Security audit

byteplan-api

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real BytePlan API helper, but it needs review because it automatically stores reusable credentials and tokens in plaintext in locations that do not match the documentation.

Install only if you trust the publisher and are comfortable with BytePlan credentials being stored in plaintext. Use a dedicated working directory, avoid generic USER_NAME/PASSWORD environment variables, check which .env file the skill will modify, prefer UAT over dev when possible, and rotate credentials if they were written to a project file by mistake.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents code capabilities that access environment/config files and make network requests, but it does not declare corresponding permissions. This creates a transparency and governance gap: users and calling systems may not realize the skill can read local credential material and contact external services.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest says the skill provides authentication and data access, but the documentation also describes persistent storage of passwords and tokens plus automatic refresh in ~/.byteplan/.env. That hidden persistence materially changes the security profile because it leaves reusable secrets on disk beyond the immediate session.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation is internally inconsistent: one section says the user may choose whether to save credentials, while later sections state login automatically creates ~/.byteplan and saves token material. This can undermine informed consent and cause credentials or session secrets to be persisted unexpectedly.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs users to store BP_PASSWORD in plaintext in ~/.byteplan/.env. Plaintext credential storage is dangerous because any local process, backup system, accidental file disclosure, or overly permissive filesystem access can expose the account and enable unauthorized access to the BytePlan platform.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code persists highly sensitive secrets including username, plaintext password, access token, and refresh token into a .env file on disk without prompting the user or limiting scope. In an agent/skill ecosystem, writing secrets into the caller's working-directory .env can expose credentials to other tools, source control, backups, logs, or later compromise of the host.

Credential Access

High

Category: Privilege Escalation
Content: // 凭证文件路径 const BYTEPLAN_DIR = path.join(homedir(), '.byteplan'); const ENV_FILE = path.join(BYTEPLAN_DIR, '.env'); // 用户选择的环境 let selectedEnv = 'dev';
Confidence: 93% confidence
Finding: .env'

Credential Access

High

Category: Privilege Escalation
Content: // 用户选择的环境 let selectedEnv = 'dev'; // 尝试使用 ~/.byteplan/.env 凭证登录 let token; if (existsSync(ENV_FILE)) { try {
Confidence: 93% confidence
Finding: .env

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/api.js:16

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/api.js:286