Key Rotation Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent key-rotation planner, but its inventory workflow can print real secrets into command output, chat, or logs unless the user adds redaction and scoping.

Install only if you are comfortable with a skill that helps inspect credential locations and rotation state. Before running its inventory commands, restrict scans to the intended repository, use a redacting secret scanner or metadata-only output, and avoid placing discovered secret values in prompts, reports, tickets, logs, or transcripts. Treat any exposed value as compromised and rotate it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Credential Inventory Commands May Expose Plaintext Secrets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–31
Vulnerability Type: Plaintext sensitive-data disclosure
Risk Level: High

bash

# Find hardcoded secrets (should be 0)
rg -i "(api_key|apikey|secret_key|access_key|private_key|token)\s*[=:]\s*['\"][a-zA-Z0-9+/=_-]{16,}" \
  --type-not binary -g '!node_modules' -g '!vendor' -g '!*.test.*' -g '!*.example*' 2>/dev/null

# Find environment variable references for secrets
rg -i "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|ACCESS_KEY|CLIENT_SECRET)" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null | \
  grep -v "test\|example\|mock\|fake\|dummy" | head -30

Technical Analysis

The inventory procedure uses rg to locate probable secrets but does not suppress or redact matching content. By default, rg prints the complete matching source line. If a configuration or source file contains a hardcoded API key, access token, password, private key, or client secret, the credential may consequently be copied into terminal output, the AI agent context, session transcripts, audit reports, or centralized execution logs.

The first expression specifically seeks assignments containing secret-like values of at least 16 characters, making disclosure of actual credential material particularly likely when a match is found. The second expression is broader and may print configuration lines containing both a sensitive variable name and its value. Excluding some test and example files does not provide redaction and may also miss differently named fixtures.

This finding is limited to local disclosure: the reviewed file contains no command that explicitly transmits discovered values to an external system.

Attack Path

1. A user invokes the documented inventory workflow against a repository containing a plaintext credential.
2. The agent or operator executes one of the supplied recursive rg commands.
3. rg locates a matching assignment an ...[truncated 1059 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace content-printing searches with metadata-only output containing the file path, line number, and detected secret type. Do not include the matching line or value.
2. Use a purpose-built secret scanner with verified redaction support, such as Gitleaks with redaction enabled or detect-secrets, and validate that no raw value appears in stdout, stderr, reports, or debug logs.
3. Require explicit user authorization before scanning a repository and constrain every scan to the intended project root.
4. Treat all discovered values as sensitive. Do not place them in prompts, reports, persistent memory, issue trackers, chat messages, or telemetry.
5. Store findings using fingerprints or one-way hashes where correlation is necessary. Never record complete secrets.
6. Restrict access to scan logs and configure short retention periods. Disable command tracing and other verbose logging while secret discovery is running.
7. If a secret has already appeared in output, rotate or revoke it promptly, inspect access logs for misuse, and remove it from source history and retained transcripts where feasible.
8. Add a documented output-safety test using synthetic credentials to ensure future versions reveal only redacted findings.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

## Critical (rotate immediately)
| Key | Type | Age | Last Rotated | Location | Priority |
|-----|------|-----|-------------|----------|----------|
| STRIPE_SECRET_KEY | API key | 14 months | Never | .env (server) | 18/20 🔴 |
| DB_PASSWORD (prod) | Password | 11 months | 2025-05-15 | Vault | 15/20 🔴 |
| JWT_SIGNING_KEY | Signing key | 8 months | 2025-08-01 | env var | 14/20 🔴 |