SnapPwd Secure Secret Sharing

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:24 AM UTC
• Version: 1.0.1

Overview

The skill is openly designed for secret sharing, but it normalizes sending durable credentials like SSH private keys and whole credential files through a third-party tool without enough guardrails.

Review this carefully before installing. It is not artifact-backed malware, but users should avoid sharing raw SSH private keys, whole .env files, credential bundles, or long-lived production tokens through it unless there is a deliberate policy-approved reason. Prefer scoped temporary credentials, verify the recipient out of band, pin and verify the CLI package if used, avoid putting secrets on command lines, and rotate or revoke anything shared.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38
• Finding: Unpinned globally installed dependency is trusted with sensitive credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:38-40`, `references/cli-usage.md:3-6`, `scripts/snappwd-share.sh:7-15` **Vulnerability Type**: Supply-chain exposure through an unpinned security-critical dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:38-40`: ```bash # Install if needed npm install -g @snappwd/cli ``` `references/cli-usage.md:3-6`: ```bash ## Installation ```bash npm install -g @snappwd/cli ``` ``` `scripts/snappwd-share.sh:7-15`: ```bash # Check if snappwd-cli is installed if ! command -v snappwd &> /dev/null; then echo "Error: snappwd-cli is not installed." echo "" echo "Install it with:" echo " npm install -g @snappwd/cli" echo "" echo "Or use the web interface at: https://snappwd.io" exit 1 fi ``` ### Technical Analysis The Skill directs users to install the latest available version of `@snappwd/cli` globally without pinning a reviewed version or verifying package integrity. The installed CLI is subsequently entrusted with passwords, API tokens, credential files, and potentially SSH private keys. The implementation of that package is not included in the audited project. Consequently, this audit cannot verify whether the CLI generates keys securely, encrypts before upload, sends data only to the documented endpoint, avoids telemetry, or protects plaintext while processing it. Global npm installation may also run package lifecycle scripts. If the package, its maintainer account, or a transitive dependency is compromised, installation can execute attacker-controlled code under the installing user's privileges. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or one of its transitive dependencies. 2. The attacker publishes a modified version under the same package name. 3. A user follows the Skill's unpinned `npm install -g @snappwd/cli` instruction. 4. npm retrieves and installs the compromised release and may execute its lifecycle scripts ...[truncated 784 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a specifically reviewed version rather than installing the latest release: ```bash npm install --global @snappwd/cli@<reviewed-version> ``` 2. Document the expected package checksum, provenance, and official registry source. 3. Use npm provenance/signature verification where supported. 4. Review and lock all transitive dependencies of the security-critical CLI. 5. Prefer a project-local installation with a committed lockfile over global installation. 6. Consider vendoring or bundling an independently audited client so the effective implementation is available during Skill review. 7. Disable package lifecycle scripts during installation where compatible, and document any scripts that are strictly required. 8. Warn users not to submit valuable credentials until the installed binary and version have been verified. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/snappwd-share.sh:17
• Finding: Secret values are exposed through shell and child-process command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/snappwd-share.sh:3`, `scripts/snappwd-share.sh:17-25`, `scripts/snappwd-share.sh:30-32` **Vulnerability Type**: Plaintext credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `scripts/snappwd-share.sh:3`: ```bash # Usage: ./snappwd-share.sh "your secret here" ``` `scripts/snappwd-share.sh:17-25`: ```bash # Get secret from argument or stdin SECRET="" if [ -n "$1" ]; then SECRET="$1" elif [ ! -t 0 ]; then SECRET=$(cat) else echo "Error: No secret provided." echo "Usage: $0 \"your secret\"" ``` `scripts/snappwd-share.sh:30-32`: ```bash # Create the secure link echo "Creating secure link..." LINK=$(snappwd put "$SECRET") ``` ### Technical Analysis The wrapper accepts a plaintext secret as its first command-line argument. An interactively entered command such as: ```bash ./snappwd-share.sh "production-password" ``` may be retained in shell history. More importantly, both argument-based and stdin-based inputs are ultimately converted into the command-line argument of the child process through: ```bash snappwd put "$SECRET" ``` Quoting prevents shell word splitting and command substitution at this stage, but it does not protect confidentiality. The plaintext still appears in the child process's argument vector. Depending on operating-system policy and local permissions, process arguments may be visible through process inspection interfaces, administrative monitoring, endpoint telemetry, audit systems, diagnostic tools, or crash reports. Capturing stdin into a shell variable also retains the plaintext in the shell process for the duration of execution. No temporary file is created, which limits the exposure, but the argv disclosure remains. ### Attack Path 1. A user invokes the script with a sensitive password or pipes the password over stdin. 2. The wrapper stores the plaintext in `SECRET`. 3. The wrapper launches `snappwd ...[truncated 987 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove command-line secret input from the documented interface. 2. Require secret input through a protected stdin or file-descriptor channel. 3. Modify or select a CLI mode that consumes the secret directly from stdin without converting it to an argument, for example: ```bash read -r -s SECRET printf '%s' "$SECRET" | snappwd put --stdin ``` This is only safe if the reviewed CLI genuinely supports an stdin mode and does not internally reconstruct an exposed command line. 4. Avoid retaining the complete secret in a shell variable where possible; stream it directly from the input source to the encrypting process. 5. Remove examples that put secrets directly into interactive shell commands. 6. Add a warning that prior argument-based invocations may remain in shell history or operational telemetry. 7. Ensure the CLI never logs plaintext input and clears sensitive buffers where technically practical. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:47
• Finding: Documentation encourages uploading reusable SSH private keys through an externally installed client<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47-52`, `references/cli-usage.md:28-37` **Vulnerability Type**: Excessive handling of durable high-privilege credentials **Risk Level**: Medium ### Vulnerable Code `SKILL.md:47-52`: ```bash # Share a text secret snappwd put "your-secret-here" # Share a file (e.g., .env, config, private key) snappwd put-file ./database.env snappwd put-file ~/.ssh/id_rsa ``` `references/cli-usage.md:28-37`: ```bash Examples: ```bash # Share an .env file snappwd put-file ./.env # Share an SSH key snappwd put-file ~/.ssh/id_rsa # Share a config file snappwd put-file ./config/credentials.json ``` ``` ### Technical Analysis These commands do not write to or modify `~/.ssh/id_rsa`; they instruct the external CLI to read and upload that file. The operation is explicit rather than hidden, and sharing sensitive files is within the Skill's broadly declared functionality. Nevertheless, a user's default `id_rsa` is commonly a durable, reusable identity credential with access to multiple remote systems. Presenting that file as a routine example encourages a high-impact credential-distribution pattern rather than a least-privilege workflow. The file passes through an npm-installed client whose implementation is absent from this project. The project documentation asserts client-side encryption and zero-knowledge storage, but those properties cannot be independently verified from the audited files. Even if encryption is implemented correctly, anyone who obtains the complete URL can retrieve the key material once, and the private key remains valid after retrieval unless separately revoked or rotated. ### Attack Path 1. A user follows the documentation and runs `snappwd put-file ~/.ssh/id_rsa`. 2. The third-party CLI reads the user's reusable SSH private key. 3. The CLI encrypts and uploads the file according to its external implementation, then returns a URL containing the decryption key. 4. The user sends the complete ...[truncated 1392 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `~/.ssh/id_rsa` from all routine examples. 2. Recommend a dedicated key restricted to one host, account, command, and purpose rather than a user's general identity key. 3. Prefer short-lived SSH certificates, time-limited access grants, or another ephemeral authorization mechanism. 4. Require explicit user confirmation before processing private keys or other credential files. 5. Display a warning that link destruction does not revoke the credential contained in the shared file. 6. Instruct users to verify the recipient over a separate trusted channel. 7. Require immediate rotation or revocation after temporary transfer. 8. Advise users to protect private keys with strong passphrases and never share the passphrase through the same channel. 9. Document how to remove the corresponding public key from every affected `authorized_keys` file if disclosure is suspected. 10. Prefer self-hosted, independently audited infrastructure for exceptionally sensitive key material. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

---
name: snappwd-share
description: Securely share secrets, API keys, files, and credentials with OpenClaw agents and team members via self-destructing links. Use when the user needs to share sensitive information (passwords, API keys, tokens, credentials, config files, .env files) in chat, email, or any messaging context. Triggers on phrases like "share this secret", "send this password securely", "create a secure link for this API key", "share credentials safely", "share this file securely", or when user mentions needing to share sensitive data.
---

# SnapPwd Secure Secret Sharing

• Confidence: 90% confidence
• Finding: The description explicitly targets sharing of .env files and other credentials, which often contain many unrelated secrets, endpoints, and configuration details. Encouraging bulk sharing of such files increases the likelihood of excessive disclosure beyond the user's intended secret.

Credential Access

High

• Category: Privilege Escalation

Content

# Share a file (e.g., .env, config, private key)
snappwd put-file ./database.env
snappwd put-file ~/.ssh/id_rsa

# Output: https://snappwd.io/g/abc123...#encryption-key...
```

• Confidence: 98% confidence
• Finding: The skill directly instructs users to share highly sensitive secret-bearing files, including a private SSH key at ~/.ssh/id_rsa. Normalizing exfiltration of raw private keys is dangerous because compromise of the one-time link, mistaken recipient, endpoint malware, or user error can immediately grant unauthorized infrastructure access.

Credential Access

High

• Category: Privilege Escalation

Content

| **Text Secrets** | API keys, passwords, tokens | Quick credential sharing |
| **Config Files** | `.env`, `config.json`, `settings.yaml` | Share environment configs securely |
| **Private Keys** | SSH keys, TLS certificates, PGP keys | Temporary key distribution |
| **Credentials Files** | `credentials.json`, `.netrc` | Service account access |

## Security Model

• Confidence: 95% confidence
• Finding: Promoting credentials.json as a routine shareable file encourages distribution of service-account or API credentials that may provide broad, persistent access. Because the skill is specifically designed to move secrets through chat-adjacent workflows, this increases the risk of credential leakage, misuse, and loss of audit control.

Credential Access

High

• Category: Privilege Escalation

Content

| **Text Secrets** | API keys, passwords, tokens | Quick credential sharing |
| **Config Files** | `.env`, `config.json`, `settings.yaml` | Share environment configs securely |
| **Private Keys** | SSH keys, TLS certificates, PGP keys | Temporary key distribution |
| **Credentials Files** | `credentials.json`, `.netrc` | Service account access |

## Security Model

• Confidence: 95% confidence
• Finding: Promoting credentials.json as a routine shareable file encourages distribution of service-account or API credentials that may provide broad, persistent access. Because the skill is specifically designed to move secrets through chat-adjacent workflows, this increases the risk of credential leakage, misuse, and loss of audit control.

Credential Access

High

• Category: Privilege Escalation

Content

|----------|---------|
| API Key Sharing | "I need to share my OpenAI API key with a teammate" |
| Database Credentials | "Send the DB password to the new developer" |
| OAuth Tokens | "Share this access token with the integration team" |
| **Config File Sharing** | "I need to share my `.env` file securely" |
| **SSH Key Distribution** | "Send the deploy key to the DevOps team" |
| **Certificate Sharing** | "Share the TLS certificate with the infra team" |

• Confidence: 87% confidence
• Finding: The use-case examples normalize sharing access tokens and deploy keys through the tool, which may be appropriate in rare cases but is risky without constraints. In this context, the skill lacks strong warnings about token scope, expiry, revocation, recipient validation, and organizational controls, making accidental credential exposure more likely.

Credential Access

High

• Category: Privilege Escalation

Content

Examples:
```bash
# Share an .env file
snappwd put-file ./.env

# Share an SSH key

• Confidence: 83% confidence
• Finding: The example to share a .env file encourages transferring a file that commonly contains multiple secrets such as API keys, database passwords, and tokens. This is dangerous because it promotes bulk disclosure of sensitive material and increases blast radius if the link is mishandled, logged, or sent to the wrong recipient.

Credential Access

High

• Category: Privilege Escalation

Content

Examples:
```bash
# Share an .env file
snappwd put-file ./.env

# Share an SSH key
snappwd put-file ~/.ssh/id_rsa

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

snappwd put-file ./.env

# Share an SSH key
snappwd put-file ~/.ssh/id_rsa

# Share a config file
snappwd put-file ./config/credentials.json

• Confidence: 97% confidence
• Finding: The example instructs users to share a private SSH key file (~/.ssh/id_rsa), which is one of the most sensitive credential types and can directly enable unauthorized access to systems if disclosed. Even if the transport is encrypted, the documentation encourages exfiltration and redistribution of long-lived authentication material that should generally never be moved this way.

Credential Access

High

• Category: Privilege Escalation

Content

snappwd put-file ~/.ssh/id_rsa

# Share a config file
snappwd put-file ./config/credentials.json
```

### Retrieve a Secret

• Confidence: 89% confidence
• Finding: The credentials.json example promotes sharing a likely credential-bearing configuration file, which may contain API keys, service account data, or other reusable secrets. In the context of a secret-sharing skill, this broadens the pattern of encouraging users to package and transmit whole secret stores instead of minimizing exposure to the smallest necessary secret.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger description is extremely broad and explicitly activates on generic phrases about sharing secrets, passwords, files, or credentials in many contexts. That increases the chance of unintended invocation and can steer users toward moving highly sensitive material into a third-party secret-sharing workflow without sufficient validation of recipient, destination, or policy constraints.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly demonstrates sharing highly sensitive files such as .env files, private SSH keys, and credential stores without any warning, validation, or guardrails. In a skill whose purpose is to move secrets around, normalizing direct sharing of these artifacts increases the likelihood of credential exposure, accidental exfiltration, and unsafe operational behavior by users or downstream agents.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends the provided secret to an external service via the `snappwd` CLI without giving the user an explicit warning immediately before transmission or requiring confirmation. Because this skill is specifically triggered for passwords, API keys, tokens, credentials, and `.env` files, users may disclose highly sensitive material to a third-party network service without fully understanding the trust boundary or retention/security implications.

Static analysis

No suspicious patterns detected.