Config Drift Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:25 AM UTC
• Version: 1.0.1

Overview

The skill has a legitimate config-drift purpose, but its examples can expose environment and infrastructure secrets in logs and temporary files.

Review carefully before installing. Use this only in controlled environments, avoid running the raw examples against production secrets, and replace them with redacted or key-only comparisons before using CI or sharing agent output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

Unredacted Disclosure of Environment and Terraform Configuration Values

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–56 and 64–66
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

bash

# Compare .env files across environments
for f in .env.development .env.staging .env.production; do
  if [[ -f "$f" ]]; then
    echo "=== $f ==="
    grep -v '^#' "$f" | grep -v '^$' | sort
  fi
done

bash

# Compare tfvars across environments
for f in terraform/environments/*/terraform.tfvars; do
  echo "=== $f ==="
  cat "$f"
done

Technical Analysis

The documented commands print complete values from environment files and Terraform variable files without identifying or redacting sensitive keys. Such files commonly contain database connection strings, passwords, API keys, access tokens, private endpoints, and other deployment credentials.

The output can be copied into an AI agent's context, terminal output, CI logs, audit artifacts, or generated reports. Reading complete values is unnecessary when the objective is configuration-parity analysis: key names, presence, metadata, or non-reversible fingerprints are generally sufficient.

Although the Skill does not transmit this information to an external service itself, its instructions create a direct plaintext disclosure channel. The exposure is limited to configuration files readable by the account executing the commands.

Attack Path

1. A configuration file such as .env.production or terraform.tfvars contains a secret value.
2. A user or agent follows the Skill's configuration extraction instructions.
3. grep or cat prints the complete secret to standard output.
4. The output is retained in an agent transcript, terminal capture, CI log, report, or other operational record.
5. A user with access to that record obtains and potentially reuses the exposed credential against its associated service.

Impact Assessment

An attacker does not receive new operating-system privileges directly from these ...[truncated 470 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not print complete configuration values by default.
2. Extract and compare key names separately from values.
3. Redact keys matching sensitive patterns such as PASSWORD, SECRET, TOKEN, API_KEY, PRIVATE_KEY, CREDENTIAL, and DATABASE_URL.
4. When value comparison is required, compare keyed cryptographic hashes instead of plaintext values.
5. Avoid including raw secrets in generated reports, AI prompts, CI logs, or build artifacts.
6. Require explicit user confirmation before displaying any sensitive value.
7. Configure CI systems to mask known secrets and restrict access to drift-analysis output.
8. Replace the examples with a redaction-aware parser that preserves syntax and reports only whether values match.

Example safe output should resemble:

text

DATABASE_PASSWORD=[REDACTED; values differ]
LOG_LEVEL=info
API_TOKEN=[REDACTED; values match]

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Predictable Temporary Files Store Raw Kubernetes Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–47
Vulnerability Type: Unsafe temporary-file handling and plaintext configuration storage
Risk Level: Medium

Vulnerable Code

bash

# ConfigMaps
for env in dev staging prod; do
  kubectl get configmaps -n "$env" -o json | python3 -c "
import json, sys
cms = json.load(sys.stdin)['items']
for cm in cms:
    name = cm['metadata']['name']
    for k, v in cm.get('data', {}).items():
        print(f'{name}.{k}={v}')
" > "/tmp/config-$env.txt"
done

Technical Analysis

The command writes complete Kubernetes ConfigMap values to predictable paths:

text

/tmp/config-dev.txt
/tmp/config-staging.txt
/tmp/config-prod.txt

The instructions do not create a private temporary directory, set a restrictive umask, verify that the destination is not a symbolic link, or remove the files after use. Consequently, configuration data can remain on disk after the scan and may be readable by unintended local users depending on the process umask and host configuration.

Predictable filenames also introduce a symlink and file-clobber risk. A local attacker who can create entries in /tmp may prepare one of these paths as a symbolic link. When a more privileged user executes the command, shell redirection follows the link and truncates or overwrites the linked target if the executing account has permission.

Kubernetes ConfigMaps are not intended for secrets, but they frequently contain operationally sensitive data such as internal endpoints, feature configuration, tenant identifiers, or accidentally misplaced credentials. This finding does not assert that Kubernetes Secrets are read; the shown command only retrieves ConfigMaps.

Attack Path

Information-disclosure path:

1. The executing account has permission to read ConfigMaps in the dev, staging, or prod namespace.
2. The Skill writes all retrieved values to predictable files under /tmp.
3. The files receive permissions deriv ...[truncated 1511 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer in-memory processing so Kubernetes configuration is not persisted to disk.
2. If temporary files are necessary, create a private directory with mktemp -d.
3. Set umask 077 before creating files so only the executing user can access them.
4. Register cleanup with trap to remove temporary data on normal exit and interruption.
5. Do not use fixed names directly under a shared temporary directory.
6. Redact sensitive key names and values before writing any output.
7. Validate that temporary paths are regular files and do not follow attacker-controlled symbolic links.
8. Apply Kubernetes least privilege so the executing identity can read only the required namespaces and ConfigMaps.

A safer structural pattern is:

bash

umask 077
tmpdir="$(mktemp -d)" || exit 1
trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM

for env in dev staging prod; do
  kubectl get configmaps -n "$env" -o json |
    python3 redacted_config_parser.py > "$tmpdir/config-$env.txt"
done

The parser should suppress or fingerprint sensitive values rather than writing them in plaintext.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

bash

# Find config files in the project
find . -maxdepth 4 \( \
  -name "*.env" -o -name "*.env.*" -o \
  -name "*.config.*" -o -name "config.yaml" -o -name "config.json" -o \
  -name "*.toml" -o -name "settings.*" -o \
  -name "docker-compose*.yml" -o -name "docker-compose*.yaml" -o \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The .env comparison workflow is credential-access behavior because it processes environment files that frequently store secrets and then proceeds to display their raw contents. In practice this enables accidental exposure of API keys, passwords, and DSNs during routine troubleshooting or CI execution.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

done

text

For .env files:
```bash
# Compare .env files across environments
for f in .env.development .env.staging .env.production; do

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Iterating over environment-specific .env files is not inherently malicious, but in this context it is part of a workflow that reveals credential-bearing configuration from multiple environments. This broadens exposure by touching development, staging, and production secret material in a single command path.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

For .env files:

bash

# Compare .env files across environments
for f in .env.development .env.staging .env.production; do
  if [[ -f "$f" ]]; then
    echo "=== $f ==="

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The command grep -v '^#' "$f" | grep -v '^$' | sort prints all non-comment, non-empty lines from .env files, which commonly includes plaintext secrets. This creates a direct disclosure path for credentials and internal configuration to anyone with console or log access.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

For .env files:

bash

# Compare .env files across environments
for f in .env.development .env.staging .env.production; do
  if [[ -f "$f" ]]; then
    echo "=== $f ==="
    grep -v '^#' "$f" | grep -v '^$' | sort

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The CI example diffs sorted contents of .env.staging and .env.production, which can expose production secrets in GitHub Actions logs and artifacts. Because CI logs are often retained and accessible to multiple users, this significantly amplifies the blast radius of accidental credential disclosure.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

• name: Check for drift run: | # Compare all env files and flag dangerous differences diff <(grep -v '^#' .env.staging | sort) <(grep -v '^#' .env.production | sort) || true

text

### 3. `template` — Generate Config Parity Checklist

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to print the contents of .env files, Terraform tfvars, and Kubernetes ConfigMaps directly to stdout, which commonly contain secrets, tokens, database credentials, and internal endpoints. Even though the feature is framed as configuration comparison, emitting raw values can leak sensitive data into terminals, CI logs, shell history, chat transcripts, and other monitoring systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.