Huckleberry

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:40 AM UTC
• Version: 0.1.0

Overview

This skill is coherent for Huckleberry baby tracking, but it handles live child-health account data and credentials through an under-hardened install and credential setup.

Review this before installing if you are comfortable giving a local CLI and its third-party dependency live access to your Huckleberry account. Prefer a pinned reviewed dependency, avoid storing the account password in plaintext if possible, and if you use the config file keep it private with restrictive permissions. Expect write commands to change real Huckleberry records immediately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:23
• Finding: Unpinned Third-Party Dependency Allows Mutable Upstream Code Installation## Vulnerability Details **File Location**: `SKILL.md:23-30` **Vulnerability Type**: Supply-chain risk from an unpinned dependency **Risk Level**: High **Vulnerable Code:** ```markdown 1. Install the API: ```bash # Install from GitHub (required for bottle feeding support until next PyPI release) pip install git+https://github.com/Woyken/py-huckleberry-api.git # or with uv: uv pip install git+https://github.com/Woyken/py-huckleberry-api.git ``` ``` The package metadata also declares the dependency without an exact version: ```yaml requires: bins: ["python3"] packages: ["huckleberry-api"] install: - id: pip-huckleberry kind: pip package: huckleberry-api label: Install huckleberry-api (pip) ``` ### Technical Analysis The installation commands retrieve the current content of a remote Git repository without specifying a reviewed release tag or immutable commit hash. Consequently, the code installed by users can change after this Skill has been audited. The metadata installation path similarly does not pin an exact package version. Python package installation may execute build backend logic, while installed package code executes when imported by `scripts/hb.py`. The dependency is especially sensitive because it receives the user's Huckleberry email and password and provides the authenticated Firebase/Firestore client. The documentation and metadata also use different dependency sources: the documentation installs directly from GitHub, while the metadata names a package resolved through the configured package index. This creates non-reproducible installations and makes it difficult to determine which implementation has been reviewed. No evidence establishes that the current upstream project is malicious. The vulnerability is that the Skill trusts mutable, externally controlled package content without version or integrity controls. ### Attack Path 1. An attacker c ...[truncated 1349 chars]
• Remediation: ## Remediation Suggestions 1. Pin the Git dependency to a reviewed immutable commit: ```bash pip install "huckleberry-api @ git+https://github.com/Woyken/py-huckleberry-api.git@FULL_COMMIT_SHA" ``` 2. Prefer a reviewed, fixed release from a trusted package index when the required functionality is available. 3. Pin the exact dependency version in Skill metadata rather than using the unqualified `huckleberry-api` name. 4. Use a lock file or constraints file to pin transitive dependencies. 5. Require package hashes where the installation mechanism supports them, such as `pip install --require-hashes`. 6. Ensure the metadata and documentation install the same reviewed artifact. 7. Perform dependency vulnerability and provenance checks in CI, and update pins only after reviewing upstream changes. 8. Install dependencies in an isolated virtual environment under a non-privileged account.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hb.py:27
• Finding: Reusable Account Password Stored in Plaintext Without Permission Enforcement## Vulnerability Details **File Location**: `scripts/hb.py:27-47`; documented at `SKILL.md:32-46` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium **Vulnerable Code:** ```python def get_credentials() -> tuple[str, str, str]: """Get credentials from environment or config file.""" email = os.environ.get("HUCKLEBERRY_EMAIL") password = os.environ.get("HUCKLEBERRY_PASSWORD") timezone = os.environ.get("HUCKLEBERRY_TIMEZONE", "America/Los_Angeles") if not email or not password: config_path = Path.home() / ".config" / "huckleberry" / "credentials.json" if config_path.exists(): with open(config_path) as f: creds = json.load(f) email = email or creds.get("email") password = password or creds.get("password") timezone = creds.get("timezone", timezone) if not email or not password: print("Error: Missing credentials. Set HUCKLEBERRY_EMAIL and HUCKLEBERRY_PASSWORD", file=sys.stderr) print("Or create ~/.config/huckleberry/credentials.json with {\"email\": ..., \"password\": ...}", file=sys.stderr) sys.exit(1) return email, password, timezone ``` The corresponding setup instructions are: ```markdown - Config file at `~/.config/huckleberry/credentials.json`: ```json { "email": "[e-mail]", "password": "your-password", "timezone": "America/Los_Angeles" } ``` ``` ### Technical Analysis Authentication is necessary for the declared baby-tracking functionality, and the script accesses only the explicitly documented credential file rather than searching unrelated secret locations. This access therefore does not, by itself, exceed the minimum functional privileges required. The security issue is the recommended storage of a reusable account password in plaintext without enfor ...[truncated 2536 chars]
• Remediation: ## Remediation Suggestions 1. Prefer an operating-system credential manager such as Keychain, Secret Service, Credential Manager, or a dedicated secret-management service. 2. Prefer scoped, revocable, short-lived tokens over storing a reusable account password when supported by the upstream service. 3. If a file must be supported, document a secure creation procedure: ```bash umask 077 install -d -m 700 ~/.config/huckleberry install -m 600 /dev/null ~/.config/huckleberry/credentials.json ``` 4. Before reading the file, use `lstat()` to reject symbolic links and verify that it is a regular file owned by the current user. 5. Check the permission mode and refuse to load files accessible by group or other users: ```python import stat info = config_path.lstat() if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode): raise RuntimeError("Credential path must be a regular, non-symlink file") if info.st_uid != os.getuid() or info.st_mode & 0o077: raise RuntimeError("Credential file must be owned by the current user with mode 0600") ``` 6. Avoid printing secret values in errors, diagnostics, or debug logs. The current code does not print loaded values; preserve this behavior. 7. Clearly warn users not to place the file in synchronized or shared directories and not to reuse the password across services. 8. Consider separating non-secret timezone configuration from authentication secrets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description frames the skill as simple natural-language logging, but the documentation shows broader capabilities: reading children/history data, querying growth/history, and directly modifying Firestore documents. This mismatch can mislead users and orchestrators about the true data access and mutation surface, undermining informed consent and policy enforcement.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

install:
      - id: pip-huckleberry
        kind: pip
        package: huckleberry-api
        label: Install huckleberry-api (pip)
---

# Huckleberry Baby Tracker

Track baby activities (sleep, feeding, diapers, growth) via the Huckleberry app's Firebase backend.

## Setup

1. Install the API:
   ```bash
   # Install from GitHub (required for bottle feeding support until next PyPI release)
   pip install git+https://github.com/Woyken/py-huckleberry-api.git
   # or with uv:
   uv pip install git+https://github.com/Woyken/py-huckleberry-api.git
   ```

2. Configure credentials (choose one):
   - Environment variables:
     ```bash
     export HUCKLEBERRY_EMAIL="[e-mail]"
     export HUCKLEBERRY_PASSWORD="your-password"
     export HUCKLEBERRY_TIMEZONE="America/Los_Angeles"  # optional
     ```
   - Config file at `~/.config/huckleberry/credentials.json`:
     ```json
     {
       "email": "[e-mail]",
       "password": "your-password",
       "timezone":

• Confidence: 92% confidence
• Finding: The setup instructions direct installation from a GitHub repository via `pip install git+https://...`, which executes unpinned remote package code during installation. This introduces a software supply-chain risk: if the repository, dependency tree, or referenced branch changes or is compromised, arbitrary code could run on the host during install.

Credential Access

High

• Category: Privilege Escalation

Content

export HUCKLEBERRY_PASSWORD="your-password"
     export HUCKLEBERRY_TIMEZONE="America/Los_Angeles"  # optional
     ```
   - Config file at `~/.config/huckleberry/credentials.json`:
     ```json
     {
       "email": "[e-mail]",

• Confidence: 88% confidence
• Finding: The skill relies on access to stored credentials in a local configuration file containing plaintext email and password. Even though this is normal setup documentation, it creates a high-value secret exposure point because any over-permissioned agent, local user, or compromised process could retrieve credentials and access the associated Huckleberry account.

Credential Access

High

• Category: Privilege Escalation

Content

Requires: pip install huckleberry-api
Auth: Set HUCKLEBERRY_EMAIL and HUCKLEBERRY_PASSWORD environment variables,
      or use a credentials file at ~/.config/huckleberry/credentials.json

Created with AI - 2026-01-27
"""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

Requires: pip install huckleberry-api
Auth: Set HUCKLEBERRY_EMAIL and HUCKLEBERRY_PASSWORD environment variables,
      or use a credentials file at ~/.config/huckleberry/credentials.json

Created with AI - 2026-01-27
"""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

timezone = os.environ.get("HUCKLEBERRY_TIMEZONE", "America/Los_Angeles")
    
    if not email or not password:
        config_path = Path.home() / ".config" / "huckleberry" / "credentials.json"
        if config_path.exists():
            with open(config_path) as f:
                creds = json.load(f)

• Confidence: 88% confidence
• Finding: The script loads an email and password from a plaintext credentials file in the user's home directory. If that file is readable by other local users, synced to cloud backup, or accidentally exposed, an attacker could obtain valid Huckleberry account credentials and access sensitive baby-tracking data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries despite requiring environment-based credentials and account access. In an agent setting, missing scope metadata increases the chance the skill can read secrets or perform account actions without clear user consent or runtime restriction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description and usage guidance do not prominently warn that commands create, modify, and sync live records in the user's Huckleberry account. Without that warning, users may treat commands as local/test actions and unintentionally alter real baby-tracking data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to store and provide account credentials but does not include security guidance on secret storage, least privilege, file permissions, or risks of exposing account passwords. This can lead to insecure handling of live credentials for a third-party service, increasing the likelihood of credential theft or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code reads HUCKLEBERRY_EMAIL and HUCKLEBERRY_PASSWORD from environment variables or a local credentials file, then uses them to authenticate to a remote service. While the module docstring notes the credentials are required, there is no explicit user-facing warning about accessing sensitive credentials or transmitting them over the network during authentication.

Session Persistence

Medium

• Category: Rogue Agent

Content

if not email or not password:
        print("Error: Missing credentials. Set HUCKLEBERRY_EMAIL and HUCKLEBERRY_PASSWORD", file=sys.stderr)
        print("Or create ~/.config/huckleberry/credentials.json with {\"email\": ..., \"password\": ...}", file=sys.stderr)
        sys.exit(1)
    
    return email, password, timezone

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The helper updates the most recent interval document in Firestore, and later commands use it to persist notes and other tracking data. Although success messages are printed after completion, there is no prior disclosure in help text or comments warning users that these commands directly alter remote account data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This command bypasses a higher-level API helper and directly adds a document to the remote Firestore collection, changing persisted baby sleep history. The code prints a success message afterward, but the CLI help and command description do not explicitly warn that invoking the command will immediately create a remote record.

Static analysis

No suspicious patterns detected.