Security audit

Arc Sentinel

Security checks for vulnerabilities and agentic risk

Overview

This security-monitoring skill is mostly coherent, but it needs Review because some scripts inspect local credential stores and one JSON mode can print secret values into logs.

Review before installing. Use it only if you are comfortable with local security-audit scripts reading credential metadata and selected credential files under your home directory. Avoid secret-scanner.sh --format=json until matches are masked or removed, and treat any generated reports or logs as sensitive. Prefer running individual scripts for the exact scope you intend instead of full-audit.sh when auditing only one repository.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/secret-scanner.sh:79
Finding: Secret Scanner Discloses Detected Credentials in JSON Output
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/token-watchdog.sh:98
Finding: Full Audit Automatically Reads Account-Wide Credential and Private-Key Files
Content: View full analysis
/dev/null; then expiry=$(python3 -c " import json, sys try: with open('$FULCRA_TOKEN') as f: d = json.load(f) # Check common expiry field names for key in ['expires_at', 'expiry', 'exp', 'expiresAt', 'expires']: if key in d: print(d[key]) sys.exit(0) # Try to decode JWT access_token for key in ['access_token', 'token', 'id_token']: if key in d: import base64 parts = d[key].split('.') if len(parts) >= 2: payload = parts[1] + '==' # pad decoded = json.loads(base64.urlsafe_b64decode(payload)) if 'exp' in decoded: print(decoded['exp']) sys.exit(0) print('unknown') except Exception as e: print('error') " 2>/dev/null) || expiry="error" fi ``` Related sensitive reads also occur at: - `scripts/token-watchdog.sh:177-188` — Docker credential configuration - `scripts/token-watchdog.sh:200-219` — npm and AWS credential files - `scripts/token-watchdog.sh:228-254` — Kubernetes configuration and private SSH-key headers ### Technical Analysis Running `scripts/full-audit.sh` invokes the token watchdog automatically and without source-specific consent. The watchdog opens credential-bearing files under the user's home directory even when the requested audit target is only a repository. The Fulcra check parses the complete token JSON and reads access tokens to decode their JWT payloads. Additional checks inspect Docker authentication configuration, npm configuration, AWS credentials, Kubernetes configura ...[truncated 1970 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/permission-auditor.sh:91
Finding: Platform-Specific Permission Commands Can Cause Incorrect Security Results
Content: View full analysis
/dev/null) || true if [[ -n "$ssh_perms" && "$ssh_perms" != "700" ]]; then emit_finding "CRITICAL" "SSH Directory" "$SSH_DIR has permissions $ssh_perms (should be 700)" else emit_finding "INFO" "SSH Directory" "$SSH_DIR permissions OK (700)" fi # Check individual key files for keyfile in "$SSH_DIR"/id_* "$SSH_DIR"/*.pem; do [[ -f "$keyfile" ]] || continue # Skip public keys [[ "$keyfile" == *.pub ]] && continue perms=$(stat -f '%Lp' "$keyfile" 2>/dev/null) || true if [[ -n "$perms" && "$perms" != "600" && "$perms" != "400" ]]; then emit_finding "CRITICAL" "SSH Key" "$keyfile has permissions $perms (should be 600 or 400)" fi done ``` A related portability issue occurs at line 175: ```bash world_writable=$(find "$HOME" -maxdepth 2 -type f -perm +002 2>/dev/null | head -20) || true ``` ### Technical Analysis The permission auditor uses BSD/macOS-specific command syntax without first detecting the operating system or command implementation. In particular, `stat -f '%Lp'` is not equivalent to GNU `stat` permission formatting, and `find -perm +002` is unsupported or deprecated in common GNU environments. Errors are redirected to `/dev/null`, and `|| true` suppresses command failures. Empty or invalid values can therefore skip checks or be interpreted incorrectly. The SSH-directory branch is especially unsafe because an empty result reaches the `else` branch and reports that permissions are acceptable. A security auditor must fail closed when it cannot determine a permission value. Reporting success after a failed check creates false assurance. ### Attack Path 1. The auditor is run on a host whose `stat` or `find` implementation does not support the assumed macOS ...[truncated 920 chars]
Remediation: View remediation
/dev/null 2>&1; then perms=$(stat -f '%Lp' "$path") elif stat -c '%a' "$path" >/dev/null 2>&1; then perms=$(stat -c '%a' "$path") else emit_finding "WARNING" "Permission Check" "Unable to determine permissions for $path" continue fi ``` 2. Use portable GNU-compatible world-writable matching where appropriate: ```bash find "$HOME" -maxdepth 2 -type f -perm -0002 ``` 3. Never report an `INFO` or `OK` result when the permission command returns an empty or invalid value. 4. Remove blanket `2>/dev/null || true` handling around security-critical checks. Capture errors and emit an explicit warning. 5. Validate that permission output contains only the expected octal format before comparing it. 6. Add automated tests for at least: - macOS/BSD - GNU/Linux - Missing `stat` - Permission-denied conditions 7. Ensure an incomplete audit produces a nonzero exit code distinct from a confirmed clean result. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/git-hygiene.sh:251
Finding: Tracked Sensitive Files Do Not Affect Git Hygiene Exit Status
Content: View full analysis
/dev/null | while IFS= read -r f; do case "$f" in *.env|*.env.*|*.pem|*.key|*.p12|*.pfx|*id_rsa|*id_ed25519|*.keystore|*credentials.json|*.secret) emit_finding "CRITICAL" "Tracked Sensitive File" "$f should not be in version control" tracked_sensitive=$((tracked_sensitive + 1)) ;; esac done || true ``` The final verdict is calculated later from the parent shell's counters: ```bash if [[ $CRITICAL -gt 0 ]]; then exit 2 elif [[ $WARNING -gt 0 ]]; then exit 1 else exit 0 fi ``` ### Technical Analysis In Bash, a loop on the right side of a pipeline normally executes in a subshell. The `emit_finding` function increments `FINDINGS` and `CRITICAL`, but those changes occur only in the pipeline subshell and are discarded when the loop ends. Consequently, the script can print a critical finding for a tracked `.env`, private key, credential file, or similar artifact while the parent shell retains its earlier counter values. If no other warning or critical finding exists, the script can subsequently exit with status `0`. This creates a discrepancy between visible output and machine-readable status. CI pipelines and agent orchestration commonly rely on exit codes rather than parsing all terminal output, making the defect directly security-relevant. ### Attack Path 1. A repository contains a tracked file matching one of the sensitive patterns, such as: ```text production.env deploy.key id_rsa credentials.json ``` 2. The user or CI system runs: ```bash scripts/git-hygiene.sh /path/to/repository ``` 3. `git ls-files` returns the sensitive path. 4. The pipeline subshell calls `emit_finding`, which increments `CRITICAL` only inside that subshell. ...[truncated 827 chars]
Remediation: View remediation
/dev/null) ``` 2. Check and report failure of `git ls-files` rather than suppressing it with `|| true`. 3. Add a final invariant ensuring `tracked_sensitive > 0` forces `CRITICAL > 0` and exit status `2`. 4. Add regression tests that create repositories with tracked `.env`, `.pem`, `id_rsa`, and `credentials.json` files and verify: - A critical finding is emitted. - The critical counter is incremented. - The process exits with status `2`. 5. Have `full-audit.sh` preserve scanner exit statuses directly rather than relying only on regular-expression counting of scanner output. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: This finding indicates the documented primary purpose differs from the actual effective capability, with the real emphasis reportedly being auditing installed skills rather than the infrastructure checks advertised. Such mismatch is dangerous because it can both hide undeclared inspection behavior and cause defenders to rely on nonexistent protections, leading to misconfiguration and missed incidents.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding indicates the documented primary purpose differs from the actual effective capability, with the real emphasis reportedly being auditing installed skills rather than the infrastructure checks advertised. Such mismatch is dangerous because it can both hide undeclared inspection behavior and cause defenders to rely on nonexistent protections, leading to misconfiguration and missed incidents.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This finding indicates the documented primary purpose differs from the actual effective capability, with the real emphasis reportedly being auditing installed skills rather than the infrastructure checks advertised. Such mismatch is dangerous because it can both hide undeclared inspection behavior and cause defenders to rely on nonexistent protections, leading to misconfiguration and missed incidents.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/git-hygiene.sh (reported line 123)May include surrounding context.
sh
echo -e "${BOLD}Checking .gitignore completeness...${RESET}" REQUIRED_PATTERNS=( ".env" ".env.*" "*.key" "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 144)May include surrounding context.
sh
echo -e "${BOLD}Checking .gitignore completeness...${RESET}" REQUIRED_PATTERNS=( ".env" ".env.*" "*.key" "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/secret-scanner.sh (reported line 185)May include surrounding context.
sh
echo -e "${BOLD}Checking .gitignore completeness...${RESET}" REQUIRED_PATTERNS=( ".env" ".env.*" "*.key" "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/git-hygiene.sh (reported line 132)May include surrounding context.
sh
"*.keystore" "id_rsa" "id_ed25519" "credentials.json" "token.json" "*.secret" )

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/git-hygiene.sh (reported line 253)May include surrounding context.
sh
"*.keystore" "id_rsa" "id_ed25519" "credentials.json" "token.json" "*.secret" )

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/secret-scanner.sh (reported line 185)May include surrounding context.
sh
"*.keystore" "id_rsa" "id_ed25519" "credentials.json" "token.json" "*.secret" )

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/secret-scanner.sh (reported line 204)May include surrounding context.
sh
"*.keystore" "id_rsa" "id_ed25519" "credentials.json" "token.json" "*.secret" )

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 135)May include surrounding context.
sh
SENSITIVE_PATHS=( "$HOME/.config/fulcra/token.json" "$HOME/.config/gh/hosts.yml" "$HOME/.netrc" "$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 136)May include surrounding context.
sh
"$HOME/.config/fulcra/token.json" "$HOME/.config/gh/hosts.yml" "$HOME/.netrc" "$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/token-watchdog.sh (reported line 200)May include surrounding context.
sh
"$HOME/.config/fulcra/token.json" "$HOME/.config/gh/hosts.yml" "$HOME/.netrc" "$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 138)May include surrounding context.
sh
"$HOME/.netrc" "$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/token-watchdog.sh (reported line 177)May include surrounding context.
sh
"$HOME/.netrc" "$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config"

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 139)May include surrounding context.
sh
"$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config" "$HOME/.gnupg"

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/token-watchdog.sh (reported line 230)May include surrounding context.
sh
"$HOME/.npmrc" "$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config" "$HOME/.gnupg"

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 140)May include surrounding context.
sh
"$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config" "$HOME/.gnupg" "$HOME/.secrets"

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/token-watchdog.sh (reported line 212)May include surrounding context.
sh
"$HOME/.pypirc" "$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config" "$HOME/.gnupg" "$HOME/.secrets"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 141)May include surrounding context.
sh
"$HOME/.docker/config.json" "$HOME/.kube/config" "$HOME/.aws/credentials" "$HOME/.aws/config" "$HOME/.gnupg" "$HOME/.secrets" "$HOME/.env"

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/permission-auditor.sh (reported line 162)May include surrounding context.
sh
# Check group readable for very sensitive files group_perms=${perms:(-2):1} case "$spath" in *credentials*|*token*|*.netrc|*.pypirc|*hosts.yml) if [[ "$group_perms" =~ [4567] ]]; then emit_finding "WARNING" "Group-Readable" "$spath is group-readable (perms: $perms)" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/secret-scanner.sh (reported line 118)May include surrounding context.
sh
--include='*.go' --include='*.rs' --include='*.java' --include='*.sh' \ --include='*.bash' --include='*.zsh' --include='*.yml' --include='*.yaml' \ --include='*.json' --include='*.xml' --include='*.toml' --include='*.ini' \ --include='*.cfg' --include='*.conf' --include='*.config' --include='*.env' \ --include='*.env.*' --include='*.properties' --include='*.tf' \ --include='*.md' --include='*.txt' --include='*.html' --include='*.css' \ --include='*.dockerfile' --include='Dockerfile' --include='*.csv' \

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/secret-scanner.sh (reported line 167)May include surrounding context.
sh
--include='*.go' --include='*.rs' --include='*.java' --include='*.sh' \ --include='*.bash' --include='*.zsh' --include='*.yml' --include='*.yaml' \ --include='*.json' --include='*.xml' --include='*.toml' --include='*.ini' \ --include='*.cfg' --include='*.conf' --include='*.config' --include='*.env' \ --include='*.env.*' --include='*.properties' --include='*.tf' \ --include='*.md' --include='*.txt' --include='*.html' --include='*.css' \ --include='*.dockerfile' --include='Dockerfile' --include='*.csv' \

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/skill-auditor.sh (reported line 193)May include surrounding context.
sh
fi fi # Check for chmod 777 or overly permissive operations bad_chmod=$(echo "$content" | grep -noE 'chmod\s+(777|666|a\+[rwx])' 2>/dev/null | head -3) || true if [[ -n "$bad_chmod" ]]; then while IFS= read -r match; do

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/token-watchdog.sh (reported line 203)May include surrounding context.
sh
NPMRC="$HOME/.npmrc" if [[ -f "$NPMRC" ]]; then if grep -q '_authToken' "$NPMRC" 2>/dev/null; then emit_token "INFO" "NPM" "Auth token present in ~/.npmrc" else emit_token "MISSING" "NPM" "No auth token in ~/.npmrc" fi

Static analysis

No suspicious patterns detected.