OpenStoryline Install

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:55 PM UTC
• Version: 0.0.4

Overview

This is a straightforward install helper for OpenStoryline, with normal setup risks around running upstream install scripts and handling API keys.

Install only if you trust the FireRed-OpenStoryline upstream repository at the time you run it. Review requirements.txt and download.sh before execution, consider pinning a known commit, and avoid putting real API keys directly in shell commands; if you do, clean shell history, restrict config.toml permissions, and keep the file out of version control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79
• Finding: Unpinned Remote Source and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 79-93 **Vulnerability Type**: Unverified mutable source and dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/FireRedTeam/FireRed-OpenStoryline.git cd FireRed-OpenStoryline ``` ```bash /path/to/python -m venv .venv .venv/bin/python -m pip install --upgrade pip .venv/bin/python -m pip install -r requirements.txt bash download.sh ``` ### Technical Analysis The workflow clones the mutable default branch of an external Git repository without pinning a reviewed release tag or commit hash. It subsequently installs packages specified by the remotely controlled `requirements.txt` file and executes the remotely controlled `download.sh` script. The skill does not require inspection of these files, cryptographic verification of the checked-out revision, dependency hash validation, or checksum verification for downloaded resources. Consequently, the effective installation payload can change after this skill has been audited. This creates a supply-chain trust boundary in which compromise of the upstream repository, its maintainers, a referenced package, or a downloaded resource could introduce arbitrary commands into the installation process. ### Attack Path 1. An attacker compromises the upstream repository, its default branch, or an account authorized to modify it. 2. The attacker changes `requirements.txt`, `download.sh`, or another installation-controlled resource. 3. A user follows the skill and clones the current mutable default branch. 4. The user executes `pip install -r requirements.txt` or `bash download.sh`. 5. The modified installation payload runs with the permissions of the invoking user. A related path is possible if an unpinned or otherwise unsafe package reference in `requirements.txt` resolves to a compromised package release. ### Impact Assessment Successful exploitation could exe ...[truncated 546 chars]
• Remediation: ## Remediation Suggestions - Pin the upstream repository to a reviewed release tag and immutable commit hash. - Verify the checked-out commit before running any repository-controlled command. - Inspect `requirements.txt` and `download.sh` before installation or execution. - Use a locked dependency file containing exact versions and cryptographic hashes. - Install dependencies with hash enforcement, such as `pip install --require-hashes`. - Pin all external resource URLs to immutable versions and publish trusted SHA-256 checksums. - Verify resource checksums before extraction or use. - Run installation in an isolated, non-privileged environment with minimal filesystem and credential access. - Avoid automatically executing remotely retrieved shell scripts unless their content and integrity have been verified.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107
• Finding: API Keys Exposed Through Command-Line Arguments and Plaintext Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 107-114 **Vulnerability Type**: Insecure handling of API credentials **Risk Level**: Medium ### Vulnerable Code ```bash .venv/bin/python scripts/update_config.py --config ./config.toml --set llm.model=REPLACE_WITH_REAL_MODEL .venv/bin/python scripts/update_config.py --config ./config.toml --set llm.base_url=REPLACE_WITH_REAL_URL .venv/bin/python scripts/update_config.py --config ./config.toml --set llm.api_key=sk-REPLACE_WITH_REAL_KEY .venv/bin/python scripts/update_config.py --config ./config.toml --set vlm.model=REPLACE_WITH_REAL_MODEL .venv/bin/python scripts/update_config.py --config ./config.toml --set vlm.base_url=REPLACE_WITH_REAL_URL .venv/bin/python scripts/update_config.py --config ./config.toml --set vlm.api_key=sk-REPLACE_WITH_REAL_KEY ``` ### Technical Analysis The documented workflow instructs users to replace API-key placeholders directly in command-line arguments. Real credentials supplied this way may be recorded in shell history. Depending on the operating system and process isolation settings, command-line arguments may also be visible temporarily through process inspection interfaces or monitoring tools. The command writes the credentials into `config.toml`, but the skill does not instruct the user to restrict that file's permissions or confirm that it is excluded from version control. This creates an additional plaintext-secret exposure risk through overly broad local access, backups, support bundles, logs, or accidental repository commits. ### Attack Path 1. A user replaces `sk-REPLACE_WITH_REAL_KEY` with an active provider credential. 2. The shell records the full command in its history, or a local process-monitoring mechanism captures the process arguments. 3. Alternatively, the resulting `config.toml` remains readable by unintended local users or is accidentally committed to version control. 4. An attacker or unauthorized local u ...[truncated 624 chars]
• Remediation: ## Remediation Suggestions - Do not pass API keys as command-line arguments. - Accept secrets through a non-echoing interactive prompt, a secret manager, or a protected environment file. - If environment variables are used, prevent them from being printed in logs or diagnostic output. - Store sensitive configuration separately from non-sensitive settings where possible. - Set restrictive permissions on secret-bearing files, such as `chmod 600 config.toml`. - Ensure `config.toml` and secret environment files are excluded through `.gitignore`. - Add automated secret scanning to prevent accidental commits. - Document safe backup, logging, and credential-rotation practices. - Advise users who entered real keys using the documented command pattern to remove the relevant shell-history entries and rotate the exposed credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Debian/Ubuntu:
  ```bash
  sudo apt-get update
  sudo apt-get install -y ffmpeg wget unzip
  ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Debian/Ubuntu:
  ```bash
  sudo apt-get update
  sudo apt-get install -y ffmpeg wget unzip
  ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to place live API keys directly into config.toml without any warning about plaintext local storage, file permissions, or safer secret-handling options. This creates a real risk of credential leakage through source control commits, backups, shell history, shared workstations, or accidental file disclosure during troubleshooting.

Static analysis

No suspicious patterns detected.