Security audit

env-secure-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a secret manager, but its implementation can expose the secrets and encryption key it claims to protect.

Review before installing. This skill handles highly sensitive values, but it can print its encryption key, import the whole process environment if invoked with a broad prefix, and return stored secrets to any caller that sets the documented flags. Use only in a tightly controlled environment after fixing key handling, environment import scoping, and real authorization for secret retrieval.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: index.ts:67
Finding: AES Master Key Disclosed Through Application Logs
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: index.ts:162
Finding: Caller-Controlled Flags Permit Unauthenticated Plaintext Secret Disclosure
Content: View full analysis
= {}; for (const [key, item] of Object.entries(envStore)) { if (item.isSecret && !showSecrets) { result[key] = "***REDACTED***"; } else if (item.encrypted && item.iv && showSecrets) { result[key] = await decrypt(item.value, item.iv); } else { result[key] = item.value; } } return { success: true, env: result, count: Object.keys(envStore).length }; } ``` ### Technical Analysis The implementation does not authenticate callers or evaluate a trusted authorization policy. Instead, it accepts `allowSecret` and `showSecrets` from the same untrusted request that asks to retrieve the data. A Boolean value supplied by a caller cannot establish authorization. Any caller capable of invoking the skill can set either flag to `true`. The `list` operation is especially dangerous because it supports bulk decrypti ...[truncated 1501 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: index.ts:224
Finding: Arbitrary Prefix Allows Harvesting of the Entire Process Environment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: When no key is provided, the skill generates an encryption key, writes it into the process environment, and logs the key value to the console. This exposes the master key to logs, terminals, subprocesses, and other components that can read environment variables, undermining all encryption performed by the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code emits the generated encryption key directly in console warnings without any safe handling or interface disclosure. Console output is frequently captured in logs or agent transcripts, so this can permanently leak the key and allow retrospective decryption of all stored secrets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill description, parameters, and examples are presented only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The visible instructional content of the skill is written entirely in Chinese, including headings, parameter explanations, and examples. For a general-purpose skill, this imposes a specific language/locale on users without any opt-in or documented region-specific justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill claims permission control and leak prevention, but there is no real access-control boundary: any caller can request secret exposure by passing allowSecret=true or showSecrets=true. In a multi-tool or agent setting, such misleading claims are dangerous because operators may trust the skill to protect secrets when it does not.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill markets itself as secure secret management, but both get with allowSecret=true and list with showSecrets=true return decrypted plaintext secrets to any caller who sets those flags. There is no actual authorization or policy enforcement, so secrecy depends entirely on caller honesty, which defeats the claimed protection model and can directly leak credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: loadFromEnv bulk-reads all environment variables matching a prefix and imports them into the skill's store, potentially sweeping in sensitive system secrets without strong user awareness or consent boundaries. In agent environments, bulk environment access increases blast radius because a single call can ingest many secrets for later exposure through other weak interfaces.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest describes environment variable and secret management, but set, get, list, and delete operate on envStore, an internal object, not the process environment. Aside from reading and writing the encryption key env var and importing existing env vars, the code does not actually manage environment variables in the runtime environment as the description implies.
Content: No source excerpt is available for this finding.