surrealfs

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:24 PM UTC
• Version: 1.2.1

Overview

The skill is mostly transparent about its virtual filesystem purpose, but it documents a host command execution feature that needs careful review before installation.

Install only in an isolated development environment unless you understand the command-execution feature. Avoid exposing the HTTP server publicly, disable or audit telemetry for sensitive data, use least-privilege SurrealDB credentials, avoid command-line passwords for real secrets, and prefer pinned package versions or verified releases.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:96
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:96` and `SKILL.md:105` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install the Rust core cargo install surrealfs ``` ```bash # Install the Python agent pip install surrealfs-ai ``` ### Technical Analysis The documented installation commands retrieve mutable package versions without specifying an exact version, package hash, lockfile, signature, or other artifact verification mechanism. Although the metadata references an upstream commit, the installation commands do not bind the installed packages to that commit. Consequently, the code installed by a user can differ from the version that was reviewed. A compromised package publisher, registry account, release artifact, or transitive dependency could introduce attacker-controlled code. Package installation or subsequent package execution may then run that code with the privileges of the user following the instructions. The repository contains only `SKILL.md`; therefore, no dependency manifests or integrity controls elsewhere in the project were available to mitigate this exposure. ### Attack Path 1. An attacker compromises the `surrealfs` or `surrealfs-ai` publishing account, package registry entry, release process, or a resolved transitive dependency. 2. The attacker publishes a malicious package version that becomes the version selected by an unpinned installation. 3. A user follows the Quick Start instructions and runs `cargo install surrealfs` or `pip install surrealfs-ai`. 4. The package manager downloads the attacker-controlled release. 5. Malicious code executes during installation, import, startup, or normal package operation. ### Impact Assessment Exploitation could provide code execution with the privileges of the installing or executing user. Depending on the environment, this may expose local files, environ ...[truncated 226 chars]
• Remediation: ## Remediation Suggestions - Pin both packages to exact, reviewed versions in every installation example. - Use Rust lockfiles and Python hash-locked dependency files where applicable. - Require package hashes or verified signatures for release artifacts. - Document the expected package registry and verify package ownership and provenance. - Bind documented package releases to the reviewed upstream commit. - Use isolated virtual environments or containers and avoid installing packages with administrative privileges. - Add a controlled dependency-update process that reviews changes before updating pins.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:134
• Finding: Host Command Execution Through Pipe Syntax## Vulnerability Details **File Location**: `SKILL.md:134-140` **Vulnerability Type**: Potential command injection through externally constructed pipe commands **Risk Level**: High ### Vulnerable Code ```text **Pipe commands**: The Rust core supports `curl URL > /path` syntax for content ingress. This executes the pipe source command on the host. Use only with trusted URLs in controlled environments. Do not allow untrusted input to construct pipe commands. **Sandboxing**: The virtual FS root (`/`) is a SurrealDB-backed abstraction, not the host filesystem. Path traversal (e.g., `../../etc/passwd`) is normalized and rejected. However, pipe commands execute on the host -- run in a container or sandbox if accepting untrusted agent input. ``` ### Technical Analysis The documented pipe feature crosses the virtual-filesystem security boundary and executes the pipe source on the host. If an AI-generated value, user request, retrieved document, or other untrusted input can influence the command string, shell metacharacters or command substitutions may alter the intended command and cause arbitrary host command execution. Virtual-path normalization does not mitigate this risk because it protects the SurrealDB-backed filesystem namespace, while the pipe source is executed by the host operating system. The documentation warns users about this behavior, but it does not describe an enforceable executable allowlist, shell-free argument handling, input validation, or mandatory sandbox. The implementation is not included in the audited project, so the exact parser and available injection syntax could not be verified. The dangerous host-execution capability itself is explicitly documented. ### Attack Path 1. The Skill is deployed in an agent workflow that permits users or retrieved content to influence filesystem commands. 2. An attacker supplies input designed to be incorporated into the pipe source or URL. 3. The agent co ...[truncated 802 chars]
• Remediation: ## Remediation Suggestions - Remove support for generic host shell commands from the virtual-filesystem interface. - Implement HTTP content ingestion directly through a networking library rather than invoking `curl`. - If external execution is unavoidable, invoke a fixed executable using a structured argument array without a shell. - Enforce strict URL parsing, permitted schemes, destination allowlists, redirect limits, response-size limits, and timeouts. - Prevent access to loopback, link-local, private, metadata-service, and other sensitive network destinations where appropriate. - Do not permit AI-generated or user-controlled values to select executables or add command arguments. - Run the process as a dedicated, unprivileged account in a restricted container or sandbox with a read-only host filesystem. - Restrict outbound networking and remove unnecessary credentials from the execution environment. - Add tests for shell metacharacters, command substitution, argument injection, malformed URLs, and indirect prompt-injection inputs.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:102
• Finding: Database Password Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:102` **Vulnerability Type**: Insecure credential handling and privileged default credentials **Risk Level**: Low ### Vulnerable Code ```bash # Or connect to a remote SurrealDB instance surrealfs --endpoint ws://localhost:8000 --user root --pass root --ns agent --db workspace ``` ### Technical Analysis The example passes the database password through the `--pass` command-line argument. Command-line secrets can be retained in shell history and may be exposed through process inspection, diagnostic reports, terminal logging, audit tooling, or command-recording systems. The example also uses the privileged-looking `root` account with the password `root`. Although the later Security Considerations section warns against using root credentials in shared or production environments, the executable Quick Start example may encourage insecure copying or substitution of a real password into the same command-line pattern. ### Attack Path 1. A user copies the example and either retains the default credentials or substitutes a real database password. 2. The command is stored in shell history, terminal logs, process metadata, or monitoring output. 3. Another local user, support operator, diagnostic collector, or compromised process obtains the command. 4. The exposed credentials are used to authenticate to the configured SurrealDB service. 5. The attacker accesses the namespace, database, and records permitted to that account. ### Impact Assessment The impact depends on the privileges assigned to the exposed account. A least-privilege account may expose only one namespace or database, while a root or administrative account could permit broad reading, modification, deletion, schema changes, or account administration. Exposure is most consequential on shared hosts or when the database endpoint is remotely reachable.
• Remediation: ## Remediation Suggestions - Remove literal `root/root` credentials from the Quick Start example. - Demonstrate a dedicated, least-privilege account scoped to the required namespace and database. - Obtain passwords through an interactive prompt, protected credential file, operating-system key store, or secret manager. - If environment variables are supported, explain their process-environment exposure and use them only with appropriate runtime isolation. - Mark all sample credentials as nonfunctional placeholders. - Prefer encrypted transport for remote connections and document certificate verification requirements. - Advise users to disable shell-history recording temporarily only as a secondary control, not as a replacement for safe secret input. - Rotate any credential suspected of appearing in command history, logs, or process captures.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation

Content

construct pipe commands.

**Sandboxing**: The virtual FS root (`/`) is a SurrealDB-backed abstraction,
not the host filesystem. Path traversal (e.g., `../../etc/passwd`) is
normalized and rejected. However, pipe commands execute on the host -- run
in a container or sandbox if accepting untrusted agent input.

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.