Krónan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.3

Overview

This grocery-shopping CLI skill is coherent, but it asks users to run mutable remote installer code and handle an account token that can read and change real shopping data.

Review the upstream arnif/kronan-cli repository and installer before installing, prefer a pinned release with a verified checksum if available, avoid entering access tokens directly in commands where logs or history may capture them, and do not let an agent run --force or any state-changing cart, list, note, order, or stats command without fresh explicit approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29

Finding

Mutable Remote Installer and Binary Are Executed Without Integrity Verification

Content

View full analysis

clones the repo to `/tmp/kronan-cli`, then `install.sh` downloads a pre-built binary from the latest GitHub release and places it at `~/.local/bin/kronan` ### Technical Analysis The installation command clones the mutable default branch of an external GitHub repository and immediately executes `install.sh`. That remote script subsequently downloads a pre-built binary from the mutable “latest” release. Neither the repository revision nor the release artifact is pinned to an immutable commit, tag digest, or cryptographic checksum. No signature, provenance attestation, or trusted-publisher verification is required before execution. The installer and downloaded binary are not included in the audited project, so their behavior cannot be validated from this package. This creates a remote payload channel whose effective code can change after the Skill has been reviewed. Compromise of the upstream repository, maintainer credentials, release workflow, or distribution artifact could turn the documented installation process into arbitrary local code execution. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its release pipeline. 2. The attacker modifies the default branch’s `install.sh` or replaces the binary referenced by the latest release. 3. A user or AI Agent follows the documented installation command. 4. The mutable installer executes under the invoking user’s account. 5. The installer downloads or installs the attacker-controlled binary. 6. The payload can access files and credentials available to that user, including the documented Krónan toke ...[truncated 504 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Source Build Executes Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Access Token Is Passed Through a Command-Line Argument

Content

View full analysis

``` The documentation states that the supplied token is validated and stored locally. ### Technical Analysis Supplying an access token directly as a command-line argument can expose it outside the intended credential store. Depending on the operating system and shell configuration, command arguments may be recorded in shell history, terminal transcripts, process inspection interfaces, command auditing systems, debugging output, or AI Agent conversation and tool logs. Restricting the stored file to mode `600` protects the final token file but does not address exposure that occurs while the token is entered or while the process is running. ### Attack Path 1. The user follows the documented command and places the Krónan access token directly in the shell command line. 2. The shell, terminal, Agent framework, auditing service, or process-monitoring mechanism records or exposes the argument. 3. Another local user, administrator, log reader, transcript reader, or compromised process obtains the token. 4. The attacker submits authenticated requests using the documented `Authorization: AccessToken {token}` format. 5. The attacker accesses or modifies data permitted by the token until it is revoked or expires. ### Impact Assessment A disclosed token may allow unauthorized access to the associated Krónan account through the Public API. Based on the documented features, exposed data may include identity information, purchase history, orders, cart contents, product lists, shopping notes, and purchase statistics. The token may also permit supported state-changing operations, including modifying carts, lists, notes, order lines, substitution settings, and ignored purchase statistics. The exact scope is limited to the privi ...[truncated 44 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- [GitHub CLI](https://cli.github.com) (`gh`) — required for the install command
- A Krónan account with **Auðkenni** (Icelandic e-ID) login
- An Access Token from https://kronan.is/adgangur/adgangslyklar

## Install

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

## Security and privacy

- **Install script**: `install.sh` executes on your machine and downloads a binary. Audit the [repository](https://github.com/arnif/kronan-cli) and the script before running.
- **Token storage**: Access tokens are stored at `~/.kronan/token`. These are credentials for the Krónan Public API. Ensure the file is only readable by your user (`chmod 600 ~/.kronan/token`).
- **PII**: `kronan me` outputs your identity information (name and type - user or customer group). Be careful when sharing this output.
- **API Access**: Tokens are created in your Krónan account settings and can be revoked at any time at https://kronan.is/adgangur/adgangslyklar

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

## Authentication

First, create an access token:
1. Go to https://kronan.is/adgangur/adgangslyklar
2. Log in with Auðkenni (Icelandic e-ID)
3. Create a new access token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The command kronan token <your-access-token> encourages passing the secret directly as a command-line argument, which can expose it via shell history, process listings, terminal logging, or agent transcripts. In an AI-agent setting, this is more dangerous because the token may be captured in tool-call logs or conversation context.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

First, create an access token:
1. Go to https://kronan.is/adgangur/adgangslyklar
2. Log in with Auðkenni (Icelandic e-ID)
3. Create a new access token

Then save it with the CLI:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

If you were using the previous version with Cognito authentication:

1. Remove old tokens: `rm ~/.kronan/tokens.json`
2. Get a new access token from https://kronan.is/adgangur/adgangslyklar
3. Run `kronan token <new-token>`
4. Update any scripts using `kronan login` to use `kronan token` instead

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The migration example again instructs users to pass a new access token on the command line, repeating the risk of exposing credentials through history, process inspection, and logs. Because this skill is explicitly designed for AI agents, transcript and tool logging make that exposure pathway more realistic.

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

md

If you were using the previous version with Cognito authentication:

1. Remove old tokens: `rm ~/.kronan/tokens.json`
2. Get a new access token from https://kronan.is/adgangur/adgangslyklar
3. Run `kronan token <new-token>`
4. Update any scripts using `kronan login` to use `kronan token` instead

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

## Security and privacy

- **Install script**: `install.sh` executes on your machine and downloads a binary. Audit the [repository](https://github.com/arnif/kronan-cli) and the script before running.
- **Token storage**: Access tokens are stored at `~/.kronan/token`. These are credentials for the Krónan Public API. Ensure the file is only readable by your user (`chmod 600 ~/.kronan/token`).
- **PII**: `kronan me` outputs your identity information (name and type - user or customer group). Be careful when sharing this output.
- **API Access**: Tokens are created in your Krónan account settings and can be revoked at any time at https://kronan.is/adgangur/adgangslyklar

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `notes add`, `notes update`, `notes remove`, `notes toggle`, `notes clear`
- `stats ignore`, `stats unignore`

Read-only commands are safe to run without confirmation:
- `search`, `product`, `categories`, `category`
- `orders`, `order` (view)
- `cart` (view)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The documented --force flag allows destructive operations to bypass confirmation, which creates a real risk when the skill is used by AI agents or scripts. In this skill's context, those operations affect real shopping data, so accidental or unauthorized cart/list/note/order changes become easier if an agent is induced to use --force.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

| `--limit <n>` | Results per page |
| `--offset <n>` | Offset for pagination |
| `--include-ignored` | Include ignored products in stats |
| `--force` | Skip confirmation for destructive operations |
| `--text "..."` | Text for shopping note item |
| `--sku SKU` | Product SKU |
| `--quantity N` | Quantity (default: 1) |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md

## API Reference

The CLI uses the official Krónan Public API at `https://api.kronan.is/api/v1/`.

API Documentation:
- Swagger UI: https://api.kronan.is/api/v1/schema/swagger-ui/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md

## API Reference

The CLI uses the official Krónan Public API at `https://api.kronan.is/api/v1/`.

API Documentation:
- Swagger UI: https://api.kronan.is/api/v1/schema/swagger-ui/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md

## API Reference

The CLI uses the official Krónan Public API at `https://api.kronan.is/api/v1/`.

API Documentation:
- Swagger UI: https://api.kronan.is/api/v1/schema/swagger-ui/