Dashpass

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 0.9.0

Overview

This is a credential-vault skill, but it overstates key protections and lets any agent with the vault environment read, export, rotate, or delete critical secrets without the promised human approval.

Review before installing. Use only testnet or low-impact secrets unless the approval and audit controls are fixed. Do not assume critical credentials require human approval in the current implementation, avoid eval-based env export for sensitive secrets, disable cache if needed, and treat CRITICAL_WIF and the recovery mnemonic as full vault-control secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dashpass-cli.mjs:519

Finding

Mutual confirmation can be automatically fabricated and bypassed by one process

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dashpass-cli.mjs:489

Finding

Documented human approval for critical credentials is not enforced

Content

View full analysis

**CRITICAL-level human confirmation:** Credentials marked "critical" (like mainnet private keys or primary API keys) require explicit human approval before any AI agent can access or modify them. The AI cannot escalate its own permissions. ``` The normal retrieval path decrypts the selected record without checking its security level or obtaining human approval: ```javascript // scripts/dashpass-cli.mjs: standard cmdGet path const sorted = docs.sort((a, b) => (b.data.version ?? 1) - (a.data.version ?? 1)); const best = sorted[0]; let decrypted; try { decrypted = decryptDoc(best.data); } catch (e) { console.error('[get] Decryption failed:', e.message); process.exit(1); } const result = { id: best.id, service: best.data.service, label: best.data.label, credType: best.data.credType, level: best.data.level, status: best.data.status, version: best.data.version ?? 1, expiresAt: best.data.expiresAt ?? 0, decrypted, }; ``` The environment export path similarly decrypts records without a level-based authorization gate: ```javascript // scripts/dashpass-cli.mjs: cmdEnv path const best = docs.sort((a, b) => (b.data.version ?? 1) - (a.data.version ?? 1))[0]; decrypted = decryptDoc(best.data); ``` ### Technical Analysis The `level` field is treated only as metadata. The CLI does not branch on `level === "critical"` before retrieval, environment export, rotation, or deletion. The implementation therefore does not enforce the documented rule that critical credentials require explicit human approval. Ordinary `get`, `get --pipe`, and `env` operations can expose critical secrets using only the p ...[truncated 1431 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dashpass-cli.mjs:127

Finding

Standard cryptographic paths leave sensitive buffers in process memory

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: setup.md:24

Finding

Security-sensitive runtime dependencies lack a reproducible integrity boundary

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/mutual-confirm.mjs:197

Finding

Audit-trail guarantees materially exceed the implemented logging controls

Content

View full analysis

**On-chain audit trail:** Every credential operation (create, read, rotate, delete) can be logged to the Dash blockchain. Blockchain entries are immutable — nobody can edit or delete the history, not even the system administrators. ``` ```markdown | **Audit trail** | Internal logs (you trust the company) | On-chain logs (you trust math) | ``` The implemented mutual-confirmation audit log is a local file: ```javascript // scripts/mutual-confirm.mjs:197-205 function auditLog(entry) { ensureDir(); const record = { timestamp: new Date().toISOString(), ...entry }; appendFileSync(AUDIT_LOG_PATH, JSON.stringify(record) + '\n', { mode: 0o600 }); } export { auditLog }; ``` The CLI's normal CRUD and export paths do not create an on-chain `accessLog` document. ### Technical Analysis The project contract defines an `accessLog` document type, but the reviewed CLI does not submit these documents for ordinary credential operations. Only mutual-confirmation request, approval, denial, and execution events are appended to `~/.dashpass/audit.log`. That local file is not cryptographically chained, signed, append-only at the operating-system level, or stored on-chain. A process running as the same user can alter, truncate, replace, or delete it. Standard `get`, `env`, `put`, `rotate`, and `delete` operations are not recorded through this logger. Consequently, the system does not provide the immutable, comprehensive audit trail described in its trust architecture. ### Attack Path 1. An Agent invokes ordinary `get`, `env`, `put`, `rotate`, or ...[truncated 881 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The troubleshooting guidance includes rm -f ~/.dashpass/evo.share ~/.dashpass/cc.share, a destructive filesystem operation, without a warning about consequences or a safer verification step first. Although targeted to a fixed path, it can still cause loss of mutual-confirmation material and operational lockout if run carelessly or in the wrong environment.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

node $CLI share-status

If shares are missing or unhealthy, re-initialize:

rm -f ~/.dashpass/evo.share ~/.dashpass/cc.share node $CLI init-shares

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/dashpass-recovery.mjs (reported line 5)May include surrounding context.

js

* dashpass-recovery.mjs — Phase 0 (P0-3): BIP-39 backup/recover for the
 * CRITICAL_WIF-derived 32-byte private key. Pure local crypto, no Platform deps.
 *
 * Model (borrowed from oak-keyring's BIP-39 recovery-words pattern):
 *   backup:  CRITICAL_WIF -> 32-byte privKey -> 24-word BIP-39 mnemonic (stdout only)
 *   recover: mnemonic -> 32-byte entropy -> privKey -> WIF (re-set CRITICAL_WIF)
 *

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires sensitive environment variables (CRITICAL_WIF, DASHPASS_IDENTITY_ID) but does not declare any explicit tool or permission scope. In an agent setting, that weakens least-privilege boundaries and makes it easier for the skill to access or encourage use of highly sensitive secrets without transparent scoping or user consent expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation exposes a destructive delete operation without an adjacent warning that deletion can cause irreversible loss of access to stored credentials. For a credential vault skill, this is more dangerous than usual because users may assume recovery is available when the same document also discusses backup and recovery for keys, not deleted records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The eval $(node $CLI env ...) example encourages placing decrypted secrets directly into the shell evaluation flow without warning about exposure risks. This can leak secrets through shell history, process inspection, downstream child processes, debugging output, or command-injection if output formatting is ever compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

bash

# Shares must be 0600, directory must be 0700
chmod 700 ~/.dashpass
chmod 600 ~/.dashpass/evo.share ~/.dashpass/cc.share

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

bash

# Shares must be 0600, directory must be 0700
chmod 700 ~/.dashpass
chmod 600 ~/.dashpass/evo.share ~/.dashpass/cc.share

If init-shares reports success but share-status shows wrong permissions, check if a umask override is active.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The contract defines an on-chain accessLog document that records service, action, agentId, and timestamp, which expands the skill beyond a simple encrypted vault into persistent behavioral telemetry. Even if secret values remain encrypted, immutable on-chain metadata can reveal which services are used, when credentials are accessed, and by which agents, creating privacy leakage and operational intelligence for attackers or observers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The get --json example shows the fully decrypted secret in normal command output without warning users that this can end up in terminal scrollback, CI logs, shell captures, observability tooling, or copied transcripts. In a credential-vault skill, normalized examples that print raw secrets materially increase accidental disclosure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes DashPass as an encrypted credential vault on Dash Platform with encrypted on-chain storage. In this file, the delete command is documented as permanently removing all versions of a credential from the blockchain, which is semantically at odds with an immutable on-chain vault model and with the earlier rotation/audit language that emphasizes retained history on-chain.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented env workflow encourages decrypting secrets and exporting them into the shell environment, then applying them via eval $(...). This expands exposure well beyond vault retrieval: environment variables can leak to subprocesses, debugging output, shell history/workflows, and command injection becomes possible if output is not perfectly escaped or is attacker-influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Recommending eval $(node dashpass-cli.mjs env ...) is dangerous because it executes command output in the current shell, not just data assignment. If service names, labels, values, or any upstream output formatting are ever attacker-controlled or improperly escaped, this becomes a direct code-execution vector while simultaneously placing decrypted secrets into the ambient shell environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/faq.md (reported line 49)May include surrounding context.

md

### "invalid identity nonce"

This happens when you do write operations (put, rotate) too quickly in succession. The Dash Platform needs a few seconds between operations to process each transaction.

**Fix:** Wait 3-5 seconds between consecutive write operations. This is a known platform timing limitation, not a DashPass bug.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/security-analysis-summary.md (reported line 17)May include surrounding context.

md

| ID | Issue | Fix |
|----|-------|-----|
| P0-1 | Plaintext cache in world-readable `/tmp/` | Cache moved to `~/.dashpass/cache/`, encrypted with AES-256-GCM, file permissions 0600 |
| P0-2 | `--value` exposed in shell history | Added `--value-stdin` flag; warning printed when `--value` used via CLI args |
| P0-3 | Decrypted values stored in cache | Cache stores only encrypted blobs; decryption happens on read |

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/security-model.md (reported line 121)May include surrounding context.

md

| ID | Issue | Fix |
|----|-------|-----|
| P0-1 | Plaintext cache in world-readable `/tmp/` | Cache moved to `~/.dashpass/cache/`, encrypted with AES-256-GCM, file permissions 0600 |
| P0-2 | `--value` exposed in shell history | Added `--value-stdin` flag; warning printed when `--value` used via CLI args |
| P0-3 | Decrypted values stored in cache | Cache stores only encrypted blobs; decryption happens on read |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The document describes a 5-minute local cache of encrypted credential data. Even though the cache is encrypted and permissioned, it extends the lifetime of sensitive material on disk and creates residual access after an agent session ends, especially if the WIF remains available in the environment or is later recovered from the host. In a credential-vault skill, any persistence of secret-adjacent data increases the attack surface and weakens the claim of immediate revocation.

Content

Scanner excerpt · references/security-model.md (reported line 35)May include surrounding context.

md

If an agent misbehaves or a key is compromised:
- **Instant:** Delete the `CRITICAL_WIF` environment variable → agent loses all access immediately
- **Permanent:** Rotate the WIF → all old ciphertext becomes undecryptable
- **On-chain:** Revoke the Identity key → no more write access to the blockchain

## Local cache

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document promotes on-chain audit logging as a trust feature but does not pair that claim with a clear warning that blockchain audit metadata is durable, broadly visible to observers with chain access, and effectively irreversible once written. For a credential vault, users may not realize that operation history, service associations, timing, and usage patterns can create lasting intelligence about their systems even if secret values remain encrypted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that plaintext is given to the AI agent during retrieval, but it does not present this as a prominent security warning or clearly explain the consequence: once decrypted, the secret is exposed to the agent runtime and can be copied, logged, forwarded, or mishandled by prompts, tools, or memory systems. In a credential-management skill for AI agents, this omission can mislead users into believing the system is trustless end-to-end when in fact retrieval intentionally breaks that boundary at the agent layer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default get flow ends by calling printCredential, which prints cred.decrypted?.value directly to stdout. Although the file warns about passing secrets on the command line, it does not similarly warn users that retrieving a credential will display the secret in terminal output, shell scrollback, logs, or recordings.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The env command decrypts stored secrets and emits them as shell export VAR="value" statements intended for eval $(...). That expands the vault from storage/retrieval into direct environment injection, which increases accidental disclosure risk through shell history, process environments, logging, debugging tools, and downstream child processes that inherit the exported secrets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code provides shell-oriented secret injection capability by transforming vault entries into environment variable assignments for direct shell evaluation. Even with basic escaping, the feature materially increases the blast radius of a retrieved secret because it encourages loading decrypted credentials into the ambient shell session, where unrelated commands and tools can access or leak them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The env command outputs fully decrypted secrets directly to stdout as shell export statements without a strong disclosure warning at the point of use. This can leak secrets into terminal scrollback, command substitution contexts, CI logs, audit trails, or wrappers that capture stdout, making accidental exposure likely in real operational use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises encrypted credential storage on Dash Platform, but this code stores both secret shares and audit logs as local files under the user's home directory. In a credential-vault skill, this mismatch is security-relevant because users and downstream agents may assume platform-backed isolation, durability, and access controls that do not actually exist, increasing the risk of local compromise, backup leakage, or accidental exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This routine reconstructs the full private key locally and performs decryption on the host, contradicting the stated model of an encrypted on-platform credential vault. In the context of a secret-management skill, local reconstruction materially expands the attack surface: any host compromise, debugging hook, crash dump, or malicious co-resident process may target the reconstructed key or decrypted plaintext during execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs users to place a private key in an environment variable, but does not warn that env vars may be readable by other local processes, captured by process inspection tools, inherited by child processes, logged by shell tooling, or persisted in session/config files. Because this skill manages decryption keys for a credential vault, exposing the WIF can directly compromise all stored secrets and the associated blockchain identity.

Content

No source excerpt is available for this finding.