OpenAI Skill Error Sent Application Secrets to a Researcher-Controlled Domain

AIR Security researchers uncovered a supply-chain flaw in an official OpenAI skills repository that caused at least one production application to send internal API requests, including an authorization token, to a domain controlled by the researchers.

The issue was in the render-deploy skill, which guides coding agents through deployments on Render. The skill incorrectly described render-internal.com as the platform's private networking domain. AIR registered that domain and configured a passive sinkhole after confirming that a coding agent could copy the reference into generated application code and deployment settings.

The sinkhole later received a health check and a token-bearing API call from a real application that believed it was contacting an internal memory service. AIR said it handled the traffic passively and coordinated remediation. The finding shows how a trusted instruction file can become part of the software supply chain even when neither the model nor the skill is malicious.

Security teams using coding agents should review agent skills like executable dependencies. That means validating domains and commands, pinning trusted versions, scanning generated configuration and preventing production secrets from being sent to unapproved destinations.