Snipeit Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 PM UTC
• Version: 1.0.0

Overview

This Snipe-IT helper is not deceptive, but it gives an agent broad ability to change or delete inventory and user records with an API token and does not define clear safeguards.

Review this skill before installing. Use it only with a trusted HTTPS Snipe-IT URL, a least-privileged API token, and agent instructions that require explicit approval before POST, PATCH, PUT, DELETE, checkout, checkin, restore, backup download, or user deactivation actions. Consider narrowing the trigger language to explicit Snipe-IT requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13

Finding

Bearer Token Forwarded to an Unvalidated Configurable Host

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-14, 41-48, 696-697
Vulnerability Type: Bearer-token disclosure through an unvalidated API origin
Risk Level: Medium

Vulnerable Code

yaml

env:
  - SNIPEIT_URL        # e.g. https://assets.w-w.top
  - SNIPEIT_API_TOKEN  # Bearer token from your profile → API keys

bash

local args=(
  -s -X "$method"
  -H "Authorization: Bearer $SNIPEIT_API_TOKEN"
  -H "Accept: application/json"
  -H "Content-Type: application/json"
)

[ -n "$data" ] && args+=(-d "$data")

curl "${args[@]}" "${SNIPEIT_URL}/api/v1${endpoint}" | jq .

bash

export SNIPEIT_URL="https://assets.w-w.top"
export SNIPEIT_API_TOKEN="your_token_here"

Technical Analysis

The helper constructs the request destination directly from the configurable SNIPEIT_URL and unconditionally attaches SNIPEIT_API_TOKEN as a bearer credential. It does not validate that the URL uses HTTPS, belongs to an approved Snipe-IT deployment, contains no user-information component, or matches the origin for which the token was issued.

Consequently, a configuration mistake or attacker-controlled environment value can cause every API helper to disclose the bearer token to an unintended server. Shell quoting prevents ordinary argument-splitting injection through this variable, but it does not prevent credential exfiltration because curl still intentionally sends the authorization header to the selected origin.

Attack Path

1. An attacker influences SNIPEIT_URL, such as through a modified environment configuration, copied setup command, deployment secret, or wrapper script.
2. The value is set to an HTTPS endpoint controlled by the attacker.
3. The user invokes any helper such as snipe_get, snipe_post, or snipe_delete.
4. The helper builds an Authorization: Bearer $SNIPEIT_API_TOKEN header without validating the destination.
5. curl transmits the bearer token to the attacker-controlled endpoint.
6. The attacker captures ...[truncated 683 chars]

Remediation

View remediation

Remediation Suggestions

1. Require SNIPEIT_URL to use HTTPS and reject all other schemes.
2. Parse and validate the URL before constructing authenticated requests.
3. Reject URLs containing user information, fragments, unexpected paths, or malformed hostnames.
4. Require the hostname to match an explicit administrator-managed allowlist or a pinned deployment origin.
5. Replace the concrete example domain with an unmistakable placeholder such as https://snipeit.example.com.
6. Display the resolved destination and require confirmation during initial configuration before sending credentials.
7. Use a narrowly scoped API token with only the permissions required for the intended workflow.
8. Store the token in a protected secret manager rather than reusable shell configuration files.
9. Rotate the token immediately if it may have been sent to an unintended host.
10. Consider certificate or public-key pinning in controlled deployments where the Snipe-IT endpoint is stable.

A hardened helper should fail closed before adding the authorization header:

bash

validate_snipeit_url() {
  case "$SNIPEIT_URL" in
    "https://snipeit.example.com") ;;
    *)
      echo "Refusing unapproved Snipe-IT URL" >&2
      return 1
      ;;
  esac
}

snipe() {
  validate_snipeit_url || return 1

  local method="${1:-GET}"
  local endpoint="$2"
  local data="${3:-}"
  local args=(
    --silent
    --show-error
    --fail-with-body
    --request "$method"
    --header "Authorization: Bearer $SNIPEIT_API_TOKEN"
    --header "Accept: application/json"
    --header "Content-Type: application/json"
  )

  [ -n "$data" ] && args+=(--data "$data")
  curl "${args[@]}" "${SNIPEIT_URL}/api/v1${endpoint}" | jq .
}

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes very generic terms such as "asset," "hardware," "license," and "equipment," which can cause the skill to activate in routine conversations unrelated to Snipe-IT. Because this skill supports write and delete operations, accidental invocation can lead to unintended inventory changes or disclosure of asset/user data to the external Snipe-IT service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- SNIPEIT_URL        # e.g. https://assets.w-w.top
      - SNIPEIT_API_TOKEN  # Bearer token from your profile → API keys
    requires:
      - curl
      - jq
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill prominently documents destructive and state-changing operations like delete, create, checkout, checkin, restore, and user deactivation without requiring confirmation, dry-run behavior, or warning language. In an agent setting, this increases the chance of irreversible or high-impact actions being taken from ambiguous prompts or mistaken IDs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.