coda.io

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:01 PM UTC
• Version: 0.2.3

Overview

The skill does what it says, but it asks users to install an external CLI globally and handle a Coda API token in a way that can leave an extra plaintext credential file behind.

Before installing, review the coda-ai npm package and grant the narrowest Coda token you can. Avoid leaving the token in .env: use owner-only permissions, delete the file after authentication, and rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unaudited Third-Party CLI Installed Globally Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Supply-chain exposure through an externally distributed npm package
Risk Level: Medium

Vulnerable Code

bash

npm install -g coda-ai@0.2.2

The Skill metadata also declares the same external package as a required installation:

yaml

metadata: {"openclaw":{"requires":{"bins":["coda-ai"],"env":["CODA_API_TOKEN"]},"primaryEnv":"CODA_API_TOKEN","install":[{"id":"node","kind":"node","package":"coda-ai","bins":["coda-ai"],"label":"Install coda-ai (npm)"}]}}

Technical Analysis

The setup procedure globally installs and executes the third-party coda-ai npm package, but the package implementation and its transitive dependencies are not included in the audited project. Although version 0.2.2 is explicitly selected, no package integrity hash or reviewed lockfile is provided.

Installation of an npm package may execute package lifecycle scripts. Subsequent CLI invocation executes code supplied by the package with the privileges of the current user. Because the CLI receives a Coda API token and processes Coda document content, a compromised package, compromised transitive dependency, or maliciously altered registry artifact could access both credentials and document data.

The audit found no evidence that coda-ai@0.2.2 is malicious. The issue is the unverified supply-chain trust boundary created by requiring globally installed code that is absent from the audited artifact.

Attack Path

1. An attacker compromises the npm package, its publisher account, a transitive dependency, or the package distribution channel.
2. A user follows the Skill instructions and runs npm install -g coda-ai@0.2.2.
3. Malicious code executes through an installation lifecycle script or when the CLI is invoked.
4. The package accesses the current user's files and environment, including the supplied Coda API token.
5. The package may t ...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

• Vendor or otherwise make the CLI implementation available for security review.
• Install the dependency locally in an isolated directory rather than globally.
• Use a reviewed lockfile with integrity hashes for the package and all transitive dependencies.
• Retrieve packages only from an explicitly configured trusted registry.
• Disable npm lifecycle scripts during installation where compatible with the package.
• Run the CLI in a sandbox with restricted filesystem and network access.
• Grant the Coda token only the minimum document and account permissions required.
• Establish a dependency-update review process that includes provenance, maintainer, and vulnerability checks.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Coda API Token Written to a Persistent Plaintext Environment File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–25
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Code

bash

# Auth (Coda API token)
echo "CODA_API_TOKEN=YOUR_TOKEN" > .env
coda-ai auth --from-file .env

Technical Analysis

The documented authentication procedure writes the Coda API token into a plaintext .env file using ordinary shell redirection. The resulting permissions depend on the user's current umask; the command does not explicitly enforce owner-only access. The instructions also do not delete the file after the CLI imports the credential.

This creates a second persistent credential copy in addition to the documented ~/.coda-ai/config.json storage. The .env file may be readable by other local users in permissively configured environments, consumed by unrelated development tools, included in backups, or accidentally committed to source control. The documented 0600 permission for the CLI configuration does not protect this separate .env file.

Attack Path

1. A user replaces YOUR_TOKEN with a valid Coda API token and runs the documented command.
2. The shell creates .env in the current directory with permissions determined by the active umask.
3. The file remains after coda-ai auth --from-file .env completes.
4. Another local process or user reads the file, or the file is captured by source control, an archive, a backup, or unrelated tooling.
5. The exposed token is used to authenticate to Coda and access resources authorized for that token.

Impact Assessment

An attacker who obtains the token can impersonate its holder within the authorization scope assigned by Coda. Based on the documented Skill behavior, this may permit enumeration of accessible documents and pages and retrieval of their content. The exact scope is limited by the token owner's Coda permissions and any platform-side restrictions. Exposure may contin ...[truncated 41 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer secure interactive credential entry or an ephemeral environment variable that does not create a file.

• If file-based import is required, create the file with owner-only permissions before writing the token, for example:

  bash

  umask 077
  printf '%s\n' 'CODA_API_TOKEN=YOUR_TOKEN' > .env
  coda-ai auth --from-file .env
  rm -f .env
  

• Add .env to applicable version-control ignore rules and prevent secret files from entering build artifacts or backups.

• Avoid placing the token directly in shell command history where possible.

• Use a narrowly scoped token and revoke or rotate it immediately if exposure is suspected.

• Verify that ~/.coda-ai/config.json is actually created with mode 0600 and that parent-directory permissions prevent unauthorized traversal.

• Integrate secret scanning into source-control and CI workflows.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

npm install -g coda-ai@0.2.2

# Auth (Coda API token)
echo "CODA_API_TOKEN=YOUR_TOKEN" > .env
coda-ai auth --from-file .env

coda-ai whoami # verify auth

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

npm install -g coda-ai@0.2.2

# Auth (Coda API token)
echo "CODA_API_TOKEN=YOUR_TOKEN" > .env
coda-ai auth --from-file .env

coda-ai whoami # verify auth

Static analysis

No suspicious patterns detected.