authentication-patterns

• Outcome: Pass
• Latest audit: Aug 26, 2026 · 1:43 PM UTC
• Version: 1.9.19

Overview

This is a documentation-only authentication guidance skill with some risky copy-paste examples, but no hidden installer or automatic execution behavior.

Install only if you want authentication implementation guidance. Treat the subprocess and shell snippets as examples, not trusted drop-in code: allowlist provider CLIs, avoid arbitrary service names, protect API keys and tokens, and clear local auth caches on shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill goes beyond describing authentication patterns and includes executable shell guidance that sources a local script and then performs authenticated operations against real services. In an agent setting, this increases the chance the skill will drive operational side effects, consume cached credentials, or trigger unintended actions if an agent treats the examples as steps to execute rather than documentation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The OAuth example passes an unvalidated, caller-controlled `service` value directly into `subprocess.run` as the executable name. Even without `shell=True`, this still allows execution of arbitrary local programs if an attacker can influence `service`, which is unsafe in an authentication helper because it normalizes command execution during login flows.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The token refresh example repeats the same unsafe pattern by using the untrusted `service` parameter as the command to execute. In documentation for authentication patterns, this is especially risky because developers may copy the snippet verbatim into production code, creating a command-execution primitive in a security-sensitive path.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code executes an external program based directly on the untrusted `service` parameter, which expands the skill from passive verification guidance into active local command execution. Even though `subprocess.run` is called with a list rather than a shell, an attacker who can influence `service` can cause invocation of an unexpected binary present on the system, potentially triggering arbitrary local actions or network calls.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The subprocess-based smoke test is broader than a documentation skill strictly needs and introduces command-execution behavior into a verification pattern. In context this is not necessarily malicious, but it does create a real attack surface because the example normalizes executing caller-selected binaries to validate auth.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger list contains very broad terms such as `security`, `authentication`, `oauth`, and `tokens`, which can cause this skill to activate in many unrelated discussions. In agent environments, overbroad auto-activation expands the blast radius of the skill's operational content, making it more likely that shell-sourcing or authenticated command guidance is injected into contexts where it is unnecessary or unsafe.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The snippet instructs users to append an API key to `~/.env` without any warning about secret exposure, file permissions, shell history, or whether that file is actually used securely by the application. This can lead to long-lived credentials being written to disk in plaintext and mishandled by developers who assume the pattern is safe because it appears in an authentication guidance skill.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly promotes local token caching and fallback to credential-bearing environment variables, but it does not prominently warn users about the sensitivity of those credentials, the risk of disk persistence, or host compromise exposure. In an authentication-focused skill, encouraging cached auth state without strong guidance on secure storage, rotation, and environment leakage can lead to accidental credential exposure or over-retention.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The markdown does not disclose that the verification example will execute a local CLI and may trigger external network requests to a provider. Lack of disclosure increases the chance that a user copies this pattern into an automation context without realizing it performs real command execution and potentially billable or sensitive operations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The auth-status check invokes an external command without documenting that it can execute provider tooling and possibly initiate network activity. In a skill intended as reusable guidance, hidden side effects make misuse more likely and can lead to execution of attacker-influenced binaries when combined with the uncontrolled `service` parameter.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def smoke_test(service: str) -> bool:
    """Test auth with minimal request."""
    try:
        result = subprocess.run(
            [service, "-p", "Respond with OK"],
            capture_output=True,
            timeout=30

• Confidence: 97% confidence
• Finding: `subprocess.run([service, ...])` uses untrusted input as the executable name, creating a command execution primitive if an attacker can control `service` or the runtime PATH. While there is no shell interpolation here, this still allows execution of an unintended program and is dangerous in an agent or automation environment where inputs may be externally influenced.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# Check auth status
    if checks["cli_available"]:
        result = subprocess.run([service, "auth", "status"], capture_output=True)
        checks["auth_valid"] = result.returncode == 0

    # Check model access

• Confidence: 97% confidence
• Finding: This line repeats the same core issue: an attacker-controlled `service` value determines which binary is executed for the auth status check. In the context of an authentication helper skill, this is especially risky because users may assume the code is merely validating credentials when it can actually launch arbitrary local programs.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.