CredAgent

• Outcome: Review
• Latest audit: Oct 13, 2026 · 9:29 AM UTC
• Version: 0.2.0

Overview

The skill is a disclosed credential-protection guide, but it gives an agent broad authority over sensitive credential files and system-level CredAgent setup with some under-scoped examples.

Install only if you intentionally want an agent to help manage local credential files with CredAgent. Approve each credential path and each authorized program separately, avoid whole-home scans and bulk protection, do not authorize broad interpreters like /usr/bin/python3 for cloud credentials, and understand how to release or recover a protected file before letting the agent run protect/remove/update commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (142)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documented flow has the agent operate directly on a highly sensitive credential file and determine an authorized reader program, which can alter access control around the secret. If the agent selects the wrong binary, authorizes an attacker-controlled wrapper, or protects the wrong file, the result could deny legitimate access or unintentionally grant access to secrets.

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

md

You: Please protect ~/.ssh/id_rsa

Agent: I'll protect your SSH private key.
  1. Credential file: ~/.ssh/id_rsa
  2. Authorized program: /usr/bin/ssh (used by git over ssh)
  3. Protecting (SHA256 measured, max 2 opens per PID):
     $ credctl protect --strategy BASIC \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

credctl protect ... ~/.ssh/id_rsa performs a state-changing operation on a private key, including moving it into the enclave and replacing the original path. For an autonomous agent, modifying a secret file is high risk because mistakes can break authentication workflows, cause data loss, or apply incorrect access policies to critical credentials.

Content

Scanner excerpt · README.md (reported line 108)May include surrounding context.

md

3. Protecting (SHA256 measured, max 2 opens per PID):
     $ credctl protect --strategy BASIC \
         --program-permit /usr/bin/ssh --measure true \
         --open-frequency 2 ~/.ssh/id_rsa
     Successfully onboarded ~/.ssh/id_rsa, securely shredded, and
     created symlink to /mnt/credagent/shielded/a23457c0659d.
  4. Verifying:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill advertises scanning the user's home directory for credential files, which expands the agent's reach over multiple sensitive assets and can produce broad unintended access to secrets or metadata. In an agent setting, automated discovery of secrets is especially risky because false positives, over-collection, or later misuse of discovered paths can materially increase exposure.

Content

Scanner excerpt · README.md (reported line 124)May include surrounding context.

md

You: Please protect the credential files in ~

Agent: I scanned ~ and found these credential files:
  - ~/.ssh/id_rsa          → authorize /usr/bin/ssh
  - ~/.aws/credentials     → authorize /usr/bin/aws
  - ~/.aliyun/config.json  → authorize /usr/bin/aliyun (writable, token refresh)
Protect all of them? (y/n)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The example enumerates multiple real-world credential locations and proposes automated authorization decisions for each. That combination of secret discovery plus agent-selected trust assignments increases the chance of misconfiguration or over-broad access to high-value credentials such as cloud keys.

Content

Scanner excerpt · README.md (reported line 125)May include surrounding context.

md

Agent: I scanned ~ and found these credential files:
  - ~/.ssh/id_rsa          → authorize /usr/bin/ssh
  - ~/.aws/credentials     → authorize /usr/bin/aws
  - ~/.aliyun/config.json  → authorize /usr/bin/aliyun (writable, token refresh)
Protect all of them? (y/n)
You: y

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The instruction to 'Allow /usr/bin/python3 to read ~/.aws/credentials' encourages granting a general interpreter access to cloud credentials, which can effectively expose them to any Python code run under that binary. In the context of agent use, this weakens the intended trust boundary and can enable easy secret misuse if the interpreter is later invoked by untrusted code.

Content

Scanner excerpt · README.md (reported line 132)May include surrounding context.

Agent: ✅ Protected 3 files. Each verified; authorized programs can access normally.

text

That's it. To release or modify a protected file later, just ask: "Release the protection on ~/.ssh/id_rsa" or "Allow /usr/bin/python3 to read ~/.aws/credentials".

## How it works

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The instruction to 'Allow /usr/bin/python3 to read ~/.aws/credentials' encourages granting a general interpreter access to cloud credentials, which can effectively expose them to any Python code run under that binary. In the context of agent use, this weakens the intended trust boundary and can enable easy secret misuse if the interpreter is later invoked by untrusted code.

Content

Scanner excerpt · README.md (reported line 132)May include surrounding context.

Agent: ✅ Protected 3 files. Each verified; authorized programs can access normally.

text

That's it. To release or modify a protected file later, just ask: "Release the protection on ~/.ssh/id_rsa" or "Allow /usr/bin/python3 to read ~/.aws/credentials".

## How it works

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 83)May include surrounding context.

md

--auto-init
# 等到日志出现 "CredAgent is ready and serving requests"，再按 Ctrl-C

sudo systemctl start credagent && sudo systemctl enable credagent

# --auto-init 生成的是随机管理密码，使用 release / remove / update /
# attach / detach / refresh 之前必须先改掉

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.zh-CN.md (reported line 83)May include surrounding context.

md

--auto-init
# 等到日志出现 "CredAgent is ready and serving requests"，再按 Ctrl-C

sudo systemctl start credagent && sudo systemctl enable credagent

# --auto-init 生成的是随机管理密码，使用 release / remove / update /
# attach / detach / refresh 之前必须先改掉

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The example directs the agent to scan the entire home directory for credential files. Broad discovery of secrets increases the chance of over-collection, unintended access to unrelated sensitive material, and excessive agent visibility into a user's private files.

Content

Scanner excerpt · README.zh-CN.md (reported line 123)May include surrounding context.

md

You: 请保护 ~ 目录中的凭据文件

Agent: 我扫描了 ~ 目录,发现以下凭据文件:
  - ~/.ssh/id_rsa          → 授权 /usr/bin/ssh
  - ~/.aws/credentials     → 授权 /usr/bin/aws
  - ~/.aliyun/config.json  → 授权 /usr/bin/aliyun(可写,需刷新 token)
是否全部保护?(y/n)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The README’s bulk-scan example enumerates multiple likely secret locations under the user's home directory. Even in a defensive skill, this pattern can normalize broad credential discovery by an agent and increases the blast radius if the agent mishandles results or logs them.

Content

Scanner excerpt · README.zh-CN.md (reported line 124)May include surrounding context.

md

Agent: 我扫描了 ~ 目录,发现以下凭据文件:
  - ~/.ssh/id_rsa          → 授权 /usr/bin/ssh
  - ~/.aws/credentials     → 授权 /usr/bin/aws
  - ~/.aliyun/config.json  → 授权 /usr/bin/aliyun(可写,需刷新 token)
是否全部保护?(y/n)
You: y

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 100)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 109)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 100)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 103)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 108)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 109)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 112)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 113)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 131)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/manual.md (reported line 31)May include surrounding context.

md

---
name: credagent
description: Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it. Applicable when a user asks to lock down or harden credential files (SSH keys such as `~/.ssh/id_rsa`, cloud CLI configs such as `~/.aws/credentials` or `~/.aliyun/config.json`, API tokens, OAuth cookies, `.env` secrets), restrict access so only specific authorized binaries or scripts can read them, audit which programs may read secrets, or undo/release existing protection. Triggers on mentions of credential protection, secret hardening, shielding credential files, zero-trust file access, CredAgent, credctl, or preventing AI agents and tools from exfiltrating keys and tokens.
version: 0.2.0
license: Apache-2.0
---