Codehooks Backend

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:04 PM UTC
• Version: 1.0.0

Overview

This looks like a legitimate Codehooks backend skill, but it gives an agent broad admin deployment and data powers with too few guardrails.

Install only if you are comfortable giving the agent real authority over a Codehooks backend. Use a dedicated project and the least-privileged or shortest-lived token available, keep the token out of prompts/logs/source control, rotate it after use, review deployments before they go live, and validate any callback URL patterns before using the workflow example in production.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/workflow-automation.js:102

Finding

Unvalidated Workflow Callback URL Enables Blind Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: examples/workflow-automation.js, lines 102–112 and 127–140
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: Medium

Complete vulnerable code snippet:

javascript

// Optionally notify the agent via webhook callback
if (data.state?.callbackUrl) {
  try {
    await fetch(data.state.callbackUrl, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        workflowId: data.workflowId,
        status: data.state.finalStatus,
        result: data.state.result
      })
    });
  } catch (err) {
    console.error('Callback failed:', err.message);
  }
}

The callback URL originates directly from the request:

javascript

app.post('/workflow/start', async (req, res) => {
  const conn = await Datastore.open();

  // Create the task
  const task = await conn.insertOne('tasks', {
    ...req.body,
    status: 'pending',
    createdAt: new Date()
  });

  // Start the workflow
  const workflow = await taskWorkflow.start({
    taskId: task._id,
    callbackUrl: req.body.callbackUrl // Optional: agent's webhook URL
  });

Technical Analysis

The /workflow/start route accepts req.body.callbackUrl and stores it in workflow state without validating its scheme, hostname, port, resolved IP address, or redirect behavior. When the workflow completes, the serverless runtime passes this value directly to fetch().

An attacker who can call the workflow-start endpoint can consequently cause the backend to issue a server-side HTTP POST to an attacker-selected destination. Because the request originates from the Codehooks execution environment rather than the attacker's device, it may reach destinations unavailable to the attacker directly, including internal services, loopback interfaces, link-local endpoints, or cloud metadata services where platform networki ...[truncated 1739 chars]

Remediation

View remediation

Remediation Suggestions

• Permit only https: callback URLs.
• Use an explicit allowlist of trusted callback domains rather than accepting arbitrary hosts.
• Resolve the destination before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
• Protect against DNS rebinding by connecting only to the validated resolved address and repeating validation when DNS is resolved again.
• Disable redirects where possible. If redirects are required, validate every redirect destination using the same controls.
• Reject URLs containing unexpected credentials, ports, encoded addresses, or ambiguous hostname representations.
• Apply strict connection and response timeouts, response-size limits, and outbound network egress controls.
• Avoid including sensitive workflow results in callbacks unless the destination is trusted and the payload is authenticated and encrypted.
• Authenticate callbacks using a keyed signature and a timestamp to prevent tampering and replay.
• Validate the request body against a strict schema before storing it in the workflow state.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:51

Finding

Mutable CLI-Generated Prompt Is Imported Directly into Agent Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–61 and 192–197
Vulnerability Type: Untrusted external instructions imported into agent context
Risk Level: Medium

Complete vulnerable instruction snippets:

markdown

## Essential: Load the development context

Before building anything, run:

```bash
coho prompt

This outputs the complete Codehooks development prompt — routing, database, queues, jobs, workflows, and the full codehooks-js API. Copy it into your context to build any backend feature correctly.

text

The prescribed workflow repeats the requirement:

```markdown
## Development workflow: Let your agent build new endpoints

1. Agent runs `coho prompt` and loads the development context
2. For existing projects, agent runs `coho doctor` and `coho describe` to understand what's deployed
3. Agent writes code using codehooks-js patterns
4. Agent runs `coho deploy` (5 seconds to live)
5. Agent verifies with `coho log -f` or tests endpoints with `coho info --examples`
6. Agent iterates — the fast deploy loop enables rapid development

Technical Analysis

The Skill requires the agent to execute coho prompt and copy its output into the active context. That output is neither contained in nor integrity-bound to the audited Skill package, so its contents can change after this repository has been reviewed.

No safeguards instruct the agent to treat the output solely as untrusted API reference material. There is also no version pin, content hash, signature verification, approved snapshot, or rule requiring rejection of instructions unrelated to Codehooks API documentation. Consequently, compromise or malicious modification of the CLI package or its upstream prompt source could introduce instructions that influence the agent's goals, tool calls, handling of secrets, or deployment actions.

This finding concerns instruction integrity rather than demonstrated malicious behavio ...[truncated 1473 chars]

Remediation

View remediation

Remediation Suggestions

• Vendor a reviewed, versioned copy of the development reference in the Skill package.
• Pin the Codehooks CLI to a specific reviewed version and verify package integrity or provenance before installation.
• If dynamic retrieval is unavoidable, verify the prompt using a trusted signature or pinned cryptographic hash.
• Explicitly instruct the agent that command output is untrusted reference data, not authoritative instructions.
• Delimit imported documentation and prohibit it from changing system instructions, safety constraints, task scope, credential policy, or tool permissions.
• Reject generated content that requests secrets, unrelated system access, destructive operations, persistence, or policy overrides.
• Require human approval before deployments, destructive database actions, permission changes, or use of administrative credentials.
• Use a least-privilege token restricted to the specific project and operations required for the task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs a human to generate an admin token, give it to an agent, export it into an environment variable, and use it for unattended deployment, but it does not warn that this token is highly privileged or provide guidance for secure storage, rotation, and least-privilege handling. In an agent-oriented context, this is especially risky because prompts, logs, shell history, copied context, or downstream tools may expose the token, enabling full backend deployment or administrative abuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill enables sensitive capabilities including environment-secret use and live network deployment, but it declares no explicit tool scope or permission boundaries. In an agent setting, this increases the risk that the agent can access broader tools than intended and autonomously deploy or interact with external services without least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly tells the human to give an admin token to the agent, which grants powerful control over deployment, data access, and backend management. Although the file contains a general warning about deploying code, it does not provide concrete credential-handling guidance such as least privilege, storage restrictions, rotation, redaction, or avoiding prompt/context exposure, making credential leakage or misuse significantly more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow completion handler performs a server-side POST to data.state.callbackUrl, which is populated from req.body.callbackUrl without validation or allowlisting. This creates an SSRF-style primitive and can also exfiltrate workflow result data to arbitrary attacker-controlled endpoints, especially dangerous in backend/serverless environments that may have network access to internal services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code inserts user-supplied task data into a datastore and later updates task status, but there is no confirmation prompt, user-facing notice, or explanatory comment/docstring describing these persistent writes. For a code-file warning review, the file shows storage-modifying behavior without any visible disclosure beyond implementation comments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.