appfolio-hello-world
Facilitates querying AppFolio properties, units, and tenants through its REST API for efficient property management.
Install this skill
Security score
The appfolio-hello-world skill was audited on May 19, 2026 and we found 17 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 40 | `${process.env.APPFOLIO_CLIENT_ID}:${process.env.APPFOLIO_CLIENT_SECRET}` |
Template literal with variable interpolation in command context
| 42 | const res = await fetch(`${APPFOLIO_BASE}${path}`, { |
Template literal with variable interpolation in command context
| 43 | headers: { Authorization: `Basic ${credentials}`, Accept: "application/json" }, |
Template literal with variable interpolation in command context
| 45 | if (!res.ok) throw new Error(`AppFolio ${res.status}: ${await res.text()}`); |
Template literal with variable interpolation in command context
| 54 | console.log(`Found ${properties.length} properties`); |
Template literal with variable interpolation in command context
| 55 | properties.forEach((p: any) => console.log(` ${p.id}: ${p.address_line1}, ${p.city}`)); |
Template literal with variable interpolation in command context
| 61 | const tenants = await appfolioFetch(`/tenants?property_id=${properties[0].id}`); |
Template literal with variable interpolation in command context
| 62 | tenants.forEach((t: any) => console.log(` ${t.name} — Unit ${t.unit_number}`)); |
Template literal with variable interpolation in command context
| 68 | const workOrder = await fetch(`${APPFOLIO_BASE}/work_orders`, { |
Template literal with variable interpolation in command context
| 71 | Authorization: `Basic ${Buffer.from(`${process.env.APPFOLIO_CLIENT_ID}:${process.env.APPFOLIO_CLIENT_SECRET}`).toString("base64")}`, |
Fetch to external URL
| 53 | const properties = await appfolioFetch("/properties?page_size=10"); |
Access to .env file
| 36 | const APPFOLIO_BASE = process.env.APPFOLIO_BASE_URL || "https://yourcompany.appfolio.com/api/v1"; |
Access to .env file
| 40 | `${process.env.APPFOLIO_CLIENT_ID}:${process.env.APPFOLIO_CLIENT_SECRET}` |
Access to .env file
| 71 | Authorization: `Basic ${Buffer.from(`${process.env.APPFOLIO_CLIENT_ID}:${process.env.APPFOLIO_CLIENT_SECRET}`).toString("base64")}`, |
External URL reference
| 36 | const APPFOLIO_BASE = process.env.APPFOLIO_BASE_URL || "https://yourcompany.appfolio.com/api/v1"; |
External URL reference
| 99 | - [AppFolio Stack APIs](https://www.appfolio.com/stack/partners/api) |
External URL reference
| 100 | - [AppFolio Engineering Blog](https://engineering.appfolio.com) |