Agentstead Deploy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:54 PM UTC
• Version: 1.4.1

Overview

The skill is purpose-aligned for AgentStead deployment, but it handles passwords, bot tokens, auth tokens, and wallet-deducting actions with enough unsafe or under-disclosed behavior to require review.

Review this before installing if you will use real AgentStead, Slack, Discord, Telegram, WhatsApp, or billing credentials. Prefer the hidden interactive login prompt, avoid putting passwords or bot tokens in shell commands or environment exports, use least-privilege bot tokens, rotate secrets after testing, and manually confirm any subscription command because it deducts wallet funds.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

Predictable Temporary Script Path Enables Symlink-Based File Overwrite

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–17 and 142
Vulnerability Type: Unsafe predictable temporary file
Risk Level: Medium

Vulnerable Code:

bash

# Save the deploy helper script
cat > /tmp/agentstead-deploy.sh << 'SCRIPT'

After writing the script, the same predictable path is made executable:

bash

SCRIPT
chmod +x /tmp/agentstead-deploy.sh

Technical Analysis

The installation instructions write an executable script to the fixed, publicly predictable path /tmp/agentstead-deploy.sh. Shell output redirection opens an existing target without exclusive creation and may follow a symbolic link.

On a multi-user system, an attacker who can write to /tmp could create this pathname or place a symbolic link there before the victim follows the instructions. The redirection may then overwrite the linked target using the victim's privileges. The subsequent chmod +x operation also acts on the predictable path and may modify the target's permissions.

Exploitability and the exact behavior depend on operating-system protections such as sticky-directory rules, protected symlink settings, file ownership, and whether the victim has permission to modify the linked target.

Attack Path

1. An attacker with local access monitors or anticipates use of the documented installation command.
2. The attacker creates /tmp/agentstead-deploy.sh as a symbolic link to a file writable by the victim.
3. The victim executes the documented cat > /tmp/agentstead-deploy.sh command.
4. The shell follows the attacker-controlled link and replaces the target with the helper-script contents.
5. The documented chmod +x command may additionally add executable permissions to the target.
6. The overwritten file may cause denial of service or unintended code execution if it is subsequently executed or sourced in a security-sensitive context.

Impact Assessment

Successful e ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

• Do not install executable content at a fixed pathname in a shared temporary directory.
• Prefer a user-owned installation location such as ${HOME}/.local/bin/agentstead-deploy.
• If temporary storage is necessary, create a private directory using mktemp -d, set restrictive permissions, and register a cleanup trap.
• Refuse to overwrite an existing destination and verify that the destination is a regular file owned by the current user.
• Avoid following symbolic links. Where supported, use APIs or utilities that provide exclusive creation and no-follow semantics.
• Apply restrictive permissions during creation, such as through umask 077, rather than creating the file first and securing it afterward.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:148

Finding

Recommended Authentication Workflow Exposes Passwords Through Persistent Environment Variables

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 148–151
Vulnerability Type: Plaintext credential exposure through process environment and shell history
Risk Level: Low

Vulnerable Code:

bash

# Option A: Use environment variables (recommended)
export AGENTSTEAD_EMAIL="[e-mail]"
export AGENTSTEAD_PASSWORD="password123"
/tmp/agentstead-deploy.sh login

Technical Analysis

The documentation identifies exporting the password as the recommended authentication method. An exported variable remains in the current shell environment until it is unset or the shell terminates, and it is inherited by subsequently launched child processes.

The literal export command may also remain in shell history, depending on shell configuration. Consequently, the plaintext password can outlive the login operation and become available to later child processes, diagnostic tooling, history synchronization, crash reports, or other same-account inspection mechanisms.

Attack Path

1. A user follows the recommended example and exports AGENTSTEAD_PASSWORD.
2. The password remains in the shell environment after authentication completes.
3. The user subsequently launches an untrusted, compromised, or overly verbose child process from the same shell.
4. That process reads or records the inherited AGENTSTEAD_PASSWORD value.
5. Alternatively, an attacker who later gains access to the user's shell-history data retrieves the literal password from the recorded export command.
6. The exposed credential is then used to authenticate to the user's AgentStead account.

Impact Assessment

Exposure compromises the AgentStead account password rather than merely the short-lived helper process. An attacker who obtains it may authenticate with the victim's account privileges, subject to any server-side controls such as multi-factor authentication.

Based on the documented API capabilities, account access could p ...[truncated 218 chars]

Remediation

View remediation

Remediation Suggestions

• Make the hidden interactive password prompt the recommended default.
• Do not include literal passwords in shell commands or documentation examples.
• If non-interactive authentication is required, use a protected file descriptor, a secret manager, or a narrowly scoped credential file with mode 0600.
• If environment-based input must remain supported, scope it to a single process, clear it immediately after use, and prominently warn users about environment inheritance and shell-history exposure.
• Modify the helper to clear sensitive variables after constructing the login request.
• Prefer revocable API tokens over reusable account passwords for automated workflows.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Login Dispatcher Accepts Passwords as Command-Line Arguments Contrary to Security Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–26, 132–133, and 214
Vulnerability Type: Credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code:

bash

cmd_login() {
  local email="${1:-$AGENTSTEAD_EMAIL}" password="${2:-$AGENTSTEAD_PASSWORD}"

The command dispatcher forwards a positional password to cmd_login:

bash

case "$1" in
  login)     cmd_login "$2" "$3" ;;

This behavior contradicts the documented security claim:

text

- Credentials are read from environment variables or interactive prompts — never passed as CLI arguments

Technical Analysis

The login function treats its second positional parameter as the password, and the command dispatcher obtains that value from the script's third command-line argument. Therefore, an invocation such as the following is functionally supported even though it is not documented:

bash

/tmp/agentstead-deploy.sh login "[e-mail]" "plaintext-password"

Passwords supplied this way may be exposed through shell history, process-list inspection while the command is running, audit logs, job runners, telemetry, or wrapper scripts that record arguments. The implementation invalidates the explicit assurance that credentials are never passed through command-line arguments.

Attack Path

1. A user or automation system invokes the supported positional interface as login EMAIL PASSWORD.
2. The shell records the full command in history, or the operating system exposes the argument vector while the process runs.
3. Another local process, administrator, logging system, or later shell-history reader obtains the plaintext password.
4. The attacker reuses the credential to authenticate to AgentStead.
5. The attacker then performs actions available to the compromised account.

Impact Assessment

Successful exploitation discloses the user's reusable AgentStead password. Th ...[truncated 378 chars]

Remediation

View remediation

Remediation Suggestions

• Remove support for positional password arguments entirely.
• Change cmd_login so that positional parameters can supply only non-sensitive values such as the email address.
• Read the password from a hidden interactive prompt using read -r -s.
• For automation, accept the secret through a protected file descriptor, standard input with clear usage constraints, or a dedicated secret manager.
• Avoid printing or logging the password and clear the variable immediately after the request body is created.
• Add argument validation that rejects extra login parameters with a clear error.
• Update automated tests to verify that login EMAIL PASSWORD is rejected and that process arguments never contain credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This login request transmits the user's email and password to an external service. Although HTTPS is used and remote authentication is expected for this skill, it still constitutes sensitive credential exfiltration to a third party and should be treated as a real security-sensitive operation in skill review.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

local body
  body=$(jq -n --arg e "$email" --arg p "$password" '{email: $e, password: $p}')
  local resp
  resp=$(curl -s -X POST "$API/auth/login" -H "Content-Type: application/json" -d "$body")
  local token
  token=$(echo "$resp" | jq -r '.token // empty')
  if [ -z "$token" ]; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

return 1
  fi
  echo "$token" > "$TOKEN_FILE"
  chmod 600 "$TOKEN_FILE"
  echo "OK: Logged in successfully"
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This endpoint sends agent metadata and an authentication token to a remote service to create hosted agents. The behavior is consistent with the skill's purpose, but it is still an external transmission of authenticated user data and can create cloud resources with downstream operational and billing consequences.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

--arg aiPlan "$ai_plan" \
    --arg model "$model" \
    '{name: $name, plan: $plan, aiPlan: $aiPlan, defaultModel: $model}')
  curl -s -X POST "$API/agents" \
    -H "Content-Type: application/json" \
    -H "x-cognito-id: $(cat "$TOKEN_FILE")" \
    -d "$body" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This configuration call transmits agent personality content and an authentication token to the remote service. If users place sensitive prompts, policies, or proprietary instructions in the personality field, those are disclosed externally and may persist on the provider platform.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

token=$(cat "$TOKEN_FILE" 2>/dev/null) || { echo "ERROR: Not logged in" >&2; return 1; }
  local body
  body=$(jq -n --arg p "$personality" '{personality: $p}')
  curl -s -X PATCH "$API/agents/$agent_id" \
    -H "Content-Type: application/json" \
    -H "x-cognito-id: $(cat "$TOKEN_FILE")" \
    -d "$body" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This call transmits a third-party bot token along with an authenticated request to AgentStead, giving the remote platform control material for external messaging integrations. Because bot tokens often grant operational access in other services, compromise or misuse could extend beyond AgentStead and affect connected Telegram, Discord, Slack, or WhatsApp environments.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

token=$(cat "$TOKEN_FILE" 2>/dev/null) || { echo "ERROR: Not logged in" >&2; return 1; }
  local body
  body=$(jq -n --arg t "$type" --arg bt "$bot_token" '{type: $t, config: {botToken: $bt}}')
  curl -s -X POST "$API/agents/$agent_id/channels" \
    -H "Content-Type: application/json" \
    -H "x-cognito-id: $(cat "$TOKEN_FILE")" \
    -d "$body" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This request sends an authenticated subscription command that affects billing by deducting ASTD wallet funds. Even though this is core functionality, it is security-relevant because it can directly trigger spend and alter account state on the remote platform.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

token=$(cat "$TOKEN_FILE" 2>/dev/null) || { echo "ERROR: Not logged in" >&2; return 1; }
  local body
  body=$(jq -n --argjson cost "$astd_cost" '{planAstdCost: $cost}')
  curl -s -X POST "$API/agents/$agent_id/subscribe-astd" \
    -H "Content-Type: application/json" \
    -H "x-cognito-id: $(cat "$TOKEN_FILE")" \
    -d "$body" | jq .

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The subscribe action performs a billing-affecting API call that deducts ASTD from the user's wallet, but the usage text does not present this as a dangerous or irreversible financial operation. In an agent skill context, missing spend warnings can lead to unintended charges or silent execution of cost-incurring actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The channel setup step sends third-party bot credentials to the remote AgentStead service, but the documentation does not clearly warn that those tokens leave the local machine and become available to an external platform. This creates avoidable credential-handling and privacy risk, especially for high-privilege Slack, Discord, Telegram, or WhatsApp integrations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The security section claims credentials are never passed as CLI arguments, but the helper explicitly supports cmd_login "$2" "$3", allowing a password to be supplied positionally. CLI arguments may be exposed via shell history, process listings, audit logs, or telemetry, so the documentation is materially misleading and could cause credential leakage.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest advertises the "exec" capability while only declaring network permission, creating a mismatch between the skill's stated powers and its permission model. Command execution is a high-risk capability because it can invoke local binaries, access environment data, or chain with network access to download and run payloads, and the incomplete permission declaration makes review and enforcement less reliable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.