Devtools Secrets

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:10 PM UTC
• Version: 1.0.0

Overview

This secrets-tooling skill is mostly coherent, but it gives unsafe installer and plaintext-secret handling guidance that users should review before installing.

Install only if you are comfortable with a skill that inspects local secret-tool configuration and gives operational secrets guidance. Avoid copying the curl-to-shell installer examples as written; prefer verified package-manager or pinned release installs. Treat any export to .env, .env.local, or secrets.json as plaintext secret material that must be tightly controlled and kept out of version control.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Unverified Remote mise Installer Piped Directly to a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

markdown

- mise: !`command -v mise >/dev/null 2>&1 && echo "INSTALLED ($(mise --version 2>/dev/null | head -1))" || echo "MISSING — install with: curl https://mise.run | sh"`

Technical Analysis

The tool-availability check does not itself execute the installer, but it presents curl https://mise.run | sh as the prescribed installation command when mise is missing. If followed, this command downloads the current response from an external URL and passes it directly to a shell.

The downloaded payload is mutable and is not pinned to a specific release, saved for inspection, or validated using a cryptographic checksum or signature. HTTPS protects the connection in transit but does not establish artifact immutability or protect users if the origin, CDN, DNS path, or publishing infrastructure is compromised.

This behavior is not necessary for the Skill's secrets-toolchain guidance. Installation can be performed through a trusted package manager or a separately downloaded, pinned, and verified release artifact.

Attack Path

1. The Skill checks whether mise is installed.
2. When the tool is absent, it displays curl https://mise.run | sh as the installation method.
3. The user or agent follows that instruction.
4. The shell executes whatever content the external endpoint returns at that time.
5. If the upstream delivery path has been compromised, attacker-controlled commands execute with the invoking user's privileges.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the installer. An attacker could read or modify files available to that account, access environment variables and developer credentials, alter shell or tool configuration, install additional software, or tamper with source repositories ...[truncated 164 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | sh recommendation.
• Prefer a trusted operating-system package manager or another installation channel that verifies signed packages.
• If direct artifact installation is necessary, pin a specific mise version and immutable release URL.
• Download the artifact to disk rather than streaming it into a shell.
• Verify a vendor-published cryptographic checksum or signature before execution.
• Present the exact artifact, expected digest, verification command, and installation command as separate steps.
• Require explicit user approval before installing software; the availability check should remain read-only.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/infisical-patterns.md:5

Finding

Infisical Installer Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: references/infisical-patterns.md, lines 5–7
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

# Install (if not via mise)
curl -1sLf 'https://dl.infisical.com/get-cli.sh' | bash

Technical Analysis

The installation guidance streams a script from an external endpoint directly into Bash. The effective executable payload can change after the Skill has been reviewed. No version pin, checksum, digital signature, or manual inspection boundary is provided.

The flags passed to curl do not mitigate this supply-chain risk: they affect protocol behavior and output but do not verify the identity or integrity of the downloaded script beyond ordinary TLS transport validation. A compromised vendor account, web origin, CDN, DNS path, or release pipeline could therefore turn the documented installation step into arbitrary code execution.

Direct shell execution of a mutable network response exceeds the minimum privileges and behavior necessary to document or install the Infisical CLI. A pinned, independently verified package or release artifact would satisfy the declared functionality with lower risk.

Attack Path

1. A user follows the documented Infisical setup procedure.
2. curl requests the current get-cli.sh response from the external host.
3. The response is immediately passed to Bash without being stored or verified.
4. A compromised upstream delivery path supplies malicious shell commands.
5. Bash executes those commands with the invoking user's permissions before the user can inspect the payload.

Impact Assessment

Exploitation can result in arbitrary code execution as the invoking user. Because this Skill concerns secret-management tooling, the affected environment may contain sensitive credentials, keyring access, CI tokens, age or SSH key paths, and source-code repositories. Malicious installer code could read accessi ...[truncated 293 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the piped installer with installation through a trusted package manager or Infisical's signed release distribution.
• Pin an explicit CLI version rather than retrieving a mutable installer.
• Download the package or script as a separate operation.
• Verify its published SHA-256 digest or digital signature before installation.
• Fail closed if integrity verification does not succeed.
• Allow users to inspect the downloaded content before executing it.
• Document the expected source, version, digest, and verification procedure.
• Avoid running installation steps with elevated privileges unless a specific operation demonstrably requires them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends installing mise via a 'curl https://mise.run | sh' pattern, which executes a remote script directly from the network without prior verification. If the remote endpoint, transport, or distribution channel is compromised, users could execute arbitrary code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

**IMPORTANT: Check tool availability before proceeding with any guidance.**

- mise: !`command -v mise >/dev/null 2>&1 && echo "INSTALLED ($(mise --version 2>/dev/null | head -1))" || echo "MISSING — install with: curl https://mise.run | sh"`
- fnox: !`command -v fnox >/dev/null 2>&1 && echo "INSTALLED ($(fnox --version 2>/dev/null | head -1))" || echo "MISSING — install with: mise use -g fnox"`
- infisical: !`command -v infisical >/dev/null 2>&1 && echo "INSTALLED ($(infisical --version 2>/dev/null | head -1))" || echo "MISSING — install with: mise use -g infisical"`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

- **infisical auth expires** — `infisical login` tokens have a TTL. CI/CD
  should use `INFISICAL_TOKEN` (service token) instead.
- **Token path scope is explicit** — a service token scoped to `/` cannot
  access secrets in child paths like `/git_actions`. Each path requires its
  own token or use `--recursive` with the CLI directly.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The guidance encourages using an existing SSH private key (~/.ssh/id_ed25519) as a decryption key source for secrets, coupling general-purpose authentication credentials with secrets decryption. Reusing a primary SSH identity broadens blast radius: compromise or misuse of that key can now unlock application secrets in addition to infrastructure access.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 108)May include surrounding context.

text

```bash
# Decrypt using SSH key (age auto-detects ~/.ssh/id_ed25519)
export FNOX_AGE_KEY_FILE=~/.ssh/id_ed25519

# Multiple recipients = any matching key can decrypt

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Setting FNOX_AGE_KEY_FILE=~/.ssh/id_ed25519 normalizes use of a default SSH private key for secret decryption, increasing the value and exposure of that single credential. In the context of a secrets toolchain, this is risky because it encourages key reuse across trust domains and may cause sensitive secrets to become accessible wherever that SSH key is present.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 109)May include surrounding context.

bash

# Decrypt using SSH key (age auto-detects ~/.ssh/id_ed25519)
export FNOX_AGE_KEY_FILE=~/.ssh/id_ed25519

# Multiple recipients = any matching key can decrypt
fnox set SECRET "value" --provider age

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 118)May include surrounding context.

OS Keychain

toml

[providers.keychain]
type = "keychain"
service = "fnox"  # namespace to isolate fnox secrets

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 119)May include surrounding context.

OS Keychain

toml

[providers.keychain]
type = "keychain"
service = "fnox"  # namespace to isolate fnox secrets

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 124)May include surrounding context.

OS Keychain

toml

[providers.keychain]
type = "keychain"
service = "fnox"  # namespace to isolate fnox secrets

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 125)May include surrounding context.

OS Keychain

toml

[providers.keychain]
type = "keychain"
service = "fnox"  # namespace to isolate fnox secrets

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 222)May include surrounding context.

md

| `fnox set SECRET_NAME value` | Store a secret (encrypts or stores remotely) |
| `fnox set SECRET_NAME --provider age` | Store with a specific provider |
| `fnox list` | List all configured secret names |
| `fnox import -i .env` | Import secrets from .env file |
| `fnox import -i f.json json` | Import from JSON/YAML/TOML |
| `fnox export` | Export secrets as .env format |
| `fnox export --format json` | Export as JSON |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 289)May include surrounding context.

md

| `fnox set SECRET_NAME value` | Store a secret (encrypts or stores remotely) |
| `fnox set SECRET_NAME --provider age` | Store with a specific provider |
| `fnox list` | List all configured secret names |
| `fnox import -i .env` | Import secrets from .env file |
| `fnox import -i f.json json` | Import from JSON/YAML/TOML |
| `fnox export` | Export secrets as .env format |
| `fnox export --format json` | Export as JSON |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 290)May include surrounding context.

md

| `fnox set SECRET_NAME value` | Store a secret (encrypts or stores remotely) |
| `fnox set SECRET_NAME --provider age` | Store with a specific provider |
| `fnox list` | List all configured secret names |
| `fnox import -i .env` | Import secrets from .env file |
| `fnox import -i f.json json` | Import from JSON/YAML/TOML |
| `fnox export` | Export secrets as .env format |
| `fnox export --format json` | Export as JSON |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

fnox export as .env format implies emitting plaintext secrets, but the command table does not warn about disclosure via terminal output, files, CI logs, or shell capture. Because this skill is specifically about secret injection and env var hygiene, failing to caveat plaintext export is more dangerous than in generic CLI docs.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 224)May include surrounding context.

md

| `fnox list` | List all configured secret names |
| `fnox import -i .env` | Import secrets from .env file |
| `fnox import -i f.json json` | Import from JSON/YAML/TOML |
| `fnox export` | Export secrets as .env format |
| `fnox export --format json` | Export as JSON |

`fnox set` behavior depends on provider capability:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This example is part of a workflow that culminates in exporting secrets for downstream use, but lacks warnings about plaintext handling and artifact persistence. In a secrets-focused skill, examples that normalize exporting decrypted values without safeguards materially elevate accidental leakage risk.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 293)May include surrounding context.

md

fnox import -i .env --provider age

# Import only matching secrets with a prefix
fnox import -i .env --filter "^DATABASE_" --prefix "PROD_"

# Export for Docker Compose / K8s
fnox export --format json --profile production > secrets.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The example writes exported secrets to secrets.json without warning that the file contains plaintext credentials and may be committed, indexed, backed up, or read by other local processes. In a documentation file for secrets management, that omission creates a realistic accidental exfiltration path.

Content

Scanner excerpt · references/fnox-configuration.md (reported line 296)May include surrounding context.

fnox import -i .env --filter "^DATABASE_" --prefix "PROD_"

Export for Docker Compose / K8s

fnox export --format json --profile production > secrets.json

text

Supported formats: `.env`, JSON, YAML, TOML. Pipe from stdin supported.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The installation command pipes a remotely fetched script directly into bash, creating a supply-chain and integrity risk: if the remote host, TLS trust chain, CDN, or script distribution is compromised, arbitrary code executes immediately on the user's machine. In a developer tooling skill, users are especially likely to copy and run this exact command, making the risk more operationally significant.

Content

Scanner excerpt · references/infisical-patterns.md (reported line 7)May include surrounding context.

bash

# Install (if not via mise)
curl -1sLf 'https://dl.infisical.com/get-cli.sh' | bash

# Initialize project (creates .infisical.json)
infisical init

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The | bash construct turns downloaded content into immediate shell execution, enabling command chaining abuse and eliminating an opportunity for inspection or verification. In this secrets-focused skill, compromise of the install path could expose developer environments and downstream credentials, increasing the blast radius.

Content

Scanner excerpt · references/infisical-patterns.md (reported line 7)May include surrounding context.

bash

# Install (if not via mise)
curl -1sLf 'https://dl.infisical.com/get-cli.sh' | bash

# Initialize project (creates .infisical.json)
infisical init

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/infisical-patterns.md (reported line 41)May include surrounding context.

md

| Command | Purpose |
|---------|---------|
| `infisical init` | Create .infisical.json for current project |
| `infisical login` | Authenticate (token stored in system keyring) |
| `infisical run -- cmd` | Run command with secrets as env vars |
| `infisical run --env=prod -- cmd` | Run with specific environment |
| `infisical run --path=/apps/api -- cmd` | Run with specific secret path |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/infisical-patterns.md (reported line 90)May include surrounding context.

md

| Command | Purpose |
|---------|---------|
| `infisical init` | Create .infisical.json for current project |
| `infisical login` | Authenticate (token stored in system keyring) |
| `infisical run -- cmd` | Run command with secrets as env vars |
| `infisical run --env=prod -- cmd` | Run with specific environment |
| `infisical run --path=/apps/api -- cmd` | Run with specific secret path |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/infisical-patterns.md (reported line 107)May include surrounding context.

Universal Auth (most common for CI)

bash

# Get access token
infisical login --method=universal-auth \
  --client-id=<client-id> \
  --client-secret=<client-secret> \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mise-integration.md (reported line 26)May include surrounding context.

toml

[env]
# Single dotenv file
_.file = ".env"

# Multiple files with mixed formats
_.file = [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mise-integration.md (reported line 31)May include surrounding context.

toml

[env]
# Single dotenv file
_.file = ".env"

# Multiple files with mixed formats
_.file = [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mise-integration.md (reported line 36)May include surrounding context.

toml

[env]
# Single dotenv file
_.file = ".env"

# Multiple files with mixed formats
_.file = [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mise-integration.md (reported line 32)May include surrounding context.

md

_.file = [
    ".env.json",
    "/User/bob/.env",
    { path = ".secrets.yaml", redact = true }
]

# Load after tool env vars are set

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The example redirects env output from a fnox exec session into .env.local, which captures all injected secrets into a plaintext file. That materially increases exposure risk because secrets move from ephemeral process environment into a persistent repo-adjacent artifact that may be read, copied, or committed accidentally.

Content

Scanner excerpt · references/mise-integration.md (reported line 184)May include surrounding context.

toml

[hooks.enter]
run = "fnox exec -- env > .env.local"

Existing mise Tasks in This Repo

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger description is broad enough to activate on generic secrets-management or environment-variable discussions, not just the intended mise/fnox/infisical toolchain. That can route unrelated secret-handling requests into a skill that contains shell-checks and tool-specific guidance, increasing the chance of unsafe or irrelevant operational advice in sensitive contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.