T08 · Insecure Dependencies
Error
- Location
SKILL.md:9- Finding
Mutable Upstream Source and Unrestricted npm Build Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
PikaBoard
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-aligned for PikaBoard task management, but it needs review because installation runs mutable external Node code and the docs/scripts handle API tokens in plaintext files.
Review before installing. Use a sandbox or low-privilege account for setup, verify the upstream repository revision before running npm install/build, avoid putting the bearer token in TOOLS.md, protect backend/.env with restrictive permissions, and confirm board IDs before allowing agents to create or update tasks.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:37- Finding
Bearer Token File Created Without Explicit Restrictive Permissions
- Content
View full analysis
backend/.env << EOF DATABASE_PATH=./pikaboard.db PIKABOARD_TOKEN=$(openssl rand -hex 32) PORT=3001 EOF ``` ### Technical Analysis The setup script generates a strong random bearer token, but it writes the token to `backend/.env` without first setting a restrictive `umask` and without applying an explicit file mode afterward. The resulting permissions depend on the caller's current umask. Under a common `022` umask, shell redirection can create the file with mode `0644`, making it readable by other local users. Because the token is used as an authorization credential for PikaBoard API requests, read access to the file may translate directly into API access. The issue is limited to newly created files because the script does not overwrite an existing `backend/.env`. ### Attack Path 1. A user runs `scripts/setup.sh` with a permissive umask such as `022`. 2. The script creates `backend/.env` through shell redirection. 3. The file inherits permissions that may permit reads by other local accounts. 4. A local attacker or process with filesystem access reads `PIKABOARD_TOKEN`. 5. The attacker sends requests using `Authorization: Bearer `. 6. The attacker receives whatever board and task privileges the token provides. ### Impact Assessment Exploitation requires local filesystem access to the generated file or access through another process running under an account allowed to read it. A disclosed token may allow unauthorized reading, creation, or modification of PikaBoard boards and tasks, depending on the backend authorization model. The vulnerability does not itself grant operating-system privilege escalat ...[truncated 136 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/setup-agent-board.sh:29- Finding
Ambiguous Partial Board Matching Can Select an Unrelated Agent Board
- Content
View full analysis
input += c); process.stdin.on("end", () => { const name = (process.argv[1] || "").toLowerCase(); const parsed = JSON.parse(input); const boards = Array.isArray(parsed.boards) ? parsed.boards : []; const exact = boards.find((b) => String(b.name || "").toLowerCase() === name); if (exact && exact.id != null) { process.stdout.write(String(exact.id)); return; } const partial = boards.find((b) => String(b.name || "").toLowerCase().includes(name)); if (partial && partial.id != null) process.stdout.write(String(partial.id)); }); ' "${BOARD_NAME}" )" ``` ### Technical Analysis The helper first performs a case-insensitive exact board-name match. If that fails, it selects the first board whose name contains the requested name as a substring. It does not require the partial match to be unique and does not ask the user to confirm the selected board. Consequently, a short, misspelled, or colliding agent name can resolve to an unrelated existing board. For example, a requested board name that is a substring of multiple board names will select whichever matching board appears first in the API response. The later numeric validation of `BOARD_ID` prevents shell command injection but does not verify ownership or authorization intent. The script then verifies task access and prints the selected board ID for use by subsequent agent operations, which can normalize the incorrect mapping. ### Attack Path 1. Multiple boards exist with names that share a substring, or an attacker creates a board designed to collide with a likely agent name. 2. An agent runs th ...[truncated 1159 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as an API interaction utility, but it also directs the agent to clone a repository, install dependencies, build backend/frontend code, create local configuration files, and run a server. This mismatch is dangerous because users and orchestrators may grant or trigger the skill expecting low-risk API calls, while it actually expands to supply-chain, local execution, and secret-handling risks.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs creation of a
.envfile containingPIKABOARD_TOKEN, and later suggests adding the token toTOOLS.mdand exporting it in the shell environment. This increases the chance of credential exposure through plaintext files, repo commits, shell history, logs, or agent-readable workspace contents.- Content
md label: "Build frontend" - id: env kind: prompt message: "Create .env with DATABASE_PATH and PIKABOARD_TOKEN" label: "Configure environment" ---
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh fi echo "Checking boards on ${PIKABOARD_API}..." BOARDS_JSON="$(curl -fsS "${AUTH_HEADERS[@]}" "${PIKABOARD_API}/boards")" BOARD_ID="$( printf '%s' "${BOARDS_JSON}" | node -e '
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh ' "${BOARD_NAME}")" CREATED_JSON="$( curl -fsS -X POST "${AUTH_HEADERS[@]}" \ -H "Content-Type: application/json" \ -d "${CREATE_PAYLOAD}" \ "${PIKABOARD_API}/boards"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh npm run build cd .. # Create .env if not exists if [ ! -f backend/.env ]; then echo "⚙️ Creating .env..." cat > backend/.env << EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh npm run build cd .. # Create .env if not exists if [ ! -f backend/.env ]; then echo "⚙️ Creating .env..." cat > backend/.env << EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh npm run build cd .. # Create .env if not exists if [ ! -f backend/.env ]; then echo "⚙️ Creating .env..." cat > backend/.env << EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh npm run build cd .. # Create .env if not exists if [ ! -f backend/.env ]; then echo "⚙️ Creating .env..." cat > backend/.env << EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh npm run build cd .. # Create .env if not exists if [ ! -f backend/.env ]; then echo "⚙️ Creating .env..." cat > backend/.env << EOF
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The setup instructions tell users to export a sensitive backend token from a local
.envfile without any guidance on secure handling, masking, rotation, or limiting exposure. This is dangerous because it encourages copying secrets into shell environments and agent context, where they may leak through logs, process listings, command history, or downstream tool use.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs the agent to read
PIKABOARD_TOKENfrompikaboard/backend/.env, which grants the skill a credential-access step beyond normal task-management operations. Even if intended for local setup, teaching an agent to pull secrets from local files expands its privileges and normalizes unsafe secret handling, increasing the chance of unintended credential exposure or reuse outside the intended API scope.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill performs shell-capable actions during installation and setup (
git clone,npm install,npm run build, and laternpm start) but declares no explicit tool scope or permissions boundary. This can cause an agent or platform to invoke powerful local execution behavior unexpectedly, increasing the chance of unintended code execution from an untrusted repository.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger terms (
tasks,board,todo,backlog,sprint) are broad and likely to match ordinary conversation, causing the skill to activate in contexts where the user did not intend task-system operations. Because the skill includes state-changing commands and setup guidance, overbroad triggering can lead to unintended API calls or modifications to persistent task data.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
List tasks:
bash curl -H "Authorization: Bearer $PIKABOARD_TOKEN" "$PIKABOARD_API/tasks"Create task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh ' "${BOARD_NAME}")" CREATED_JSON="$( curl -fsS -X POST "${AUTH_HEADERS[@]}" \ -H "Content-Type: application/json" \ -d "${CREATE_PAYLOAD}" \ "${PIKABOARD_API}/boards"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documentation shows create and update examples that modify persistent task data but does not explicitly warn that these actions are state-changing. In an agent context, lack of mutation warnings can contribute to accidental writes, especially when combined with broad triggers and autonomous execution.
- Content
Static analysis
No suspicious patterns detected.