Static App

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:41 PM UTC
• Version: 1.0.4

Overview

The skill is a disclosed Static.app management tool, but it combines deployment with destructive account actions and unsafe credential/download handling that users should review before installing.

Install only if you intend to give this skill a Static.app API key with authority to list, update, download, and delete sites. Prefer STATIC_APP_API_KEY over -k/--api-key, avoid --force deletion unless you have independently verified the PID, and treat downloaded archives/output paths as sensitive until the dependency and path-validation issues are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deploy.js:18

Finding

API Keys Can Be Exposed Through Command-Line Arguments

Content

View full analysis

` — Specify API key ``` ### Technical Analysis Static.app API keys are bearer credentials capable of authenticating account operations. Accepting the key through `-k` or `--api-key` places it in `process.argv`. Depending on the host configuration, command-line arguments may be observable through: - Process inspection utilities and `/proc` metadata. - Shell history. - Agent tool-call and execution logs. - Terminal session recording. - Endpoint monitoring and process auditing products. - Wrapper scripts that record invoked commands. The scripts also support `STATIC_APP_API_KEY`, which is safer than a command-line parameter in many environments, but the insecure alternative remains enabled and documented. The behavior is unnecessary for the declared functionality because authentication can be supplied through a secret manager, protected environment injection, standard input, or a restricted credential file. ### Attack Path 1. A user or AI agent invokes a utility with a credential, for example: ``` ...[truncated 1119 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download.js:193

Finding

Unvalidated PID Influences Download, Extraction, and Cleanup Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download.js:92

Finding

Remote Download URL Is Followed Without Destination or Resource Validation

Content

View full analysis

{ response.body.pipe(fileStream); response.body.on('error', reject); fileStream.on('finish', () => { const stats = fs.statSync(destPath); console.log(`💾 Downloaded: ${formatBytes(stats.size)}`); resolve(); }); }); } ``` The downloaded content is extracted without size or entry limits: ```js function extractZip(zipPath, extractPath) { console.log(`📦 Extracting to ${extractPath}...`); // Ensure extract directory exists if (!fs.existsSync(extractPath)) { fs.mkdirSync(extractPath, { recursive: true }); } // Extract using adm-zip (pure Node.js, no shell commands) try { const zip = new AdmZip(zipPath); zip.extractAllTo(extractPath, true); console.log(`✅ Extracted successfully`); } catch (err) { console.error(`❌ Extraction failed: ${err.message}`); throw new Error('Extrac ...[truncated 3505 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also enumerates all sites via the API, which is broader account-management functionality than simple deployment. This mismatch can expose account inventory and enable unintended operational actions because users may invoke the skill assuming it only uploads local content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also enumerates all sites via the API, which is broader account-management functionality than simple deployment. This mismatch can expose account inventory and enable unintended operational actions because users may invoke the skill assuming it only uploads local content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill also enumerates all sites via the API, which is broader account-management functionality than simple deployment. This mismatch can expose account inventory and enable unintended operational actions because users may invoke the skill assuming it only uploads local content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill also enumerates all sites via the API, which is broader account-management functionality than simple deployment. This mismatch can expose account inventory and enable unintended operational actions because users may invoke the skill assuming it only uploads local content.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

node scripts/deploy.js ./dist

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

node scripts/deploy.js ./dist

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

node scripts/deploy.js ./dist

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

node scripts/deploy.js ./dist

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

node scripts/deploy.js ./dist

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

node scripts/deploy.js ./dist

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

node scripts/list.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

node scripts/download.js YOUR_PID

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

node scripts/download.js YOUR_PID

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

node scripts/download.js YOUR_PID

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs irreversible site deletion even though the skill is described as handling deployment, upload, or hosting tasks. This scope mismatch is dangerous because users or higher-level agents invoking the skill for benign hosting workflows may unknowingly gain destructive capability, increasing the risk of accidental or unauthorized deletion.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/deploy.js (reported line 14)May include surrounding context.

js

const fetch = require('node-fetch');

const API_URL = 'https://api.static.app/v1/sites/zip/';
const DEFAULT_EXCLUDE = ['node_modules', '.git', '.github', '*.md', 'package*.json', '.env', '.openclaw'];

function parseArgs() {
  const args = process.argv.slice(2);

Known Vulnerable Dependency: adm-zip==0.5.16 — 2 advisory(ies): CVE-2026-76845 (adm-zip extraction follows destination symlinks, allowing arbitrary file overwri); CVE-2026-39244 (adm-zip: Crafted ZIP file triggers 4GB memory allocation)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins adm-zip 0.5.16, which is reported vulnerable to unsafe ZIP handling, including following destination symlinks during extraction and a crafted-archive memory exhaustion condition. In a static-site deployment skill that processes archives, this is directly relevant because attacker-controlled ZIP content could lead to arbitrary file overwrite on the host or denial of service during packaging/extraction workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

brace-expansion 2.0.2 is flagged for denial-of-service issues caused by pathological brace patterns that trigger excessive expansion, hanging, or memory exhaustion. This is a transitive dependency used for pattern parsing; it becomes dangerous if the skill accepts attacker-controlled glob or pattern input, though its exploitability is less direct than the archive-handling issues.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection through unescaped multipart field names and filenames. In a deployment skill that uploads artifacts to a hosting service, this is particularly relevant because attacker-controlled metadata could tamper with multipart HTTP requests, potentially altering request structure, smuggling unintended fields, or confusing upstream services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

minimatch 9.0.5 is flagged for multiple ReDoS issues involving crafted glob patterns that cause catastrophic backtracking or combinatorial matching behavior. In this skill, such risk matters if file selection or ignore/include patterns can be influenced by users or project contents, potentially allowing a deployment operation to hang or consume excessive CPU.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

lodash 4.17.23 is reported with prototype pollution and template/code-injection advisories, but exploitability depends heavily on whether the skill invokes affected functions such as _.unset on attacker-controlled paths or _.template on untrusted input. The lockfile alone does not prove those code paths are used, yet keeping a version with known high-severity issues in a deployment tool is still risky because transitive code may expose them.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==5.1.6 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

A second vulnerable minimatch version, 5.1.6, is present transitively and carries the same ReDoS class of weaknesses as the newer flagged copy. Because deployment tools often walk directories and evaluate ignore/include patterns, attacker-influenced patterns or repository contents could trigger CPU exhaustion and stall deployments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: adm-zip==0.5.16 — 2 advisory(ies): CVE-2026-76845 (adm-zip extraction follows destination symlinks, allowing arbitrary file overwri); CVE-2026-39244 (adm-zip: Crafted ZIP file triggers 4GB memory allocation)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest includes adm-zip 0.5.16, which is flagged with high-severity issues including symlink-following arbitrary overwrite during extraction and a crafted ZIP memory-allocation denial of service. In a deployment skill that handles site packaging or archives, ZIP processing is contextually relevant, so a vulnerable archive library materially increases risk if untrusted or malformed archives are ever accepted or processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The resolved form-data version is reported vulnerable to CRLF injection via unescaped multipart field names/filenames. This skill uploads deployment artifacts to a hosting service, so malformed user-controlled metadata in multipart requests could potentially tamper with HTTP request structure or headers if such fields are influenced by external input.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents use of environment variables and outbound network access to a third-party API, but the manifest declares no explicit tool scope or permissions. That gap reduces transparency and control for reviewers and execution frameworks, making it easier for a deployment-oriented skill to access secrets and send data externally without clearly bounded authorization.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/delete.js:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/deploy.js:20

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/download.js:19

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/files.js:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/list.js:13