T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:11- Finding
Excessive Provider Credential Requirements Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
Extropy Operator
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for running Extropy simulations, but it asks for broad provider credential access and does not fully disclose external model-provider data exposure.
Install only if you are comfortable letting Extropy run local commands, create study/output files, and use model-provider API keys. Prefer exposing only the provider key needed for the configured run, avoid sensitive study inputs unless external provider transmission is acceptable, and review exported JSONL files before sharing or retaining them.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill explicitly authorizes access to credentials/config needed to execute extropy commands, and the same file grants Read/Bash tooling plus access to a config file containing provider settings. Even though it says not to inspect raw .env values, normalizing credential access within an agent skill increases the chance of unnecessary secret exposure, accidental logging, or use beyond the minimum required scope.
- Content
md - Config file read: `~/.config/extropy/config.json`. - Credentials expected: provider API keys from env vars (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`, `DEEPSEEK_API_KEY`, `AZURE_API_KEY`/`AZURE_OPENAI_API_KEY`). - Azure endpoint vars: `AZURE_ENDPOINT` or `AZURE_OPENAI_ENDPOINT` when using Azure providers. - Safety boundary: only access credentials/config needed to execute extropy commands for the requested study/scenario, do not inspect raw `.env` values, and avoid reading unrelated files. ## Canonical Pipeline
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md policy: allow_implicit_invocation: false credential_scope: "Only use credentials/config required for the requested Extropy task." secret_handling: "Do not read raw .env contents unless explicitly requested."
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
yaml policy: allow_implicit_invocation: false credential_scope: "Only use credentials/config required for the requested Extropy task." secret_handling: "Do not read raw .env contents unless explicitly requested."
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file includes commands that export raw simulation data to JSONL files, which could affect user data handling and privacy expectations. The surrounding text does not provide any warning or disclosure about the sensitivity of exported data, retention, or where those files will be stored.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad natural-language requests like 'compare policy alternatives' and 'why did this segment flip', which can overlap with ordinary analytical queries outside this skill's intended scope. That increases the chance of unintended invocation, causing the agent to route users into a simulation workflow when they asked for general advice or analysis, potentially producing misleading outputs or unnecessary execution.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: extropy description: "Execution-first operator for Extropy: run pipelines, diagnose failures, and deliver evidence-backed simulation analysis using current CLI contracts." allowed-tools: Read, Grep, Glob, Bash, Edit, Write argument-hint: "[goal or experiment request]" always: false source: "https://github.com/exaforge/extropy"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to run simulation commands that rely on external model providers and explicitly lists provider API keys and config, but it does not clearly warn the user that study contents, prompts, or derived system data may be transmitted off-host. In an execution-first skill, that omission can cause unintended disclosure of sensitive experiment inputs or local context to third-party APIs.
- Content