Security audit

Deep Research with Caesar.org

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform Caesar research as advertised, but its setup asks users to install a mutable external CLI and gives weak plaintext API-key storage guidance.

Review before installing. Prefer installing a pinned Caesar CLI version you trust, avoid putting real API keys in shell history or plaintext `.env` files, use a secret manager or restrictive file permissions, and do not send confidential or regulated data in research prompts unless Caesar's data handling is acceptable for your use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Installation of a Mutable Upstream Executable
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: README.md:29
Finding: Plaintext API-Key Persistence with Missing Claimed Ignore Protection
Content: View full analysis
.env source .env ``` The `.env` file is git-ignored and will not be committed. ``` ### Technical Analysis The documentation instructs users to store the Caesar API key in a plaintext `.env` file or shell profile. The provided command does not establish restrictive file permissions and may create the file according to a permissive process umask. The README also states that `.env` is ignored by Git, but the complete audited project listing contains no `.gitignore`. Users relying on this claim may accidentally stage and commit the credential. The application itself appropriately reads the key from `CAESAR_API_KEY` and does not hardcode or write it to disk. The vulnerability is limited to the persistence guidance and the missing protection promised by that guidance. ### Attack Path 1. A user follows the README and writes the API key to `.env`. 2. The file is created in plaintext with permissions determined by the user's current umask. 3. Because the audited project does not contain the claimed `.gitignore`, the user accidentally stages or commits `.env`, or the file is collected by backup or local indexing software. 4. Another local user, repository reader, CI service, backup operator, or other party obtains the key. 5. The exposed credential is used to authenticate to the Caesar API within the permissions and limits assigned to that key. An alternative path is disclosure through a plaintext shell profile that is readable, backed ...[truncated 483 chars]
Remediation: View remediation
.env chmod 600 .env ``` 5. Warn users not to enter real credentials directly into commands retained by shell history. 6. Provide a credential-free `.env.example` containing only placeholders. 7. Add secret scanning to source-control and CI workflows. 8. Document immediate credential revocation and rotation procedures for accidental disclosure. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

Category: Privilege Escalation
Confidence: 85% confidence
Finding: The example command writes the API key directly into a .env file in plaintext, creating a concrete credential exposure pattern rather than just mentioning configuration options abstractly. Even if the file is git-ignored, secrets may still be exposed to local users, endpoint compromise, backups, editor plugins, or accidental copying into logs and support artifacts.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
To persist it across shell sessions, add the export line to your shell profile (~/.zshrc, ~/.bashrc, etc.), or create a local .env file:

bash
echo 'export CAESAR_API_KEY=your_key_here' > .env source .env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
bash
echo 'export CAESAR_API_KEY=your_key_here' > .env source .env

The .env file is git-ignored and will not be committed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The code clearly supports the 'deep research' portion of the description by creating and monitoring research jobs through the Caesar API. However, the declared description also claims broader capabilities: follow-up chat, brainstorming, and managing collections. In this code chunk, there are no chat commands, no collection CRUD or management operations, and no actual brainstorming workflow beyond optionally attaching an existing brainstorm session ID to a research request. That makes the description materially broader than what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description emphasizes user-facing Caesar API research features such as queries, chat follow-ups, brainstorming, and collection management. The supplied code chunk does not implement any of those behaviors; it only tests configuration logic for reading an API key from an environment variable and returning errors when missing. While API key retrieval may support the broader skill, this chunk’s actual purpose is materially different from the declared functionality, so it is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose describes a research-oriented skill with Caesar API features, but the supplied code chunk contains only basic output utilities. It does not perform research operations, network/API calls, query handling, chat, brainstorming, or collection management. While output formatting is a plausible support component, this chunk alone does not substantiate the declared behavior and includes an undeclared capability to terminate the process on error.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill performs deep research using the Caesar API and supports research-oriented interactions. The supplied code chunk does not implement any such behavior. It is strictly a Go test file validating console output helpers: JSON serialization, stderr error formatting, exit handling, and default stream assignments. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README recommends storing the Caesar API key in a local .env file as plain text and sourcing it into the shell, but it does not warn users about local plaintext secret exposure, file permission risks, shell history leakage, or accidental disclosure through backups and tooling. While common in developer workflows, this still weakens secret handling guidance and can lead to credential compromise on shared or insufficiently secured systems.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to environment-provided secrets via CAESAR_API_KEY but does not declare an explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what the skill is permitted to access and increases the chance that a host agent exposes secrets or execution capabilities more broadly than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation encourages sending arbitrary research queries, chat follow-ups, and brainstorm context to an external Caesar service without warning users that their prompts and attached context leave the local environment. In a research skill, users may include sensitive business data, internal documents, or personal information, so the omission can lead to unintended data disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.