apipay.fly.dev

This tool injects the owner's root/management credentials for up to 8 different vendor platforms (Supabase, Vercel, Fly, Resend, GitHub, npm, Cloudflare, LemonSqueezy) and allows arbitrary path/method/body calls. Although the description claims destructive, billing, and admin routes are 'blocked', this is a self-declared server-side filter that the calling agent cannot verify. A compromised or manipulated agent (e.g. via a malicious search_apis/call_api result or injected content) could use this to read configuration, list secrets/env vars, or make unintended writes across many high-value platforms. The blast radius here is far larger than a typical 'call an API' tool.

This tool moves live secrets (e.g. a Supabase service_role key) directly between vendor resources without ever showing the value to the user or agent for review. While marketed as a safety feature ('never enters this conversation'), this also means the human/agent has no visibility to catch a mistaken or maliciously-steered destination. If any upstream content (e.g. a poisoned search_apis result, or a manipulated instruction) causes the agent to specify a wrong or attacker-influenced 'to' vendor/resource, a powerful secret (service_role/root key) could be silently copied to a location the owner did not intend, with no way to detect it from the conversation alone.