T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:132- Finding
Linear API Credential Forwarded to a Remote SSH Host
- Content
View full analysis
- Remediation
View remediation
Security audit
Oneshot Ship
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed code-shipping automation tool, but it forwards credential-bearing configuration to remote SSH hosts and installs a powerful mutable CLI globally.
Review this carefully before installing. Use it only in repositories where automated branch creation, commits, pushes, PR updates, and Linear comments are acceptable. Prefer local or dry-run mode first, pin and verify the package version if possible, and do not configure remote SSH execution unless you trust the remote host with any provider and Linear credentials in the oneshot config.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned Global Installation of a Privileged Third-Party Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md oneshot <repo> "<task>" --mode deep # skip classification and force deep mode oneshot <repo> "<task>" --workflow ship # apply a workflow preset oneshot <repo> "<task>" --deep-review # force exhaustive review oneshot <repo> "<task>" --model gpt-5.5 # override configured plan/PR model oneshot <repo> "<task>" --branch dev # target a different branch oneshot <repo> "<task>" --base-path /srv/workspaces # override repo root for this run oneshot <repo> "<task>" --worktree-root /tmp/agents # override temp worktree root
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-level description and usage framing encourage activation for broadly defined coding requests, while the skill performs high-impact actions such as code changes, commits, pushes, PR creation, and optional remote execution. That combination can cause the skill to be invoked without sufficiently explicit user intent or confirmation, increasing the chance of unintended repository modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description does not clearly warn users that the workflow can autonomously modify repositories, create branches, commit changes, push to remotes, and open or update PRs. Without a prominent warning, users may invoke the skill expecting advisory help rather than an execution pipeline with write effects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrase 'wants to delegate a coding task' is too ambiguous for a skill that can autonomously plan, edit code, run tooling, push commits, and open pull requests. In practice, many normal coding-assistance requests could match this condition and lead to over-broad or premature activation of a powerful automation workflow.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md oneshot eval --json # summarize outcomes oneshot workflow list # inspect workflow presets oneshot workflow show fix-ci --json # inspect one workflow preset oneshot policy init # create .oneshot/policy.json oneshot policy init --path ./repo # write policy in another directory oneshot mcp serve # expose MCP tools over stdio oneshot doctor # package, tool, SSH, and event health
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation states that remote SSH runs stream the active oneshot config to the server, including provider defaults, timeout settings, and configured Linear credentials, but it does not present this as a privacy/security warning. Users may not realize that sensitive configuration values or credential-bearing fields are transmitted to another host during execution.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Edit `prompts/plan.txt`, `execute.txt`, `review.txt`, `pr.txt` to change pipeline behavior - Use `oneshot policy init` to add `.oneshot/policy.json` with protected paths, required checks, approval-sensitive keywords, and secret-pattern gates - Use `oneshot mcp serve` when another agent should call oneshot through tools instead of shelling out ad hoc - For dense specs, explainers, review maps, incident reports, design sheets, or one-off editors, oneshot can create a self-contained HTML artifact instead of a long markdown wall. Durable artifacts belong in `docs/artifacts/`; throwaway local artifacts belong in `/tmp/oneshot-html-artifacts/`. ## Tips
Static analysis
No suspicious patterns detected.