Quantinuumclaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:17 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent quantum-app starter kit, but it asks users to deploy public cloud services and handle secrets with unsafe defaults that need careful review.

Review and harden this before installation or use: avoid real PHI/PII, do not use the one-command deploy path for production, do not put API keys in VITE_* frontend variables, inspect any Fly.io installer before running it, replace placeholder dependency guidance with verified pinned packages, and manually review exactly which secrets are uploaded to Fly.io.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/flyio_config.md:20
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `references/flyio_config.md:20-21` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # 1. Install flyctl curl -L https://fly.io/install.sh | sh ``` ### Technical Analysis The installation instructions download mutable content from an external URL and immediately execute it with the current user's shell. There is no version pinning, checksum verification, signature validation, or opportunity to inspect the downloaded script before execution. The URL belongs to Fly.io's official HTTPS domain, which reduces but does not eliminate the risk. Compromise of the remote distribution service, its deployment pipeline, DNS or TLS trust infrastructure, or the installer itself would allow the delivered payload to change after this Skill has been reviewed. This behavior grants remote content all permissions held by the user running the command and exceeds the minimum privilege necessary to document how to install the Fly.io CLI. ### Attack Path 1. An attacker compromises or modifies the remote installer or its delivery infrastructure. 2. A user follows the Skill's quick-start instructions. 3. `curl` retrieves the attacker-controlled version of `install.sh`. 4. The pipe passes the response directly to `sh` without validation. 5. The payload executes with the user's privileges and can access local files, credentials, environment variables, and network resources. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the invoking user. Depending on those privileges, an attacker could steal Fly.io or quantum-service credentials, modify source files, install persistence, tamper with deployments, or compromise the host. No evidence establishes that the current Fly.io installer is malicious; the vulnerability is the unverified remote execution mechanism. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer an official operating-system package manager or a manually downloaded, version-pinned release. - Verify the artifact using a checksum or cryptographic signature published through an independent trusted channel. - Download the installer to a local file and inspect it before execution. - Do not pipe network responses directly into an interpreter. - Document the exact expected Fly.io CLI version and authoritative release source. A safer workflow is: ```bash curl --fail --proto '=https' --tlsv1.2 \ -o fly-install.sh https://fly.io/install.sh # Review the file and verify its published checksum/signature before execution. less fly-install.sh sh fly-install.sh ``` Checksum or signature verification must still be added; separating download from execution alone is not sufficient. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/flyio_deploy.py:27
• Finding: Fly.io Secrets Are Exposed in Plaintext Command Logs and Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/flyio_deploy.py:27-38, 77-100` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```python def run_command(cmd, cwd=None, capture_output=False): """Run a shell command and return result""" print(f"$ {' '.join(cmd)}") result = subprocess.run( cmd, cwd=cwd, capture_output=capture_output, text=True ) if result.returncode != 0: print(f"❌ Command failed with exit code {result.returncode}") if result.stderr: print(f"Error: {result.stderr}") raise RuntimeError(f"Command failed: {' '.join(cmd)}") ``` ```python def configure_secrets(app_name, env_file_path): """Set secrets on Fly.io from .env file""" print(f"\n🔐 Configuring secrets for {app_name}") if not env_file_path.exists(): print(f"⚠️ .env file not found at {env_file_path}. Skipping secrets.") return # Read .env file secrets = {} for line in env_file_path.read_text().splitlines(): line = line.strip() if line and not line.startswith("#") and "=" in line: key, value = line.split("=", 1) secrets[key.strip()] = value.strip() # Set secrets on Fly.io for key, value in secrets.items(): if value and not value.startswith("your_"): # Skip placeholder values cmd = ["fly", "secrets", "set", f"{key}={value}", "--app", app_name] run_command(cmd) print(f" ✓ Set secret: {key}") ``` ### Technical Analysis `configure_secrets` reads every non-comment assignment from `.env` and places the complete `KEY=value` pair into the `fly secrets set` argument list. `run_command` then prints the full argument list before execution. The same secret-bearing command is also included in raised error messages. Although `subprocess.run` uses an argument array and therefore avoids shell injection, it does not protect ...[truncated 1147 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never include secret values in diagnostic output or exception messages. - Add a redacted logging path that displays only the command and secret names. - Pass secret material through standard input if supported by Fly.io CLI. - If standard input is unavailable, invoke the CLI in a way that minimizes process-argument exposure and explicitly warn users about the limitation. - Restrict `.env` file permissions and parse it with a robust dotenv parser. - Ensure CI systems mask known secret values and disable command tracing around credential operations. - Avoid automatically treating every `.env` assignment as a deployment secret; use an explicit allowlist. For example, log only: ```python print(f"$ fly secrets set {key}=<redacted> --app {app_name}") ``` Raised exceptions must also use the redacted representation rather than joining the original argument list. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: assets/selene-template/main.py:128
• Finding: Public Quantum API Is Deployed Without Authentication, Authorization, or Enforced Rate Limits<![CDATA[ ## Vulnerability Details **File Location**: `assets/selene-template/main.py:128-134, 202-289`; generated equivalent in `scripts/setup_selene_service.py:52-59, 122-140` **Vulnerability Type**: Missing access control and resource-abuse protection **Risk Level**: High ### Vulnerable Code ```python app.add_middleware( CORSMiddleware, allow_origins=["*"], # TODO: Restrict to your frontend domain allow_credentials=True, allow_methods=["*"], allow_headers=["*"], ) ``` ```python @app.post("/api/optimization/compute") async def compute(request: ComputeRequest): try: if not request.wait and not request.params.get("job_id"): import uuid job_id = str(uuid.uuid4()) jobs[job_id] = { "status": "queued", "params": request.params, "created_at": datetime.utcnow().isoformat() } return JobResponse( job_id=job_id, status="queued", message="Job queued for processing" ).dict() result = app.state.quantum_service.execute_quantum_circuit( request.params, timeout_seconds=request.timeout_ms // 1000 ) ``` ```python @app.get("/api/jobs/{job_id}") async def get_job_status(job_id: str): """Get status of asynchronous quantum job""" if job_id not in jobs: raise HTTPException(status_code=404, detail="Job not found") job = jobs[job_id] return { "job_id": job_id, **job, "created_at": job["created_at"] } @app.get("/api/jobs/{job_id}/result") async def get_job_result(job_id: str): """Get result of completed job""" if job_id not in jobs: raise HTTPException(status_code=404, detail="Job not found") job = jobs[job_id] if job["status"] != "completed": raise HTTPException( status_code=400, detail=f"Job not completed. Current status: {job['s ...[truncated 2147 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Deny access by default and require server-side authentication on every compute and job endpoint. - Associate each job with an authenticated principal and enforce ownership checks before returning status or results. - Use short-lived, scoped credentials rather than a shared static key. - Implement real per-user and per-IP rate limits, concurrency limits, request-size limits, and cost quotas. - Restrict CORS to explicitly approved HTTPS frontend origins. - Do not return stored request parameters from status endpoints unless strictly required. - Add typed Pydantic models with bounds for every supported use case instead of accepting unrestricted dictionaries. - Add queue backpressure and budget controls before enabling real quantum hardware. - Do not label the template production-ready until authentication, authorization, rate limiting, and secure error handling are implemented. - Continue to prohibit PHI unless an appropriate compliance, data-processing, retention, and access-control plan is in place. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: assets/lovable-template/src/lib/api.ts:3
• Finding: Frontend API Key Is Embedded in Public Vite Assets<![CDATA[ ## Vulnerability Details **File Location**: `assets/lovable-template/src/lib/api.ts:3-19` **Vulnerability Type**: Client-side credential disclosure **Risk Level**: High ### Vulnerable Code ```typescript import axios from 'axios' const API_BASE = import.meta.env.VITE_API_URL || 'http://localhost:8080' export const api = axios.create({ baseURL: API_BASE, timeout: 30000, headers: { 'Content-Type': 'application/json', }, }) // Request interceptor for auth api.interceptors.request.use( (config) => { const apiKey = import.meta.env.VITE_API_KEY if (apiKey) { config.headers.Authorization = `Bearer ${apiKey}` } return config }, (error) => Promise.reject(error) ) ``` The same pattern is also recommended in `references/lovable_patterns.md:50-65`. ### Technical Analysis Vite statically replaces `import.meta.env.VITE_*` references during frontend builds. Consequently, `VITE_API_KEY` is not a protected runtime secret: it becomes part of browser-delivered JavaScript or is directly visible in outgoing HTTP requests. Any visitor can inspect the compiled bundle, browser developer tools, or network traffic and recover the bearer value. A single shared frontend key also cannot reliably identify individual users or constrain access by user. The bearer-header behavior documented in `references/selene_api.md` is normal authentication transport to an operator-configured endpoint and is not evidence of unauthorized exfiltration. The vulnerability is storing a privileged shared credential in the browser bundle. ### Attack Path 1. An operator sets `VITE_API_KEY` during the frontend build or deployment. 2. Vite substitutes the value into the compiled static JavaScript. 3. A visitor downloads the JavaScript or observes an API request in browser developer tools. 4. The visitor extracts the bearer token. 5. The visitor sends direct requests to the backend using the stolen token, bypassing frontend restrictions. ### Impact Assess ...[truncated 311 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never place privileged credentials in `VITE_*` variables or any other client-side configuration. - Authenticate individual users through an appropriate identity provider. - Issue short-lived, narrowly scoped access tokens after successful authentication. - Enforce authorization, quota, and ownership controls at the backend. - If a privileged upstream API requires a secret, call it only from a trusted server-side component or backend-for-frontend. - Rotate any key that has already been included in a production frontend build. - Add documentation explicitly stating that all `VITE_*` values are public. - Add secret-scanning checks for generated frontend assets and source maps. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lovable_integrate.py:89
• Finding: Untrusted CLI Values Are Interpolated Directly into Generated Executable Source<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lovable_integrate.py:89-145, 351-363, 477-480` **Vulnerability Type**: Generated-code injection **Risk Level**: Medium ### Vulnerable Code The backend URL is inserted into executable Vite configuration: ```python VITE_CONFIG = '''import {{ defineConfig }} from 'vite' import react from '@vitejs/plugin-react' export default defineConfig({{ plugins: [react()], server: {{ port: 5173, proxy: {{ '/api': {{ target: '{backend_url}', changeOrigin: true, rewrite: (path) => path.replace(/^\\/api/, '') }} }} }} }}) ''' ``` User-provided values are also inserted into TSX: ```python APP_TSX = '''import {{ QueryClient, QueryClientProvider, }} from '@tanstack/react-query' import {{ QuantumDashboard }} from './components/QuantumDashboard' const queryClient = new QueryClient() function App() {{ return ( <QueryClientProvider client={queryClient}> <div className="min-h-screen bg-gray-900 text-white"> <header className="bg-gray-800 p-4 shadow-lg"> <h1 className="text-2xl font-bold">{app_name}</h1> <p className="text-gray-400">Quantum {quantum_use_case} powered by Guppy/Selene</p> </header> <main className="p-6"> <QuantumDashboard backendUrl="{backend_url}" quantumUseCase="{quantum_use_case}" /> </main> ``` The interpolated files are written without validation or context-specific escaping: ```python (project_dir / "vite.config.ts").write_text(VITE_CONFIG.format(backend_url=backend_url)) print(" ✓ Created vite.config.ts") (project_dir / "index.html").write_text( INDEX_HTML.format(app_name=app_name, quantum_use_case=quantum_use_case) ) print(" ✓ Created index.html") (src_dir / "App.tsx").write_text( APP_TSX.format( app_name=app_name, quantum_use_case=quantum_use_case, backend_url=backend_url ) ) ``` The values originate directly from CLI argu ...[truncated 1985 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate `backend_url` using a strict URL parser. - Allow only `https` for non-local destinations and reject credentials, control characters, fragments, and unexpected schemes. - Restrict application names and use-case identifiers to a conservative pattern such as `[A-Za-z0-9_-]+`. - Serialize JavaScript and JSX string values using a safe JSON encoder rather than manual interpolation. - Generate `package.json` through `json.dump` instead of string formatting. - Apply HTML-context escaping to values inserted into HTML. - Avoid inserting untrusted text into executable build configuration where possible. - Refuse to overwrite an existing project without explicit confirmation. - Add tests containing quotes, backticks, braces, newlines, HTML metacharacters, and script fragments to ensure generated files remain syntactically safe. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:140
• Finding: Instructions Recommend Installing an Ambiguous Unpinned Guppy Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:140`; also `references/guppy_guide.md:462` and `assets/selene-template/README.md:209,238` **Vulnerability Type**: Unsafe and non-reproducible dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown - **Guppy import error:** `pip install guppy` in backend; or use mock mode for demos. ``` Equivalent instructions elsewhere include: ```bash pip install guppy ``` The generated dependency template separately acknowledges uncertainty about the package version: ```python REQUIREMENTS_TEMPLATE = '''fastapi==0.104.1 uvicorn[standard]==0.24.0 guppy==0.1.0 # TODO: Update to actual Guppy version pydantic==2.5.0 python-dotenv==1.0.0 ''' ``` The shipped `assets/selene-template/requirements.txt` comments this dependency out, but the documentation still directs users to install it by an unpinned generic name. ### Technical Analysis Installing a package solely by the name `guppy` delegates package identity and version selection to the configured Python package index. The Skill does not provide an authoritative project URL, verified publisher identity, exact audited version, lock file, or artifact hash demonstrating that this is the intended Quantinuum Guppy runtime. A generic unpinned name creates dependency-confusion and package-substitution risk. Even if the package currently resolves correctly, future installations can retrieve a different release than the one reviewed, making builds non-reproducible. No evidence from the audit proves that a currently published package is malicious. The confirmed weakness is unsafe dependency identification and installation guidance. ### Attack Path 1. A user encounters the documented Guppy import error. 2. The user follows the instruction `pip install guppy`. 3. The configured package index resolves the generic name to an unintended, compromised, or subsequently modified package release. 4. Installation hooks or imported package code run in ...[truncated 511 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Identify and document the authoritative Quantinuum distribution name and publisher. - Link to the official package documentation and repository. - Pin a reviewed exact version rather than using an unconstrained package name. - Use a lock file and require cryptographic hashes for production installation. - Keep the package disabled until its correct identity and compatible version are established. - Remove contradictory instructions and TODO versions from production-facing templates. - Prefer commands such as the following only after replacing the placeholders with verified values: ```bash pip install --require-hashes -r requirements.lock ``` - Review package updates before changing the lock file and use an internal trusted package mirror where appropriate. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a specialized skill for building and deploying quantum computing applications, including healthcare-oriented use cases and cloud/deployment integrations. The actual code chunk does not implement any of that functionality. It only configures a local Vite development server for a React app and proxies API calls to a localhost backend. This is a materially different primary purpose from the declared description, so it is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description is broader and more operational than the code. This script only scaffolds frontend files for a React/Vite app and configures them to call a presumed backend URL. It does not deploy anything, provision infrastructure, communicate with Fly.io, invoke quantum services, or implement healthcare-specific features. While it is related to integrating quantum results into a user-facing interface, the primary behavior is much narrower than the declared purpose, so this is a meaningful description-behavior mismatch.

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/lovable_integrate.py \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/lovable_integrate.py \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Instruction Override

High

• Category: Prompt Injection

Content

| `PORT` | Service port (Fly.io sets this) | No (default: 8080) |
| `QUANTUM_HARDWARE` | Hardware target: h2, h1, emulator | No |
| `QUANTUM_API_KEY` | Quantinuum API key for real hardware | Only for real hardware |
| `DEBUG` | Enable debug mode | No (default: false) |

### fly.toml Configuration

• Confidence: 70% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Known Vulnerable Dependency: fastapi==0.104.1 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The file pins FastAPI to version 0.104.1, and the static analysis reports a known high-severity advisory (CVE-2024-24762) affecting that version. Because this template is for building deployable web APIs, shipping a vulnerable framework version can expose downstream applications to exploitable request-handling or API-layer weaknesses in real deployments.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Install flyctl
curl -L https://fly.io/install.sh | sh

# 2. Login
fly auth login

• Confidence: 98% confidence
• Finding: Piping a remote script directly into the shell executes code fetched over the network without integrity verification, pinning, or prior review. If the remote endpoint, transport, or upstream script is compromised, users can suffer arbitrary code execution on their local machine or CI runner.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Install flyctl
curl -L https://fly.io/install.sh | sh

# 2. Login
fly auth login

• Confidence: 70% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"✅ App created")

def configure_secrets(app_name, env_file_path):
    """Set secrets on Fly.io from .env file"""
    print(f"\n🔐 Configuring secrets for {app_name}")

    if not env_file_path.exists():

• Confidence: 87% confidence
• Finding: The script automatically reads a local .env-style file and prepares to push its contents into Fly.io secrets, which can transfer sensitive credentials to a remote platform with little operator scrutiny. In this healthcare/clinical deployment context, bulk-importing environment variables increases the chance of unintentionally exporting development, test, or regulated secrets to the wrong cloud app or tenant.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"\n🔐 Configuring secrets for {app_name}")

    if not env_file_path.exists():
        print(f"⚠️  .env file not found at {env_file_path}. Skipping secrets.")
        return

    # Read .env file

• Confidence: 87% confidence
• Finding: The secret-loading workflow trusts any existing .env path and does not distinguish between safe local configuration and highly sensitive credentials that should never be propagated automatically. This can cause accidental credential exposure to cloud deployment targets, especially dangerous given the skill's focus on clinical and healthcare projects where credentials may guard protected data and regulated systems.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"⚠️  .env file not found at {env_file_path}. Skipping secrets.")
        return

    # Read .env file
    secrets = {}
    for line in env_file_path.read_text().splitlines():
        line = line.strip()

• Confidence: 93% confidence
• Finding: This code reads every non-comment key/value pair from the .env file and uploads them, creating a mass-secret exfiltration path from local developer storage to remote Fly.io configuration. Because there is no filtering, classification, or review step, sensitive tokens unrelated to the deployed service could be uploaded inadvertently.

Credential Access

High

• Category: Privilege Escalation

Content

# Step 3: Configure secrets
        if not args.skip_secrets:
            env_file = service_dir / ".env"
            if not env_file.exists():
                env_file = service_dir / ".env.example"
                print(f"⚠️  .env not found, using .env.example as reference")

• Confidence: 90% confidence
• Finding: The script defaults to consuming .env from the service directory during deployment preparation, which makes secret export automatic rather than deliberate. In a healthcare-oriented skill, this increases the operational risk of pushing credentials tied to PHI-bearing systems or other regulated services into the wrong environment.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = service_dir / ".env"
            if not env_file.exists():
                env_file = service_dir / ".env.example"
                print(f"⚠️  .env not found, using .env.example as reference")
            configure_secrets(args.app_name, env_file)

        # Step 4: Deploy (unless setup-only)

• Confidence: 95% confidence
• Finding: Falling back to .env.example as a source for secret configuration is dangerous because example files are often committed, stale, shared, or attacker-modifiable; if populated with real-looking values, they may be uploaded to production or used to poison deployment configuration. This is particularly risky in an agent skill where repository content must be treated as untrusted and where cloud deployment actions have real external side effects.

Credential Access

High

• Category: Privilege Escalation

Content

.gitignore_content = '''node_modules/
dist/
.env.local
.env.*.local
*.log
.DS_Store

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"\n✅ Selene service created at: {project_dir}")
    print(f"\nNext steps:")
    print(f"1. cd {project_dir}")
    print(f"2. Install dependencies and configure .env")
    print(f"3. Implement actual Guppy algorithm in main.py")
    print(f"4. Test locally: python main.py")
    print(f"5. Deploy: fly launch --now")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README promotes one-command generation, deployment, and public frontend/backend wiring for clinical use cases without giving an immediate, prominent warning about sensitive health data, endpoint exposure, authentication, or data minimization in the same workflow section. In a healthcare-themed skill, this omission can lead users to rapidly deploy internet-accessible services that process clinical inputs before they have added auth, restricted CORS, or ensured de-identification, increasing the likelihood of data exposure or unsafe handling.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/lovable-template/src/lib/api.ts:16

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/lovable_patterns.md:63