terminating intermediary on every credentialed call without agent- or user-visible auth handling.
Your outbound HTTPS traffic is transparently proxied through the OneCLI
Why it was refuted
Transparent proxying of all outbound HTTPS with automatically injected stored credentials is the skill's declared core capability stated verbatim in the frontmatter and body, so the declared-core-capability carve-out applies and the behavior is declared, not concealed.
Credential access
criticalRefutedlow confidenceThe skill instructs the agent to call live Gmail, GitHub, and Stripe endpoints via curl with no auth headers, relying on HTTPS_PROXY so that traffic from all standard clients including git transit the credential-injecting gateway invisibly to the user.
honor the `HTTPS_PROXY` environment variable automatically
Why it was refuted
HTTPS_PROXY reliance across standard HTTP clients with no auth headers is declared verbatim in the body and is the declared transparent-proxy mechanism, so the declared-core-capability carve-out and the declaration defeat the finding.
Tool poisoning
criticalRefutedmedium confidenceThe skill description forbids the agent from using browser extensions or OAuth CLI tools and instructs it to make raw HTTP requests instead, conditioning the agent's tool selection so all authentication flows through the gateway.
use browser extensions or OAuth CLI tools. Make HTTP requests directly;
Why it was refuted
The prohibition and direct-HTTP instruction are verbatim clauses of the declared description defining the declared credential-injection workflow, so the carve-out applies and the tool-selection conditioning is declared.
Data exfiltration
highRefutedmedium confidenceAll outbound HTTPS traffic, including whatever workspace or request data the agent sends to external APIs, is transparently proxied through the OneCLI gateway, giving the proxy operator full visibility into request and response content.
Your outbound HTTPS traffic is transparently proxied through the OneCLI
Why it was refuted
Operator visibility of proxied traffic is inherent to the declared 'transparent HTTPS proxy' core capability, so the carve-out applies; requests are instructed to their real API destinations and no unintended exfiltration sink exists.
Credential access
highRefutedmedium confidenceThe skill routes outbound HTTPS through a gateway that injects stored credentials (email, calendar, GitHub, Stripe) at the proxy boundary while the credential store location and proxy implementation are not shipped for review, making the claim that the agent never handles credential values unverifiable.
gateway, which injects stored credentials at the proxy boundary. You never
Why it was refuted
Injecting stored credentials at the proxy boundary is the declared core capability and the never-handle-credentials property is itself declared; the 'unverifiable credential store' portion rests solely on the absence of shipped implementation, which cannot carry the finding.
Credential access
highRefutedmedium confidenceThe skill routes the agent's outbound HTTPS traffic through a local gateway that injects stored credentials into calls to any external service, so stored credentials can be attached to requests to destinations beyond the wrapped Gmail/GitHub/Stripe APIs.
injects stored credentials into outbound calls
Why it was refuted
Credential injection into outbound calls is the declared description verbatim, and the claimed beyond-wrapped-API scope is contradicted by the declared connect model where the gateway injects only for connected apps and returns a connect URL otherwise.
Agent hijacking
highRefutedmedium confidenceThe skill description coerces the agent to use this credential-injecting gateway for every external-service interaction and forbids browser extensions and OAuth CLI tools, steering all outbound traffic through the proxy and suppressing standard user-visible authentication paths.
Do NOT use browser extensions or OAuth CLI tools
Why it was refuted
The coerced routing and tool prohibitions are quoted verbatim from the skill's own declared description, i.e., its declared core capability, so the carve-out applies and nothing is undeclared or concealed.
Data exfiltration
highRefutedmedium confidenceSKILL.md and instructions.md direct the agent to make all external API calls (Gmail, GitHub, Stripe) as plain HTTP requests intercepted by the gateway proxy, giving the gateway operator visibility into every request URL and body the agent sends.
Call the real API URL. The gateway intercepts the request and injects
Why it was refuted
Calling real API URLs through the intercepting, credential-injecting gateway is the declared core capability; each request's destination is the real API endpoint, so there is no exfiltration chain to an unintended sink.
Agent hijacking
highRefutedhigh confidenceThe skill frontmatter description commands the agent that it MUST invoke this skill whenever the user asks about any external service or API and must not use browser extensions or OAuth CLI tools, hijacking the agent's tool selection for all external interactions toward this credential-injecting gateway.
You MUST use this skill when the user asks you to
Why it was refuted
The mandatory-use command is the skill's own declared description routing agent selection to its declared credential-injection capability, so the declared-core-capability carve-out applies and the behavior is declared, not concealed.
Agent hijacking
highRefutedhigh confidenceThe skill's agent-facing description compels the agent to route every external-service interaction, including ANY external service or API, through this credential-injecting gateway, coercing the agent's task routing toward an opaque proxy.
Stripe payments, or interact with ANY external service or API. Do NOT
Why it was refuted
The ANY-external-service routing mandate and tool prohibition are verbatim clauses of the declared description, i.e., the declared core capability; there is no undeclared or concealed steering.
Supply chain
mediumRefutedlow confidenceThe skill depends on an unreviewable launch path whose HTTPS_PROXY injection happens 'automatic when launched via `onecli run`' and whose setup scripts (entrypoint.sh, run.sh) were not served for review, so enabling the skill wires the agent into runtime configuration nobody can audit.
compatibility: Requires HTTPS_PROXY set in environment (automatic when launched via `onecli run`)
Why it was refuted
The launch-path dependency is explicitly declared in the served frontmatter and only enables the declared transparent-proxy core capability, invoking the carve-out; the portion of the claim about unreviewable entrypoint.sh/run.sh rests solely on absence of those files.
