adaptive-suite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:43 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it asks for broad API-key access and gives open-ended instructions that are under-scoped for its many advertised functions.

Review this skill before installing. It may be useful as a general assistant, but users should avoid exposing broad API-key bundles and should only allow NAS scanning or external searches for specific, user-approved tasks with clear output and storage boundaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Overbroad Access to Unspecified API Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–13
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

yaml

requires:
  bins: ["python", "node", "curl", "sqlite3"]
  env: ["FREE_API_KEYS"]

Technical Analysis

The skill requires access to the broadly named FREE_API_KEYS environment variable while also requesting network-capable tools such as curl. The instructions do not identify a specific API, trusted endpoint, credential scope, or operation that requires these credentials.

Providing unspecified API keys to a general-purpose skill violates the principle of least privilege. Because the skill is instructed to search continuously for online tools, APIs, and resources, credential material would be available in a network-enabled context involving potentially untrusted services. The reviewed file does not explicitly instruct the agent to exfiltrate credentials, but its configuration creates unnecessary exposure and allows accidental inclusion of secrets in commands, requests, generated output, or logs.

Attack Path

1. A user invokes the skill, causing its declared requirements to be made available.
2. The execution environment exposes FREE_API_KEYS to the skill.
3. The skill performs broad online resource discovery using network-capable tooling such as curl.
4. A generated request, command, diagnostic message, or integration may include a key from the environment without a defined destination allowlist.
5. The credential may consequently be disclosed to an unintended remote service, command history, execution log, or user-visible output.

This is an exposure path enabled by excessive credential access; no intentional credential theft or confirmed exfiltration behavior was present in the audited file.

Impact Assessment

Exposure could allow unauthorized use of any API accounts represented by FREE_API_KEYS, subject to the permissions ...[truncated 456 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the FREE_API_KEYS environment requirement unless credentials are essential to a concrete skill operation.
• Request credentials only when the user invokes the specific feature that needs them.
• Replace the aggregated variable with a provider-specific, narrowly scoped credential.
• Restrict each credential to the minimum required permissions, resources, and API operations.
• Apply destination allowlisting so credentials can be sent only to explicitly documented HTTPS endpoints.
• Prohibit printing, logging, interpolating into command lines, or returning credential values in generated output.
• Pass secrets through a dedicated secret manager or protected process input rather than a broadly exposed environment variable.
• Add explicit documentation identifying the credential's provider, purpose, expected scope, and retention behavior.
• Rotate any credentials that may already have been exposed through logs, shell history, or unintended network requests.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises a very broad set of capabilities across coding, business analysis, web development, data analysis, and NAS scraping without clear invocation boundaries or task-scoping rules. Overly broad skills can be triggered in many contexts, increasing the chance of inappropriate activation, unsafe tool use, or handling of sensitive data outside the author's intended scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The instruction to 'continuously search' for free online tools, APIs, and resources is ambiguous and open-ended, which can cause the agent to overreach into frequent browsing or broad resource acquisition behavior across many user requests. In combination with a user-invocable, multi-purpose skill, this weak scoping increases the risk of unintended external lookups, unreliable recommendations, or exposure to untrusted third-party content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.