Hallucinated domain found in official OpenAI skill

AIR Security researchers found that an official OpenAI skill for deploying apps on Render sent production tokens to an unregistered domain, render-internal.com. They registered the domain and received real tokens and API calls; OpenAI and Render fixed the issue in mid-August.

• The Render deployment skill sent app tokens to an unregistered domain
• AIR Security registered the domain and pointed it at a passive sinkhole
• OpenAI removed the Render plugin; Render purged all domain references
• The flaw was introduced by a January commit and fixed in mid-August