Elasticsearch

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:20 PM UTC
• Version: 0.1.0

Overview

This is a coherent Elasticsearch/Kibana curl reference skill, but it merits Review because it handles API keys and includes broad destructive/admin operations without strong scoping or confirmation guidance.

Install only from a pinned, reviewed version. Use a short-lived, least-privilege Elasticsearch API key limited to the needed indices and operations. Avoid storing the key in a shell profile or committed .env file, and require explicit approval before delete, overwrite, reindex, cluster-setting, reroute, alert, or dashboard import operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned Third-Party Skill Installation Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md:17-34` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash ### Option A: Personal skill (available in all projects) git clone https://github.com/davidgeorgehope/elasticsearch-skill.git mkdir -p ~/.claude/skills/elasticsearch cp elasticsearch-skill/SKILL.md ~/.claude/skills/elasticsearch/ cp -r elasticsearch-skill/references ~/.claude/skills/elasticsearch/ ### Option B: Project skill (available in one repo only) git clone https://github.com/davidgeorgehope/elasticsearch-skill.git /tmp/elasticsearch-skill mkdir -p .claude/skills/elasticsearch cp /tmp/elasticsearch-skill/SKILL.md .claude/skills/elasticsearch/ cp -r /tmp/elasticsearch-skill/references .claude/skills/elasticsearch/ ``` ### Technical Analysis The installation instructions clone the mutable default branch of a third-party personal GitHub repository and copy its instruction-bearing Markdown files directly into a trusted Claude Skill directory. The instructions do not pin a reviewed commit, select a signed release, or verify a checksum or signature. A Skill's Markdown content controls how an agent uses its tools. Consequently, changes made upstream after this audit can alter the effective behavior installed by users. Installing the Skill under `~/.claude/skills` increases exposure because that location makes it available across projects. No malicious remote payload was present in the audited artifact. The vulnerability is the absence of controls ensuring that future cloned content is identical to the reviewed content. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or the repository's default branch. 2. The attacker modifies `SKILL.md` or a referenced Markdown file to include malicious instructions or unsafe commands. 3. A user follows the documented installation procedure and clones the mutable default branch. 4. The modified files ar ...[truncated 840 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to a specific reviewed commit hash rather than the mutable default branch: ```bash git clone https://github.com/davidgeorgehope/elasticsearch-skill.git cd elasticsearch-skill git checkout --detach <reviewed-commit-sha> ``` 2. Prefer signed, versioned releases and document how users can verify the maintainer's signature. 3. Publish SHA-256 checksums for `SKILL.md` and every reference file, then require verification before copying them. 4. Advise users to inspect diffs before installing updates. 5. Avoid automatic update procedures that overwrite the trusted Skill directory from an unreviewed branch. 6. For personal installation, explicitly warn that the Skill will affect every project and recommend project-scoped installation when global availability is unnecessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Plaintext and Long-Lived Storage of Elasticsearch API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-38` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash ## Authentication Every request needs the cluster URL and an API key: # Set these for your session (or export in .env / shell profile) ES_URL="https://your-cluster.es.cloud.elastic.co:443" ES_API_KEY="your-base64-api-key" # All requests follow this pattern: curl -s "${ES_URL%/}/<endpoint>" \ -H "Authorization: ApiKey $(printenv ES_API_KEY)" \ -H "Content-Type: application/json" \ -d '<json-body>' ``` ```text If the user provides a URL and key, export them as ES_URL and ES_API_KEY before running commands. ``` ### Technical Analysis The Skill suggests storing an API key in a `.env` file or shell profile and directs the agent to export user-provided credentials. These are plaintext storage and process-environment mechanisms. The instructions do not require restrictive file permissions, exclusion from version control, short credential lifetime, credential cleanup, or a narrowly scoped Elasticsearch API key. Environment variables can be inherited by child processes and may appear in diagnostics or process inspection interfaces, depending on the operating system and access controls. A `.env` file can also be accidentally committed or read by other local users if its permissions are weak. Shell-profile storage makes the credential persist beyond the task and exposes it to future shell sessions. The authenticated network transmission itself is necessary for the declared functionality and no hard-coded exfiltration endpoint was found. The risk arises from credential storage and lifetime, combined with the broad set of documented administrative and destructive operations. ### Attack Path 1. A user supplies an Elasticsearch API key to perform a task. 2. The agent exports the key or stores it in a `.env` file or shell profile as suggested. 3. The key remains available longer ...[truncated 1073 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer short-lived, task-specific credentials supplied through a secret manager or ephemeral process environment. 2. Do not write user-provided credentials to `.env` files or shell profiles unless the user explicitly requests persistent storage. 3. If file storage is required: - Use a dedicated credentials file with permissions such as `chmod 600`. - Ensure the file is excluded through `.gitignore`. - Keep it outside project directories where practical. - Never print or log its contents. 4. Create separate least-privilege keys for read-only searches, document writes, index administration, and cluster administration rather than using one broadly privileged key. 5. Restrict keys to required indices and APIs, and configure expiration. 6. Remove exported credentials after the task where feasible: ```bash unset ES_API_KEY ``` 7. Require HTTPS endpoints and validate the destination host before attaching an authorization header. 8. Obtain explicit user confirmation before destructive or cluster-wide operations, even when the supplied key authorizes them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (81)

Agent Config Directory Access

High

• Category: Agent Snooping

Content

You should see `elasticsearch` in the list.

> **Note:** Adding a GitHub URL to the `skills` array in `~/.claude/settings.json` does **not** work. Skills must be local files — there is no remote fetching.

## Configuration

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Credential Access

High

• Category: Privilege Escalation

Content

Every request needs the cluster URL and an API key:

```bash
# Set these for your session (or export in .env / shell profile)
ES_URL="https://your-cluster.es.cloud.elastic.co:443"
ES_API_KEY="your-base64-api-key"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

# All requests follow this pattern:
curl -s "${ES_URL%/}/<endpoint>" \
  -H "Authorization: ApiKey $(printenv ES_API_KEY)" \
  -H "Content-Type: application/json" \
  -d '<json-body>'
```

• Confidence: 70% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.