Security audit

Secure Storage

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local secret-storage tool, but its implementation materially undercuts its security claims and could expose stored API keys if users rely on it.

Install only for low-risk local convenience, not for real credential protection. Do not store production API keys, cloud credentials, repository tokens, or account secrets in this version unless you accept that the storage file can be decrypted offline with the public code. Prefer an OS keychain, password manager, KMS-backed secret store, or a revised version using user-controlled key material and authenticated encryption.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/secure-storage.js:14
Finding: Universal Hardcoded Encryption Key Allows Offline Secret Recovery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/secure-storage.js:89
Finding: Secret Values Are Exposed Through Command-Line Arguments
Content: View full analysis
``` ### Technical Analysis The `set` operation receives the plaintext secret through `process.argv`. Command-line arguments are not an appropriate secret-input channel because they may be recorded or exposed by: - Shell history files - Process inspection utilities - Operating-system process accounting or audit systems - Terminal session recording - Automation wrappers and command telemetry - CI/CD job logs Encryption occurs only after Node.js receives the argument. It cannot remove plaintext copies already retained by the shell, operating system, or monitoring infrastructure. ### Attack Path 1. A user invokes the documented `set` command with an API key as the value. 2. The shell records the complete command in its history or an operational tool captures the invocation. 3. During execution, the plaintext value is also present in the process argument vector. 4. A local observer, monitoring service, administrator, or attacker with access to retained logs reads the secret. 5. The attacker uses the recovered credential against the service for which it was issued. ### Impact Assessment The exposed scope includes every secret entered through the `set` command. Exploitation does not itself grant operating-system privileges, but a captured credential grants whatever permissions that credential has in its target service. Exposure may persist after the command terminates if the value was retained in shell history, process-accounting records, CI l ...[truncated 32 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/secure-storage.js:18
Finding: AES-CBC Encryption Does Not Authenticate Stored Records
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a substantive security issue, not just a documentation mismatch: the stated purpose is secure storage of secrets, but the described behavior includes decrypting secrets to console output, listing metadata, using reversible encryption with a static key, and storing data in a local JSON file. In the context of a secret-storage skill, these behaviors materially weaken confidentiality and can expose API keys through logs, local file compromise, or predictable key recovery.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation describes a program that reads encryption material from environment variables, but it does not declare any explicit tool scope or permissions boundary for that capability. In agent environments, undeclared access to env-sourced secrets reduces auditability and can enable broader-than-expected secret handling, especially for a skill explicitly designed to process sensitive data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and operational guidance are written in Chinese, including the title, feature descriptions, trigger notes, and warnings. This creates a language-policy concern because the file presents a fixed locale without offering an alternative language or stating that the skill is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language strings and locale behavior are explicitly fixed to Chinese, including the bilingual header and zh-CN date formatting. This can violate language/locale policy because the skill does not offer opt-in, fallback, or configuration for other languages/locales.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The get command decrypts stored secrets and prints them directly to stdout, which can expose sensitive values through terminal history, shell logging, CI logs, process capture, or shoulder-surfing. In a skill explicitly marketed as secure storage for API keys and other secrets, returning plaintext by default materially weakens the protection boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline documentation says the implementation is simple encryption based on Base64 and key obfuscation, which materially differs from the actual code path using scrypt-derived keys and AES-256-CBC. This is an active documentation/code contradiction, even though the broader warning that it is not production-grade is still present.
Content: No source excerpt is available for this finding.