T03 · Remote Payload Retrieval and Execution
Error
- Location
setupSkill.md:66- Finding
Unpinned Remote Repository Is Cloned and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Durable Agents
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent developer purpose, but its setup guide gives an agent broad authority to run unverified code, inspect credentials, and change host/auth state without enough user control.
Do not run this setup unattended. Before installing, require a version pinned to a reviewed commit, explicit approval for sudo/Docker/database/token operations, user-provided or secret-manager credentials instead of cross-project discovery, and removal of plaintext token generation and hard-coded encryption material.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
setupSkill.md:16- Finding
Setup Instructions Suppress User Approval for Security-Sensitive Actions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
setupSkill.md:106- Finding
Credential Discovery Dumps Environment Data from Unrelated Projects and Containers
- Content
View full analysis
--format '{{json .Config.Env}}' ``` Once you have `AI_BASE_URL`, `AI_API_KEY`, and `MODEL_ID`, write them to `.env` in this project: ```bash sed -i '' "s|^AI_BASE_URL=.*|AI_BASE_URL=|" .env sed -i '' "s|^AI_API_KEY=.*|AI_API_KEY=|" .env sed -i '' "s|^MODEL_ID=.*|MODEL_ID=|" .env ``` ``` ### Technical Analysis The procedure directs the Agent to search another project for credentials and, as a fallback, dump the complete environment array of a running container. A container environment frequently contains database passwords, signing keys, service credentials, and tokens unrelated to the requested AI configuration. The command does not filter output to the three required variables. Secrets may consequently appear in the Agent transcript, terminal output, logs, or command-capture systems. Copying an existing API key into a second plaintext `.env` also expands the number of locations from which it can be stolen. No explicit network exfiltration destina ...[truncated 1249 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
setupSkill.md:182- Finding
Unattended Setup Grants Root-Equivalent Docker Access and Modifies the Host
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
setupSkill.md:298- Finding
Hard-Coded Encryption Key and Predictable Plaintext Token File Expose Trigger.dev Credentials
- Content
View full analysis
/tmp/new_pat.json && cat /tmp/new_pat.json ``` ```bash TOKEN=$(node -e "console.log(require('/tmp/new_pat.json').token)") NONCE=$(node -e "console.log(require('/tmp/new_pat.json').nonce)") CIPHER=$(node -e "console.log(require('/tmp/new_pat.json').ciphertext)") TAG=$(node -e "console.log(require('/tmp/new_pat.json').tag)") HASH=$(node -e "console.log(require('/tmp/new_pat.json').hash)") USER_ID=$(docker exec trigger-postgres-1 psql -U postgres -d postgres -t -A -c "SELECT id FROM \"User\" LIMIT 1") ``` ### Technical Analysis The encryption key is embedded directly in publicly readable Skill text. Encryption with a known static key does not protect token confidentiality from anyone who can access the encrypted database field. Although AES-GCM is a secure primitive, its protection depends on keeping the key secret and managing it independently from the ciphertext. The generated PAT is also written to the predictable path `/tmp/new_pat.json` without an explicit restrictive creation mode and is printed using `cat`. This exposes the plaintext token to terminal capture, Agent transcripts, logs, and potentially other local users or processes. The instructions do not ...[truncated 1474 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (25)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The setup explicitly instructs the agent to inspect another local project, search environment files and Docker container configuration, and extract
AI_API_KEY/model settings for reuse. That is cross-project secret harvesting without user confirmation, which violates least-privilege boundaries and could expose credentials from an unrelated system.- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions tell the agent to retrieve sensitive credentials from a separate local 'openclaw' project and running containers, then reuse them in this project, all without asking the user. In the context of an autonomous setup skill, this is especially dangerous because the skill explicitly suppresses user confirmation and encourages independent investigation of sensitive local resources.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Writing
AI_BASE_URLvalues is not secret by itself, but this line is part of a sequence that persists harvested credential material into.env. In context, it contributes to unauthorized secret handling and local storage of sensitive configuration sourced from another project.- Content
Once you have
AI_BASE_URL,AI_API_KEY, andMODEL_ID, write them to.envin this project:bash sed -i '' "s|^AI_BASE_URL=.*|AI_BASE_URL=<value>|" .env sed -i '' "s|^AI_API_KEY=.*|AI_API_KEY=<value>|" .env sed -i '' "s|^MODEL_ID=.*|MODEL_ID=<value>|" .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line writes
AI_API_KEYinto.env, creating a plaintext local copy of a sensitive credential that the instructions previously harvested from another project/container. That combines unauthorized access with insecure persistence, making compromise and later leakage more likely.- Content
bash sed -i '' "s|^AI_BASE_URL=.*|AI_BASE_URL=<value>|" .env sed -i '' "s|^AI_API_KEY=.*|AI_API_KEY=<value>|" .env sed -i '' "s|^MODEL_ID=.*|MODEL_ID=<value>|" .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Persisting
MODEL_IDis less sensitive than an API key, but here it is part of a broader secret-access workflow and may reveal provider/model usage details from another project. In context it helps operationalize unauthorized reuse of another application's AI configuration.- Content
bash sed -i '' "s|^AI_BASE_URL=.*|AI_BASE_URL=<value>|" .env sed -i '' "s|^AI_API_KEY=.*|AI_API_KEY=<value>|" .env sed -i '' "s|^MODEL_ID=.*|MODEL_ID=<value>|" .envStep 7: Smoke test
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If Step 6 failed to find real LLM credentials and
.envis missingAI_BASE_URL,AI_API_KEY, orMODEL_ID, fill them with placeholders only for this test so the worker starts:bash grep -q "^AI_API_KEY=" .env || echo "AI_API_KEY=placeholder" >> .env grep -q "^AI_BASE_URL=" .env || echo "AI_BASE_URL=http://placeholder.local/v1" >> .env grep -q "^MODEL_ID=" .env || echo "MODEL_ID=placeholder-model" >> .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If Step 6 failed to find real LLM credentials and
.envis missingAI_BASE_URL,AI_API_KEY, orMODEL_ID, fill them with placeholders only for this test so the worker starts:bash grep -q "^AI_API_KEY=" .env || echo "AI_API_KEY=placeholder" >> .env grep -q "^AI_BASE_URL=" .env || echo "AI_BASE_URL=http://placeholder.local/v1" >> .env grep -q "^MODEL_ID=" .env || echo "MODEL_ID=placeholder-model" >> .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If Step 6 failed to find real LLM credentials and
.envis missingAI_BASE_URL,AI_API_KEY, orMODEL_ID, fill them with placeholders only for this test so the worker starts:bash grep -q "^AI_API_KEY=" .env || echo "AI_API_KEY=placeholder" >> .env grep -q "^AI_BASE_URL=" .env || echo "AI_BASE_URL=http://placeholder.local/v1" >> .env grep -q "^MODEL_ID=" .env || echo "MODEL_ID=placeholder-model" >> .env
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Linux:
bash sudo apt-get update && sudo apt-get install -y docker.io docker-compose-plugin sudo systemctl start docker sudo usermod -aG docker $USER && newgrp docker
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The recovery sections direct extraction of secret keys and PATs from databases and logs, and even manual regeneration/insertion of authentication material. This teaches an agent to access and manipulate live secrets directly, expanding compromise scope and risking credential disclosure, persistence abuse, and account takeover.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These sections instruct extraction of secrets from logs, databases, and local config, followed by writing them into accessible files like
.envand CLI config. That behavior effectively operationalizes credential theft and secret redistribution, which can enable lateral movement and durable unauthorized access.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This step reads
TRIGGER_ACCESS_TOKENfrom.envfor reuse in CLI config, directly handling a live authentication token. It increases the secret's exposure surface and supports silent credential propagation to additional files and tools.- Content
If the
self-hostedprofile is missing or has a placeholder token:bash PAT=$(grep TRIGGER_ACCESS_TOKEN .env | cut -d= -f2) node -e " const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line writes a generated
TRIGGER_ACCESS_TOKENinto.env, persisting a powerful authentication secret in plaintext. Because nearby steps generate and insert the token manually into the database, this creates both an unauthorized auth artifact and an easy-to-leak local copy.- Content
text ```bash # Write to .env sed -i '' "s|^TRIGGER_ACCESS_TOKEN=.*|TRIGGER_ACCESS_TOKEN=$TOKEN|" .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Although this line is adjacent formatting/context, it belongs to the same instruction block that persists an access token to
.env. In context it is part of the vulnerable secret-handling flow and reinforces insecure local storage of auth material.- Content
bash # Write to .env sed -i '' "s|^TRIGGER_ACCESS_TOKEN=.*|TRIGGER_ACCESS_TOKEN=$TOKEN|" .envVersion mismatch (404 on /engine/v1/)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Mode | Behavior | |---|---| | `"none"` | Auto-approve. Trigger next stage immediately. | | `"agent"` | Call a reviewer agent. If approved, continue. If rejected, feed feedback back to the previous stage for revision. | | `"human"` | Set a status in the DB to `pending`. Return. A human reviews externally. Resume the pipeline via an API callback. |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The rule to run every step in sequence with no skipping or asking the user encourages fully autonomous execution of potentially sensitive actions. In this file, that autonomy is coupled with credential harvesting, DB inspection, and token manipulation, which removes an important human approval checkpoint before privileged operations.
- Content
md These apply for the entire setup without exception. 1. **Run every step in sequence.** No skipping, no asking the user whether to continue. 2. **Never stop for user input.** Every known failure has a recovery path in this file. Go there, fix it, resume. 3. **If a fix is not in this file, find the solution independently.** Read logs, inspect the DB, check config files. Do not ask the user. 4. **Never change package versions or swap libraries to fix an error.** All versions in `package.json` are pinned intentionally. If a version mismatch appears to be the problem, the fix is in the configuration — not in bumping or changing a dependency.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The instruction to 'find the solution independently' by reading logs, inspecting the DB, and checking config files, while explicitly forbidding asking the user, authorizes unsupervised exploration of sensitive assets. In context, this materially increases risk because later sections direct extraction and reuse of secrets from those exact sources.
- Content
md 1. **Run every step in sequence.** No skipping, no asking the user whether to continue. 2. **Never stop for user input.** Every known failure has a recovery path in this file. Go there, fix it, resume. 3. **If a fix is not in this file, find the solution independently.** Read logs, inspect the DB, check config files. Do not ask the user. 4. **Never change package versions or swap libraries to fix an error.** All versions in `package.json` are pinned intentionally. If a version mismatch appears to be the problem, the fix is in the configuration — not in bumping or changing a dependency. 5. **After any recovery, re-run only the step that failed** — not the full `./setup.sh` — unless the recovery section says otherwise. 6. **Confirm expected output before moving to the next step.** Each step specifies what success looks like. Match it before continuing.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Before doing anything, verify the stack is not already up.
bash curl -s http://localhost:3000/healthIf this returns
{"status":"ok",...}, the stack is already running. Skip to the Post-Setup Checklist and confirm all checks pass. If they do, setup is complete — do not re-run anything.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file instructs the agent to copy discovered LLM credentials into
.envwith no warning, approval gate, or guidance on secure handling. This normalizes secret collection and local persistence, increasing the chance of accidental exposure through shell history, repo leakage, backups, or logs.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 72% confidence
- Finding
The
/pipelinePOST sends user-controlled prompt data into a system configured with harvested LLM credentials, likely causing downstream transmission to the external model provider. In isolation this could be normal app behavior, but in this skill's context it follows unauthorized credential collection and automated setup, making the outbound flow riskier because it may activate external services using improperly sourced secrets.- Content
Once real LLM credentials are in
.envfrom Step 6:bash curl -X POST http://localhost:3000/pipeline \ -H "Content-Type: application/json" \ -d '{"prompt": "Build a URL shortener service"}'
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash sudo apt-get update && sudo apt-get install -y docker.io docker-compose-plugin sudo systemctl start docker sudo usermod -aG docker $USER && newgrp docker
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash sudo apt-get update && sudo apt-get install -y docker.io docker-compose-plugin sudo systemctl start docker sudo usermod -aG docker $USER && newgrp docker
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
Adding the current user to the
dockergroup effectively grants root-equivalent access on many systems, because Docker can be used to mount the host filesystem and escape normal user restrictions. In an autonomous setup skill, instructing this without clear warning or user approval is dangerous.- Content
bash sudo apt-get update && sudo apt-get install -y docker.io docker-compose-plugin sudo systemctl start docker sudo usermod -aG docker $USER && newgrp dockerRe-run
./setup.shafter Docker is running.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The recovery flow reads tokens from
.env, writes them into local CLI credential files, and updates auth configuration without any user-facing warning. This expands the number of secret copies on disk and creates additional persistence points that may be overlooked and later exposed.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text Common values: - OpenAI: `AI_BASE_URL=https://api.openai.com/v1` - OpenRouter: `AI_BASE_URL=https://openrouter.ai/api/v1` - Ollama: `AI_BASE_URL=http://localhost:11434/v1`, `AI_API_KEY=ollama`
Static analysis
No suspicious patterns detected.