Secret Detection

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:08 AM UTC
• Version: 1.0.0

Overview

This is a local secret-scanning hook with a coherent purpose, but it can expose detected secrets in its own output and has unsafe hook-install behavior.

Review before installing. This skill is not clearly malicious, but it is risky for real secrets: detected credentials may appear in terminal or CI logs, existing pre-commit hooks can be overwritten, and staged-content scanning can be bypassed. Use only after fixing redaction, hook installation, staged-blob scanning, and exit-code behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:49

Finding

Full Secret Values Are Exposed Through JSON Scan Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:65

Finding

Pre-Commit Hook Scans Working-Tree Files Instead of Staged Content

Content

View full analysis

Remediation

View remediation

` or an equivalent Git plumbing interface. - Avoid constructing shell command strings; continue using argument arrays for subprocess execution. - Use null-delimited Git path output where applicable to handle spaces, newlines, and unusual filenames safely. - Treat Git command failures and unreadable staged blobs as blocking errors instead of reporting a successful clean scan. - Explicitly handle added, copied, modified, renamed, deleted, and submodule entries according to documented policy. - Add an integration test that stages a secret-bearing version, replaces the working-tree version with clean content, and verifies that the commit remains blocked. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:142

Finding

Explicit File Scans Return Success When Secrets Are Detected

Content

View full analysis

`. 2. Place a matching secret in the target file. 3. The scanner detects and reports the secret. 4. Because the scan did not use `--staged`, the nonzero exit condition is false. 5. The process exits with status zero. 6. Downstream automation treats the security check as successful and continues deployment, packaging, or publication. ### Impact Assessment This issue permits bypass of scanner-based automation that uses explicit file paths. It does not directly grant local privileges, but it can allow credentials to enter artifacts, repositories, logs, or deployment environments. The ...[truncated 129 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

md

- AWS Access Key IDs (`AKIA...`)
- AWS Secret Access Keys
- Passwords, secrets, tokens in variable assignments
- GitHub Personal Access Tokens (`ghp_...`)
- GitHub Fine‑Grained Tokens (`github_pat_...`)
- OpenAI API Keys (`sk-...`)
- Bearer tokens

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

Scan Specific Files

bash

./scripts/main.py scan --file config.yaml --file .env

Scan All Staged Files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Scan Specific Files

bash

./scripts/main.py scan --file config.yaml --file .env

Scan All Staged Files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/main.py (reported line 23)May include surrounding context.

python

(r'(?i)secret\s*=\s*["\']?([^\s"\']{8,})', "Secret"),
    (r'(?i)token\s*=\s*["\']?([^\s"\']{8,})', "Token"),
    (r'(?i)api_key\s*=\s*["\']?([^\s"\']{8,})', "API Key"),
    (r'(?i)ghp_[0-9a-zA-Z]{36}', "GitHub Personal Access Token"),
    (r'(?i)github_pat_[0-9a-zA-Z]{40}', "GitHub Fine‑Grained Token"),
    (r'(?i)sk-[0-9a-zA-Z]{48}', "OpenAI API Key"),
    (r'(?i)Bearer\s+([0-9a-zA-Z._-]{20,})', "Bearer Token"),

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares executable capabilities that imply reading files, writing hooks, and invoking shell commands, but it does not declare an explicit tool scope such as permissions or allowed-tools. That ambiguity weakens reviewability and least-privilege controls, making it easier for a consumer to run a skill with broader access than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states it prints the first 20 characters of detected secrets to the console, which can itself disclose sensitive material into terminal scrollback, CI logs, shell recording tools, or shared debugging transcripts. Even partial secret exposure may be enough to aid credential identification, brute-force reduction, or accidental secondary leakage.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 65)May include surrounding context.

python

def get_staged_files():
    """Get list of staged files from git."""
    try:
        result = subprocess.run(
            ['git', 'diff', '--cached', '--name-only', '--diff-filter=ACM'],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The install command overwrites .git/hooks/pre-commit without checking for an existing hook, prompting the user, or creating a backup. This can silently replace repository-local security or workflow controls and may be abused to disrupt expected protections or developer processes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_secret_detection.py (reported line 50)May include surrounding context.

python

try:
        # Run the script via subprocess
        result = subprocess.run(
            [sys.executable, os.path.join(os.path.dirname(__file__), '..', 'scripts', 'main.py'),
             'scan', '--file', temp_path],
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_secret_detection.py (reported line 66)May include surrounding context.

python

def test_cli_install_simulation():
    """Test install command (simulated, not in a git repo)."""
    # This will fail because we're not in a git repo, but we can check the error
    result = subprocess.run(
        [sys.executable, os.path.join(os.path.dirname(__file__), '..', 'scripts', 'main.py'),
         'install'],
        capture_output=True,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tests/test_secret_detection.py (reported line 81)May include surrounding context.

python

json_start = i
            break
    if json_start is not None:
        # Find the matching closing brace (simplistic: join from start to end)
        json_str = '\n'.join(lines[json_start:])
        try:
            data = json.loads(json_str)

Static analysis

No suspicious patterns detected.