OpenStoryline Install

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:55 PM UTC
• Version: 0.0.4

Overview

This is a straightforward install helper for OpenStoryline, with normal setup risks around running upstream install scripts and handling API keys.

Install only if you trust the FireRed-OpenStoryline upstream repository at the time you run it. Review requirements.txt and download.sh before execution, consider pinning a known commit, and avoid putting real API keys directly in shell commands; if you do, clean shell history, restrict config.toml permissions, and keep the file out of version control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79

Finding

Unpinned Remote Source and Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-93
Vulnerability Type: Unverified mutable source and dependency execution
Risk Level: Medium

Vulnerable Code

bash

git clone https://github.com/FireRedTeam/FireRed-OpenStoryline.git
cd FireRed-OpenStoryline

bash

/path/to/python -m venv .venv
.venv/bin/python -m pip install --upgrade pip
.venv/bin/python -m pip install -r requirements.txt
bash download.sh

Technical Analysis

The workflow clones the mutable default branch of an external Git repository without pinning a reviewed release tag or commit hash. It subsequently installs packages specified by the remotely controlled requirements.txt file and executes the remotely controlled download.sh script.

The skill does not require inspection of these files, cryptographic verification of the checked-out revision, dependency hash validation, or checksum verification for downloaded resources. Consequently, the effective installation payload can change after this skill has been audited.

This creates a supply-chain trust boundary in which compromise of the upstream repository, its maintainers, a referenced package, or a downloaded resource could introduce arbitrary commands into the installation process.

Attack Path

1. An attacker compromises the upstream repository, its default branch, or an account authorized to modify it.
2. The attacker changes requirements.txt, download.sh, or another installation-controlled resource.
3. A user follows the skill and clones the current mutable default branch.
4. The user executes pip install -r requirements.txt or bash download.sh.
5. The modified installation payload runs with the permissions of the invoking user.

A related path is possible if an unpinned or otherwise unsafe package reference in requirements.txt resolves to a compromised package release.

Impact Assessment

Successful exploitation could exe ...[truncated 546 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the upstream repository to a reviewed release tag and immutable commit hash.
• Verify the checked-out commit before running any repository-controlled command.
• Inspect requirements.txt and download.sh before installation or execution.
• Use a locked dependency file containing exact versions and cryptographic hashes.
• Install dependencies with hash enforcement, such as pip install --require-hashes.
• Pin all external resource URLs to immutable versions and publish trusted SHA-256 checksums.
• Verify resource checksums before extraction or use.
• Run installation in an isolated, non-privileged environment with minimal filesystem and credential access.
• Avoid automatically executing remotely retrieved shell scripts unless their content and integrity have been verified.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107

Finding

API Keys Exposed Through Command-Line Arguments and Plaintext Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107-114
Vulnerability Type: Insecure handling of API credentials
Risk Level: Medium

Vulnerable Code

bash

.venv/bin/python scripts/update_config.py --config ./config.toml --set llm.model=REPLACE_WITH_REAL_MODEL
.venv/bin/python scripts/update_config.py --config ./config.toml --set llm.base_url=REPLACE_WITH_REAL_URL
.venv/bin/python scripts/update_config.py --config ./config.toml --set llm.api_key=sk-REPLACE_WITH_REAL_KEY

.venv/bin/python scripts/update_config.py --config ./config.toml --set vlm.model=REPLACE_WITH_REAL_MODEL
.venv/bin/python scripts/update_config.py --config ./config.toml --set vlm.base_url=REPLACE_WITH_REAL_URL
.venv/bin/python scripts/update_config.py --config ./config.toml --set vlm.api_key=sk-REPLACE_WITH_REAL_KEY

Technical Analysis

The documented workflow instructs users to replace API-key placeholders directly in command-line arguments. Real credentials supplied this way may be recorded in shell history. Depending on the operating system and process isolation settings, command-line arguments may also be visible temporarily through process inspection interfaces or monitoring tools.

The command writes the credentials into config.toml, but the skill does not instruct the user to restrict that file's permissions or confirm that it is excluded from version control. This creates an additional plaintext-secret exposure risk through overly broad local access, backups, support bundles, logs, or accidental repository commits.

Attack Path

1. A user replaces sk-REPLACE_WITH_REAL_KEY with an active provider credential.
2. The shell records the full command in its history, or a local process-monitoring mechanism captures the process arguments.
3. Alternatively, the resulting config.toml remains readable by unintended local users or is accidentally committed to version control.
4. An attacker or unauthorized local u ...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pass API keys as command-line arguments.
• Accept secrets through a non-echoing interactive prompt, a secret manager, or a protected environment file.
• If environment variables are used, prevent them from being printed in logs or diagnostic output.
• Store sensitive configuration separately from non-sensitive settings where possible.
• Set restrictive permissions on secret-bearing files, such as chmod 600 config.toml.
• Ensure config.toml and secret environment files are excluded through .gitignore.
• Add automated secret scanning to prevent accidental commits.
• Document safe backup, logging, and credential-rotation practices.
• Advise users who entered real keys using the documented command pattern to remove the relevant shell-history entries and rotate the exposed credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

• Debian/Ubuntu:

  bash

  sudo apt-get update
  sudo apt-get install -y ffmpeg wget unzip
  

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

• Debian/Ubuntu:

  bash

  sudo apt-get update
  sudo apt-get install -y ffmpeg wget unzip
  

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to place live API keys directly into config.toml without any warning about plaintext local storage, file permissions, or safer secret-handling options. This creates a real risk of credential leakage through source control commits, backups, shell history, shared workstations, or accidental file disclosure during troubleshooting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.