SnapPwd Secure Secret Sharing

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:24 AM UTC
• Version: 1.0.1

Overview

The skill is openly designed for secret sharing, but it normalizes sending durable credentials like SSH private keys and whole credential files through a third-party tool without enough guardrails.

Review this carefully before installing. It is not artifact-backed malware, but users should avoid sharing raw SSH private keys, whole .env files, credential bundles, or long-lived production tokens through it unless there is a deliberate policy-approved reason. Prefer scoped temporary credentials, verify the recipient out of band, pin and verify the CLI package if used, avoid putting secrets on command lines, and rotate or revoke anything shared.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned globally installed dependency is trusted with sensitive credentials

Content

View full analysis

/dev/null; then echo "Error: snappwd-cli is not installed." echo "" echo "Install it with:" echo " npm install -g @snappwd/cli" echo "" echo "Or use the web interface at: https://snappwd.io" exit 1 fi ``` ### Technical Analysis The Skill directs users to install the latest available version of `@snappwd/cli` globally without pinning a reviewed version or verifying package integrity. The installed CLI is subsequently entrusted with passwords, API tokens, credential files, and potentially SSH private keys. The implementation of that package is not included in the audited project. Consequently, this audit cannot verify whether the CLI generates keys securely, encrypts before upload, sends data only to the documented endpoint, avoids telemetry, or protects plaintext while processing it. Global npm installation may also run package lifecycle scripts. If the package, its maintainer account, or a transitive dependency is compromised, installation can execute attacker-controlled code under the installing user's privileges. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or one of its transitive dependencies. 2. The attacker publishes a modified version under the same package name. 3. A user follows the Skill's unpinned `npm install -g @snappwd/cli` instruction. 4. npm retrieves and installs the compromised release and may execute its lifecycle scripts ...[truncated 784 chars]

Remediation

View remediation

``` 2. Document the expected package checksum, provenance, and official registry source. 3. Use npm provenance/signature verification where supported. 4. Review and lock all transitive dependencies of the security-critical CLI. 5. Prefer a project-local installation with a committed lockfile over global installation. 6. Consider vendoring or bundling an independently audited client so the effective implementation is available during Skill review. 7. Disable package lifecycle scripts during installation where compatible, and document any scripts that are strictly required. 8. Warn users not to submit valuable credentials until the installed binary and version have been verified. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/snappwd-share.sh:17

Finding

Secret values are exposed through shell and child-process command-line arguments

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:47

Finding

Documentation encourages uploading reusable SSH private keys through an externally installed client

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The description explicitly targets sharing of .env files and other credentials, which often contain many unrelated secrets, endpoints, and configuration details. Encouraging bulk sharing of such files increases the likelihood of excessive disclosure beyond the user's intended secret.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: snappwd-share
description: Securely share secrets, API keys, files, and credentials with OpenClaw agents and team members via self-destructing links. Use when the user needs to share sensitive information (passwords, API keys, tokens, credentials, config files, .env files) in chat, email, or any messaging context. Triggers on phrases like "share this secret", "send this password securely", "create a secure link for this API key", "share credentials safely", "share this file securely", or when user mentions needing to share sensitive data.
---

# SnapPwd Secure Secret Sharing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill directly instructs users to share highly sensitive secret-bearing files, including a private SSH key at ~/.ssh/id_rsa. Normalizing exfiltration of raw private keys is dangerous because compromise of the one-time link, mistaken recipient, endpoint malware, or user error can immediately grant unauthorized infrastructure access.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Share a file (e.g., .env, config, private key)

snappwd put-file ./database.env snappwd put-file ~/.ssh/id_rsa

Output: https://snappwd.io/g/abc123...#encryption-key...

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Promoting credentials.json as a routine shareable file encourages distribution of service-account or API credentials that may provide broad, persistent access. Because the skill is specifically designed to move secrets through chat-adjacent workflows, this increases the risk of credential leakage, misuse, and loss of audit control.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

| **Text Secrets** | API keys, passwords, tokens | Quick credential sharing |
| **Config Files** | `.env`, `config.json`, `settings.yaml` | Share environment configs securely |
| **Private Keys** | SSH keys, TLS certificates, PGP keys | Temporary key distribution |
| **Credentials Files** | `credentials.json`, `.netrc` | Service account access |

## Security Model

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Promoting credentials.json as a routine shareable file encourages distribution of service-account or API credentials that may provide broad, persistent access. Because the skill is specifically designed to move secrets through chat-adjacent workflows, this increases the risk of credential leakage, misuse, and loss of audit control.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

| **Text Secrets** | API keys, passwords, tokens | Quick credential sharing |
| **Config Files** | `.env`, `config.json`, `settings.yaml` | Share environment configs securely |
| **Private Keys** | SSH keys, TLS certificates, PGP keys | Temporary key distribution |
| **Credentials Files** | `credentials.json`, `.netrc` | Service account access |

## Security Model

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The use-case examples normalize sharing access tokens and deploy keys through the tool, which may be appropriate in rare cases but is risky without constraints. In this context, the skill lacks strong warnings about token scope, expiry, revocation, recipient validation, and organizational controls, making accidental credential exposure more likely.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

|----------|---------|
| API Key Sharing | "I need to share my OpenAI API key with a teammate" |
| Database Credentials | "Send the DB password to the new developer" |
| OAuth Tokens | "Share this access token with the integration team" |
| **Config File Sharing** | "I need to share my `.env` file securely" |
| **SSH Key Distribution** | "Send the deploy key to the DevOps team" |
| **Certificate Sharing** | "Share the TLS certificate with the infra team" |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The example to share a .env file encourages transferring a file that commonly contains multiple secrets such as API keys, database passwords, and tokens. This is dangerous because it promotes bulk disclosure of sensitive material and increases blast radius if the link is mishandled, logged, or sent to the wrong recipient.

Content

Scanner excerpt · references/cli-usage.md (reported line 30)May include surrounding context.

Examples:

bash

# Share an .env file
snappwd put-file ./.env

# Share an SSH key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-usage.md (reported line 31)May include surrounding context.

Examples:

bash

# Share an .env file
snappwd put-file ./.env

# Share an SSH key
snappwd put-file ~/.ssh/id_rsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The example instructs users to share a private SSH key file (~/.ssh/id_rsa), which is one of the most sensitive credential types and can directly enable unauthorized access to systems if disclosed. Even if the transport is encrypted, the documentation encourages exfiltration and redistribution of long-lived authentication material that should generally never be moved this way.

Content

Scanner excerpt · references/cli-usage.md (reported line 34)May include surrounding context.

md

snappwd put-file ./.env

# Share an SSH key
snappwd put-file ~/.ssh/id_rsa

# Share a config file
snappwd put-file ./config/credentials.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The credentials.json example promotes sharing a likely credential-bearing configuration file, which may contain API keys, service account data, or other reusable secrets. In the context of a secret-sharing skill, this broadens the pattern of encouraging users to package and transmit whole secret stores instead of minimizing exposure to the smallest necessary secret.

Content

Scanner excerpt · references/cli-usage.md (reported line 37)May include surrounding context.

snappwd put-file ~/.ssh/id_rsa

Share a config file

snappwd put-file ./config/credentials.json

text

### Retrieve a Secret

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is extremely broad and explicitly activates on generic phrases about sharing secrets, passwords, files, or credentials in many contexts. That increases the chance of unintended invocation and can steer users toward moving highly sensitive material into a third-party secret-sharing workflow without sufficient validation of recipient, destination, or policy constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly demonstrates sharing highly sensitive files such as .env files, private SSH keys, and credential stores without any warning, validation, or guardrails. In a skill whose purpose is to move secrets around, normalizing direct sharing of these artifacts increases the likelihood of credential exposure, accidental exfiltration, and unsafe operational behavior by users or downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends the provided secret to an external service via the snappwd CLI without giving the user an explicit warning immediately before transmission or requiring confirmation. Because this skill is specifically triggered for passwords, API keys, tokens, credentials, and .env files, users may disclose highly sensitive material to a third-party network service without fully understanding the trust boundary or retention/security implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.