AIR Security discloses that OpenAI's official render-deploy skill directs production tokens to an unregistered domain
AIR Security found that the render-deploy skill in OpenAI's official skill repository references the domain render-internal.com, which does not belong to Render. After registering the domain and pointing it to a passive sinkhole, a real application sent requests with tokens and credentials to that domain as instructed by the skill. When reproducing with Codex, the domain appeared in the generated application code and deployment configuration. Render removed all render-internal.com references from the skill on August 14, 2026 (commit 5152e543), OpenAI removed the Render plugin from openai/plugins on August 26 (commit 33bd9529), and the domain has been transferred to Render for secure custody. AIR recommends that security teams treat skills and the domains, URLs, APIs, and other external resources they reference as part of the attack surface.
The material reconstructs the full chain where the official skill references an unregistered domain and a real application sends credentials to the attacker's server, enabling investigation of external dependencies of Agent skills.