Security audit

coda.io

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it asks users to install an external CLI globally and handle a Coda API token in a way that can leave an extra plaintext credential file behind.

Before installing, review the coda-ai npm package and grant the narrowest Coda token you can. Avoid leaving the token in .env: use owner-only permissions, delete the file after authentication, and rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unaudited Third-Party CLI Installed Globally Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, line 22 **Vulnerability Type**: Supply-chain exposure through an externally distributed npm package **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g coda-ai@0.2.2 ``` The Skill metadata also declares the same external package as a required installation: ```yaml metadata: {"openclaw":{"requires":{"bins":["coda-ai"],"env":["CODA_API_TOKEN"]},"primaryEnv":"CODA_API_TOKEN","install":[{"id":"node","kind":"node","package":"coda-ai","bins":["coda-ai"],"label":"Install coda-ai (npm)"}]}} ``` ### Technical Analysis The setup procedure globally installs and executes the third-party `coda-ai` npm package, but the package implementation and its transitive dependencies are not included in the audited project. Although version `0.2.2` is explicitly selected, no package integrity hash or reviewed lockfile is provided. Installation of an npm package may execute package lifecycle scripts. Subsequent CLI invocation executes code supplied by the package with the privileges of the current user. Because the CLI receives a Coda API token and processes Coda document content, a compromised package, compromised transitive dependency, or maliciously altered registry artifact could access both credentials and document data. The audit found no evidence that `coda-ai@0.2.2` is malicious. The issue is the unverified supply-chain trust boundary created by requiring globally installed code that is absent from the audited artifact. ### Attack Path 1. An attacker compromises the npm package, its publisher account, a transitive dependency, or the package distribution channel. 2. A user follows the Skill instructions and runs `npm install -g coda-ai@0.2.2`. 3. Malicious code executes through an installation lifecycle script or when the CLI is invoked. 4. The package accesses the current user's files and environment, including the supplied Coda API token. 5. The package may t ...[truncated 624 chars]
Remediation: ## Remediation Suggestions - Vendor or otherwise make the CLI implementation available for security review. - Install the dependency locally in an isolated directory rather than globally. - Use a reviewed lockfile with integrity hashes for the package and all transitive dependencies. - Retrieve packages only from an explicitly configured trusted registry. - Disable npm lifecycle scripts during installation where compatible with the package. - Run the CLI in a sandbox with restricted filesystem and network access. - Grant the Coda token only the minimum document and account permissions required. - Establish a dependency-update review process that includes provenance, maintainer, and vulnerability checks.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Coda API Token Written to a Persistent Plaintext Environment File## Vulnerability Details **File Location**: `SKILL.md`, lines 24–25 **Vulnerability Type**: Plaintext credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Auth (Coda API token) echo "CODA_API_TOKEN=YOUR_TOKEN" > .env coda-ai auth --from-file .env ``` ### Technical Analysis The documented authentication procedure writes the Coda API token into a plaintext `.env` file using ordinary shell redirection. The resulting permissions depend on the user's current umask; the command does not explicitly enforce owner-only access. The instructions also do not delete the file after the CLI imports the credential. This creates a second persistent credential copy in addition to the documented `~/.coda-ai/config.json` storage. The `.env` file may be readable by other local users in permissively configured environments, consumed by unrelated development tools, included in backups, or accidentally committed to source control. The documented `0600` permission for the CLI configuration does not protect this separate `.env` file. ### Attack Path 1. A user replaces `YOUR_TOKEN` with a valid Coda API token and runs the documented command. 2. The shell creates `.env` in the current directory with permissions determined by the active umask. 3. The file remains after `coda-ai auth --from-file .env` completes. 4. Another local process or user reads the file, or the file is captured by source control, an archive, a backup, or unrelated tooling. 5. The exposed token is used to authenticate to Coda and access resources authorized for that token. ### Impact Assessment An attacker who obtains the token can impersonate its holder within the authorization scope assigned by Coda. Based on the documented Skill behavior, this may permit enumeration of accessible documents and pages and retrieval of their content. The exact scope is limited by the token owner's Coda permissions and any platform-side restrictions. Exposure may contin ...[truncated 41 chars]
Remediation: ## Remediation Suggestions - Prefer secure interactive credential entry or an ephemeral environment variable that does not create a file. - If file-based import is required, create the file with owner-only permissions before writing the token, for example: ```bash umask 077 printf '%s\n' 'CODA_API_TOKEN=YOUR_TOKEN' > .env coda-ai auth --from-file .env rm -f .env ``` - Add `.env` to applicable version-control ignore rules and prevent secret files from entering build artifacts or backups. - Avoid placing the token directly in shell command history where possible. - Use a narrowly scoped token and revoke or rotate it immediately if exposure is suspected. - Verify that `~/.coda-ai/config.json` is actually created with mode `0600` and that parent-directory permissions prevent unauthorized traversal. - Integrate secret scanning into source-control and CI workflows.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

Category: Privilege Escalation
Content: npm install -g coda-ai@0.2.2 # Auth (Coda API token) echo "CODA_API_TOKEN=YOUR_TOKEN" > .env coda-ai auth --from-file .env coda-ai whoami # verify auth
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: npm install -g coda-ai@0.2.2 # Auth (Coda API token) echo "CODA_API_TOKEN=YOUR_TOKEN" > .env coda-ai auth --from-file .env coda-ai whoami # verify auth
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.