T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/shared-memory.sh:22- Finding
Undeclared Discovery and Reuse of Local API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Shared Memory between Lobsters
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate shared-memory purpose, but it can silently reuse local Ensue credentials and immediately change or delete remote access controls.
Review carefully before installing. Use only a dedicated, least-privileged Ensue API key, avoid relying on credentials from other plugins, and manually confirm any create/delete/grant/revoke/subscription command before running it. Do not paste unredacted troubleshooting output from this skill into chats, logs, or support tickets.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/shared-memory.sh:62- Finding
JSON-RPC Request Injection Through Unescaped Command Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:96- Finding
Troubleshooting Instructions Expose API Keys in Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents direct shell-based capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. That creates a mismatch between what the skill can cause an agent to do and what reviewers or enforcement layers can constrain, increasing the chance of unintended execution of user/group creation, permission grants, and revocations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description uses very broad invocation language around sharing knowledge, creating users/groups, granting permissions, and managing access control. This makes it more likely the skill will be selected for common requests where the user did not clearly intend persistent permission changes or cross-user data sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation presents destructive and permission-changing commands such as delete-user, delete-group, grant, and revoke without warnings about permanence, scope, or the risk of exposing private namespaces. In an agent setting, omission of these cautions increases the chance that sensitive access-control changes are performed without informed consent or adequate review.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 79% confidence
- Finding
The family-sharing example encourages creation of persistent users, groups, memberships, and grants that outlive the current session. While the intent is legitimate collaboration, session-persistent identity and permission changes can unintentionally broaden long-term access to shared memory, especially if used casually or on the wrong namespace.
- Content
Example: Family Sharing
bash # Create user for partner {baseDir}/scripts/shared-memory.sh create-user mark # Create family group
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script searches multiple unrelated local plugin and config paths for an Ensue API key, then silently uses whatever it finds for authenticated network requests. This crosses trust boundaries by harvesting credentials from other tools without explicit user consent, creating a credential misuse risk and potentially operating under the wrong identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script reads a sensitive API key from local files and immediately uses it in authenticated requests to a remote service without any user-facing disclosure. In the context of a sharing/access-control skill, this is especially dangerous because the credential can be used to modify users, groups, permissions, and subscriptions under the owner's account.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The script transmits data and an Authorization bearer token to an external API endpoint. External transmission is expected for this skill's functionality, but it remains security-relevant because requests include sensitive credentials and potentially user/group/permission data; combined with silent credential harvesting, the risk is materially higher.
- Content
sh local method="$1" local args="$2" curl -s -X POST https://api.ensue-network.ai/ \ -H "Authorization: Bearer $ENSUE_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"$method\",\"arguments\":$args},\"id\":1}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The script transmits data and an Authorization bearer token to an external API endpoint. External transmission is expected for this skill's functionality, but it remains security-relevant because requests include sensitive credentials and potentially user/group/permission data; combined with silent credential harvesting, the risk is materially higher.
- Content
sh local method="$1" local args="$2" curl -s -X POST https://api.ensue-network.ai/ \ -H "Authorization: Bearer $ENSUE_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"$method\",\"arguments\":$args},\"id\":1}" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Destructive actions such as delete-user and delete-group execute immediately with no confirmation, dry-run, or safety prompt. In an agent-driven environment, accidental invocation or prompt manipulation could cause irreversible identity or access-control changes on the remote shared-memory service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Revoking a grant changes access control state immediately without confirmation or warning. In this skill's context, mistaken or manipulated revocations can disrupt legitimate access, break automation, or unintentionally deny users or groups needed permissions.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The header documentation enumerates supported actions, but it does not include
list-permissions, which is actually implemented later in the case statement. This creates an intent/documentation mismatch by understating the skill's available access-control inspection functionality.- Content
Static analysis
No suspicious patterns detected.