authentication-patterns

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:48 AM UTC
• Version: 1.9.19

Overview

This is an authentication guidance skill, but some examples encourage risky credential storage and loosely scoped local command execution.

Review before installing. Use this only for explicit authentication implementation or review tasks, avoid copying the ~/.env secret-storage example as written, and require allowlisted provider CLIs or SDK calls before adopting the subprocess patterns. Treat the external leyline script/plugin reference as separate code that should be reviewed before sourcing or installing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: modules/auth-methods.md:13

Finding

Insecure Plaintext API Key Storage Guidance

Content

View full analysis

> ~/.env ``` ### Technical Analysis The documented setup pattern encourages users to place an API key in a generic plaintext file without first creating the file with restrictive permissions. The resulting `~/.env` file inherits permissions determined by the user's current `umask`, which may allow unintended local access. If a user replaces the placeholder with an actual API key directly in the command, the credential may also be retained in shell history. A generic home-directory environment file can additionally be consumed by unrelated tools, included in backups, or copied into source-controlled environments. The credential path identified by the static pre-scan at `modules/auth-methods.md` lines 68–72 is not itself vulnerable. Those lines are comments describing common CLI-managed OAuth token locations and do not instruct the agent to read, modify, or transmit those files. ### Attack Path 1. A user follows the documented example and substitutes a real API key for `your-key-here`. 2. The command containing the key is potentially recorded in the user's shell history. 3. The key is appended to `~/.env` without explicit permission hardening. 4. A local user, process, backup system, or unrelated tool with access to the file or shell history obtains the credential. 5. The exposed key is used to authenticate to the associated external service within the permissions assigned to that key. ### Impact Assessment Successful exploitation exposes the API key and grants the attacker the same service privileges and scope assigned to it. Depending on the provider and key configuration, this could permit unauthorized API requests, access to p ...[truncated 325 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules/auth-methods.md (reported line 16)May include surrounding context.

Set in environment

export GEMINI_API_KEY="your-key-here"

Or in .env file

echo "GEMINI_API_KEY=your-key-here" >> ~/.env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules/auth-methods.md (reported line 17)May include surrounding context.

Set in environment

export GEMINI_API_KEY="your-key-here"

Or in .env file

echo "GEMINI_API_KEY=your-key-here" >> ~/.env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules/auth-methods.md (reported line 71)May include surrounding context.

export GITLAB_TOKEN="..." # GitLab export AWS_ACCESS_KEY_ID="..." # AWS export AWS_SECRET_ACCESS_KEY="..." export GOOGLE_APPLICATION_CREDENTIALS="path/to/credentials.json"

text

## Core Functions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules/interactive-auth.md (reported line 50)May include surrounding context.

export GITLAB_TOKEN="..." # GitLab export AWS_ACCESS_KEY_ID="..." # AWS export AWS_SECRET_ACCESS_KEY="..." export GOOGLE_APPLICATION_CREDENTIALS="path/to/credentials.json"

text

## Core Functions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules/interactive-auth.md (reported line 126)May include surrounding context.

md

then cache, then prompts:

1. Browser OAuth (recommended)
2. Personal Access Token
3. Cancel workflow

### AWS

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes very broad terms such as "security," "tokens," and "oauth," which can cause the skill to activate in contexts far beyond its intended scope. In an agent setting, unintended activation can steer workflows toward this skill's guidance when not explicitly requested, increasing the chance of irrelevant auth handling, command suggestions, or credential-related actions being introduced into unrelated tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example recommends appending an API key to ~/.env in plaintext without warning about filesystem exposure, backups, shell history equivalents, or accidental inclusion in dotfile sync/version control. In an authentication-patterns skill, this is risky because readers may adopt it as endorsed secure practice for credential handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The OAuth example passes a caller-controlled 'service' string directly as the executable in subprocess.run(). Although shell injection is avoided by using an argument list, this still allows execution of any local binary or attacker-chosen program reachable via PATH, which is dangerous in an authentication helper because service names may come from untrusted input.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The token refresh example has the same issue: it invokes a local executable selected by the caller via the 'service' parameter. In practice this can trigger arbitrary program execution under the current user's privileges if an attacker can influence the service name or PATH resolution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown presents subprocess-based command execution as normal verification behavior without clearly warning that adopting the example will run local binaries. In an agent-skill context, omission of that disclosure is dangerous because users or downstream systems may treat documentation examples as safe, passive checks when they actually cause local side effects and broaden execution privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example passes a user-controlled service value directly into subprocess.run, causing the skill to execute whatever local binary matches that name. Even without shell=True, this still grants command-execution capability outside the skill’s stated purpose of authentication verification and can be abused to run unintended programs, especially if service is attacker-influenced or PATH resolution is manipulated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The pre-flight check expands scope from passive verification into local environment inspection and command execution by reading credential-related environment variables and invoking service auth status. In a skill about auth patterns this is contextually plausible, but it still creates a capability to probe local secrets configuration and execute arbitrary provider CLIs based on input, which can leak system state or trigger unintended local actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example inspects SERVICE_API_KEY-style environment variables without explicitly disclosing that it is probing for locally configured credentials. While it does not exfiltrate the values, silent secret-state inspection can still reveal sensitive configuration presence and normalize credential access in documentation without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.