SCRAPYARD

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:59 PM UTC
• Version: 1.0.0

Overview

This skill does what it says for a SCRAPYARD game bot, but it stores the bot API key in a plain local file that users should protect.

Install only if you are comfortable with the skill contacting the SCRAPYARD service and saving a bot API key under ~/.scrapyard/credentials.json. After registration, set the credential file to owner-only permissions, avoid sharing it, and remove or rotate the key if the file may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/register.sh:31

Finding

Credential File Created Without Restrictive Permissions

Content

View full analysis

~/.scrapyard/credentials.json << EOF { "botId": "$BOT_ID", "apiKey": "$API_KEY", "botName": "$NAME", "avatar": "$AVATAR" } EOF echo "✅ Bot registered successfully!" echo " Name: $NAME $AVATAR" echo " ID: $BOT_ID" echo " Credentials saved to ~/.scrapyard/credentials.json" ``` ### Technical Analysis The script stores a bearer API key in a plaintext JSON file but does not explicitly restrict permissions on either the containing directory or the credential file. Their permissions therefore depend on the invoking process's ambient `umask`. With a common `022` umask, `~/.scrapyard` may be created with mode `755` and `credentials.json` with mode `644`. On a multi-user system, this can allow other local accounts to traverse the directory and read the API key. Persisting the credential is necessary for the declared join and leave functionality, so access to this path does not exceed the functional scope by itself. The vulnerability is the failure to apply least-privilege filesystem permissions when storing the secret. ### Attack Path 1. The victim runs `scripts/register.sh` under a permissive `umask`, such as `022`. 2. The script creates `~/.scrapyard/credentials.json` without setting an explicit restrictive mode. 3. Another local account enumerates or directly reads the credential file. 4. The attacker extracts the `botId` and bearer `apiKey`. 5. The attacker submits authenticated requests to the documented SCRAPYARD endpoints using the stolen credentials. This path requires local filesystem access under an account permitted by the resulting file and directory modes. ### Impact Assessment A successful attacker can impersonate the registered SCRAPYARD bot within the privileges granted to its API key. Th ...[truncated 359 chars]

Remediation

View remediation

"$tmp_file" chmod 600 "$tmp_file" mv "$tmp_file" "$CREDS_FILE" ``` Additional hardening measures: - Verify that the credential directory is owned by the current user before writing into it. - Reject symbolic links and unexpected file types at the destination. - Use an atomic temporary-file-and-rename operation to avoid partially written credentials. - Use `jq --arg` rather than interpolating user and server values into JSON, ensuring quotes and control characters are escaped correctly. - Consider an operating-system credential store where available. - Document that the bearer key must not be shared and provide a revocation or rotation procedure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The credential file contains an API key and bot identifier, and the skill explicitly defines a predictable filesystem path for it. Referencing and normalizing access to that file increases the chance that agent workflows or other tools will read, expose, or mishandle secrets stored there.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Credentials Storage

Store credentials in ~/.scrapyard/credentials.json:

json

{
  "botId": "uuid-here",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The first-time setup workflow instructs the agent to check for and then create a local credential file containing secrets. This operationalizes credential handling without any safeguards around permission setting, redaction, user consent, or secure storage, making accidental exposure more likely.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

## Workflows

### First Time Setup
1. Check if `~/.scrapyard/credentials.json` exists
2. If not, ask user for bot name and avatar preference
3. Register bot via API
4. Save credentials to `~/.scrapyard/credentials.json`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The workflow step to save credentials to ~/.scrapyard/credentials.json directly instructs persistent plaintext storage of an API key. Because the key is only shown once, users may be encouraged to retain it indefinitely in an insecure location, compounding the risk of later compromise.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

1. Check if `~/.scrapyard/credentials.json` exists
2. If not, ask user for bot name and avatar preference
3. Register bot via API
4. Save credentials to `~/.scrapyard/credentials.json`
5. Confirm registration and show bot details

### Join a Game

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The join workflow requires loading credentials from the local file, meaning any execution path for this skill depends on accessing a stored secret. In the context of an agent skill with broad triggers and shell capability, this increases the blast radius if the skill is invoked unexpectedly or logs/debugging capture file contents.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

5. Confirm registration and show bot details

### Join a Game
1. Load credentials from `~/.scrapyard/credentials.json`
2. Check `/api/status` for next game time
3. Call `/api/join` with bot credentials
4. Report queue position and estimated wait time

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/join.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# Leave the SCRAPYARD queue
# Requires credentials in ~/.scrapyard/credentials.json

set -e

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/join.sh (reported line 7)May include surrounding context.

sh

#!/bin/bash
# Leave the SCRAPYARD queue
# Requires credentials in ~/.scrapyard/credentials.json

set -e

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/leave.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# Leave the SCRAPYARD queue
# Requires credentials in ~/.scrapyard/credentials.json

set -e

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/leave.sh (reported line 7)May include surrounding context.

sh

#!/bin/bash
# Leave the SCRAPYARD queue
# Requires credentials in ~/.scrapyard/credentials.json

set -e

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/register.sh (reported line 47)May include surrounding context.

sh

#!/bin/bash
# Leave the SCRAPYARD queue
# Requires credentials in ~/.scrapyard/credentials.json

set -e

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The script stores an API key in a predictable plaintext file under the user's home directory, making credential access easier for any local process, malware, backup system, or another user with access to that account. Because the file path is fixed and the secret is long-lived, compromise of the host can directly yield unauthorized bot control.

Content

Scanner excerpt · scripts/register.sh (reported line 35)May include surrounding context.

sh

# Save credentials
mkdir -p ~/.scrapyard
cat > ~/.scrapyard/credentials.json << EOF
{
  "botId": "$BOT_ID",
  "apiKey": "$API_KEY",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill contains shell-based operational instructions (curl commands) but does not declare any tool scope or allowed-tools restrictions. In an agent environment, this can enable unintended command execution capability without clear sandboxing or user-consent boundaries, increasing the risk of misuse or overreach.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad phrases like 'compete' and 'similar gaming requests,' which can cause the skill to activate in contexts unrelated to this specific service. Overbroad activation increases the chance that an agent invokes external network actions or credential workflows when the user did not intend to use SCRAPYARD.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs storing a persistent API key in a plaintext local file under the user's home directory without any warning about secrecy, file permissions, or secure storage. This creates a realistic risk of credential theft by other local processes, accidental disclosure, or inclusion in backups/logs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Check Status (no auth)

bash

curl https://scrapyard-game-server-production.up.railway.app/api/status

Returns: {status, version, nextGameTime, currentGame, queueSize, viewerCount}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/join.sh (reported line 19)May include surrounding context.

sh

API_KEY=$(jq -r '.apiKey' "$CREDS_FILE")
BOT_NAME=$(jq -r '.botName' "$CREDS_FILE")

RESPONSE=$(curl -s -X POST "https://scrapyard-game-server-production.up.railway.app/api/join" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"botId\": \"$BOT_ID\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/leave.sh (reported line 18)May include surrounding context.

sh

API_KEY=$(jq -r '.apiKey' "$CREDS_FILE")
BOT_NAME=$(jq -r '.botName' "$CREDS_FILE")

RESPONSE=$(curl -s -X POST "https://scrapyard-game-server-production.up.railway.app/api/leave" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"botId\": \"$BOT_ID\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The script transmits user-supplied bot metadata to an external service and receives credentials back, which is inherently security-relevant because it sends data off-host and establishes trust with a remote API. In this gaming skill, contacting the service is expected, but it still creates risk because users may not realize registration sends data externally and retrieves secrets that will later be stored locally.

Content

Scanner excerpt · scripts/register.sh (reported line 17)May include surrounding context.

sh

fi

# Register the bot
RESPONSE=$(curl -s -X POST "https://scrapyard.fun/api/bots" \
  -H "Content-Type: application/json" \
  -d "{\"name\": \"$NAME\", \"avatar\": \"$AVATAR\"}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes a newly issued API key to ~/.scrapyard/credentials.json automatically, without warning the user or asking for consent. In an agent-skill context, silently persisting credentials increases the chance of long-lived secret exposure on shared systems, backups, or through later compromise of the user account.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The script creates a persistent credentials directory and file, causing the session token/API key to survive beyond the immediate registration flow. In an agent environment, unnecessary persistence increases exposure duration and broadens the attack surface because later processes or users may recover and reuse the saved secret.

Content

Scanner excerpt · scripts/register.sh (reported line 34)May include surrounding context.

sh

API_KEY=$(echo "$RESPONSE" | jq -r '.data.apiKey')

# Save credentials
mkdir -p ~/.scrapyard
cat > ~/.scrapyard/credentials.json << EOF
{
  "botId": "$BOT_ID",

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This shell script reads credentials from a local file and sends an authenticated POST request to a remote server using the API key and bot ID. While there are comments noting that credentials are required, there is no runtime disclosure or confirmation that the script will contact an external service and use those credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.