Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a benign harness simulator/port; sensitive-looking keychain, persistence, and remote-mode labels are implemented as no-op placeholders rather than real access.
Installers should treat this as a prototype or simulator for an agent harness, not a full secure runtime. The sensitive labels are no-ops in this artifact, but users rebuilding it should review future implementations of persistence, remote modes, and prefetch hooks before using them with private prompts or real systems.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export function startMdmRawRead() {
return { name: 'mdm_raw_read', detail: 'stub prefetch – no-op' };
}
export function startKeychainPrefetch() {
return { name: 'keychain_prefetch', detail: 'stub prefetch – no-op' };
}
export function startProjectScan(_root) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export function startMdmRawRead() {
return { name: 'mdm_raw_read', detail: 'stub prefetch – no-op' };
}
export function startKeychainPrefetch() {
return { name: 'keychain_prefetch', detail: 'stub prefetch – no-op' };
}
export function startProjectScan(_root) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
return { name: 'mdm_raw_read', detail: 'stub prefetch – no-op' };
}
export function startKeychainPrefetch() {
return { name: 'keychain_prefetch', detail: 'stub prefetch – no-op' };
}
export function startProjectScan(_root) {
return { name: 'project_scan', detail: `stub prefetch for root=${_root}` };
The import of startKeychainPrefetch from the prefetch module indicates this skill includes functionality to access keychain material, which is highly sensitive credential data. In the context of a workspace setup routine, credential-access capability is not obviously required for basic initialization, making the skill more dangerous because secret collection logic is built into startup-related code paths.
// Setup – workspace setup and report
// Mirrored from Python src/setup.py
import { runDeferredInit } from './deferred_init.js';
import { startKeychainPrefetch, startMdmRawRead, startProjectScan } from './prefetch.js';
export class WorkspaceSetup {
constructor(args) {
this.python_version = args?.python_version ?? '3.12.0';
At runSetup, startKeychainPrefetch() is actually invoked automatically, confirming live credential-access behavior rather than a dormant import. Because this occurs alongside other prefetch side effects and before deferred initialization is trust-gated, the code can access sensitive credentials even when the rest of initialization might be restricted, substantially increasing risk.
export function runSetup(_cwd, trusted = true) {
const prefetches = [
startMdmRawRead(),
startKeychainPrefetch(),
startProjectScan(_cwd ?? '<root>'),
];
return {
The skill documentation exposes capabilities for session persistence and multiple remote connection modes without any safety guidance, trust boundaries, or warnings about data handling and system impact. In an agent skill context, this can lead users or downstream agents to invoke persistence or remote-access features without understanding that prompts, transcripts, credentials, or target systems may be affected.
The documented flush-transcript and load-session functionality indicates session persistence without any visible notice about sensitive data capture, storage location, access control, or retention. In an agent runtime, persisted transcripts may contain prompts, secrets, internal context, or operational history, creating confidentiality and privacy risk if stored insecurely or replayed unexpectedly.
node dist/main.js bootstrap "" --limit 5 # Bootstrap a session node dist/main.js turn-loop "" --max-turns 3 # Run turn loop node dist/main.js flush-transcript "" # Persist session node dist/main.js load-session <session_id> # Load saved session
### Remote Modes
The flush-transcript command persists user-supplied session content to storage immediately via persistSession(), with no explicit warning, consent prompt, or visibility into retention/location before the write. In an agent skill context, prompts and transcripts often contain secrets, internal data, or tokens, so silent persistence increases the risk of unintended data exposure on disk or later retrieval by other users/processes.
The inline help describes these commands as "Simulate ... runtime branching," which suggests non-operative or mock behavior. However, the main dispatcher calls runRemoteMode, runSshMode, runTeleportMode, runDirectConnect, and runDeepLink, indicating actual mode execution logic rather than merely printing a simulated branch choice.
The code persists session state including messages, token counts, and a session identifier via saveSession(session). Although this operation is commented as session persistence, there is no user-facing disclosure, confirmation prompt, or warning in the code indicating that conversation data will be written to storage.
bootstrap_session is documented as only creating a new runtime session, but it also executes matched commands and tools, invokes the query engine, streams events, and persists a session. This hidden side-effect boundary is dangerous because callers may treat bootstrap as a safe initialization step and unknowingly trigger code execution or state changes simply by supplying a prompt.
The runtime routes a user prompt to matching commands/tools and immediately executes them without a user-visible confirmation, review, or policy gate. In a prompt-driven system, this can turn natural-language input into unintended actions, especially when routing is token-based and may match overly broad or surprising modules.
runSetup starts startKeychainPrefetch() immediately as part of normal setup, with no visible consent, warning, or trust gate. Accessing keychain-related material during initialization is dangerous because it can collect sensitive credentials before the user understands what the skill is doing, and the same function also kicks off MDM raw reads, increasing the sensitivity of this startup behavior.
The code claims to infer permission denials for dangerous tools, but the actual policy only blocks tools whose name contains bash. This creates a weak, name-based safeguard that can be bypassed by dangerous tools with other names, leading reviewers or integrators to overestimate the protection level.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"test": "jest"
},
"devDependencies": {
"@types/node": "^20.19.39",
"typescript": "^5.3.0"
}
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"devDependencies": {
"@types/node": "^20.19.39",
"typescript": "^5.3.0"
}
}