gopass

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:13 AM UTC
• Version: 1.0.0

Overview

This gopass skill is coherent and not malicious, but it gives an agent broad password-store powers without enough safety guidance around secret exposure, deletion, and auto-confirmation.

Install only if you are comfortable letting the agent operate on your gopass store. Before any use, require explicit path-by-path approval for showing, copying, editing, deleting, syncing, or changing recipients, and avoid `--yes`, warning suppression, recursive deletion, and plaintext output unless you have a specific controlled reason.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete
```bash
gopass rm path/to/secret
gopass rm -r path/to/folder          # recursive
```

• Confidence: 93% confidence
• Finding: `gopass rm path/to/secret` is a destructive parameterized command acting on sensitive assets, and the skill presents it without guardrails such as target validation or confirmation. Because the skill is designed for credential management, misuse of this command can directly remove needed secrets and disrupt authentication workflows.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete
```bash
gopass rm path/to/secret
gopass rm -r path/to/folder          # recursive
```

### Move / Copy

• Confidence: 98% confidence
• Finding: `gopass rm -r path/to/folder` is especially dangerous because recursive deletion can wipe a large portion of the secret store in one operation. In the context of a password-manager skill, this amplifies the blast radius from a bad path, ambiguous user request, or manipulated parameter and can cause widespread credential loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents `gopass show -o` and `gopass show -c`, which expose secrets directly to stdout or the clipboard, but provides no caution about terminal logging, shell history, process capture, clipboard snooping, or shared desktop exposure. In a secret-management skill, normalizing these unsafe output patterns without guardrails increases the chance an agent or user will exfiltrate credentials unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill includes `gopass rm` and especially `gopass rm -r` without any warning about irreversible deletion, scope validation, or confirmation expectations. This is dangerous because an agent following the skill could delete individual secrets or entire folders from the password store, causing credential loss and potential operational outages.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The non-interactive tips recommend suppressing warnings, notifications, and prompts via `gopass show -f`, `GOPASS_NO_NOTIFY=true`, and `gopass --yes` without describing the security consequences. In combination, these settings reduce friction around secret disclosure and destructive actions, making accidental exfiltration or unauthorized changes more likely in automated agent workflows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Use `gopass show -o path` for machine-readable password-only output
- Use `gopass show -f path` to suppress warnings
- Set `GOPASS_NO_NOTIFY=true` to suppress desktop notifications
- Use `gopass --yes` to auto-confirm prompts

• Confidence: 90% confidence
• Finding: Recommending `gopass --yes` enables automatic confirmation of prompts, which weakens human-in-the-loop protections for sensitive operations. In an agent skill for secret management, this is particularly risky because it can turn potentially reversible mistakes into immediate secret disclosure, modification, or deletion without an explicit final check.

Static analysis

No suspicious patterns detected.