Hoist

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:19 AM UTC
• Version: 0.1.5

Overview

This infrastructure skill is mostly coherent, but it asks agents to install and use an unpinned privileged CLI that can expose secrets and change or destroy live server resources.

Review this before installing. Only use it in a controlled environment, pin and verify the Hoist CLI version instead of installing latest, avoid printing env values or database URLs into chat/logs, prefer stdin or a secrets manager for secret injection, and require explicit confirmation plus backups before any destroy or volume-deletion command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: COMMANDS.md:128

Finding

Unpinned Global Installation of a Privileged Infrastructure CLI

Content

View full analysis

Run: `npm install -g hoist-cli` ``` `COMMANDS.md:128`: ```bash npm install -g hoist-cli@latest # Update to latest version ``` ### Technical Analysis The Skill instructs the agent to install `hoist-cli` globally without specifying a reviewed, immutable version. The explicit use of the mutable `latest` distribution tag makes the installed code dependent on the package registry state at execution time. No lockfile, package integrity hash, signature, provenance requirement, or version allowlist is provided. Consequently, the effective executable can change after this Skill has been audited. Global npm installation may also execute package lifecycle scripts with the permissions of the account running the agent. This is particularly sensitive because the installed CLI is intended to access cloud-provider credentials, connect to servers over SSH, create or destroy infrastructure, deploy applications, and manage databases and environment variables. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, the registry publication process, or a future release. 2. The attacker publishes a malicious version under the `latest` tag or otherwise changes the version resolved by the unpinned package request. 3. The agent follows the Skill instructions and executes: ```bash npm install -g hoist-cli ``` or: ```bash npm install -g hoist-cli@latest ``` 4. Malicious package installation code or the replaced CLI e ...[truncated 886 chars]

Remediation

View remediation

``` 2. Do not recommend `@latest` for automated or agent-driven installation. 3. Record and verify the expected package integrity hash or signed provenance before installation. 4. Maintain a version allowlist and require a separate review before updating it. 5. Prefer installation in an isolated environment rather than globally on the agent host. 6. Disable npm lifecycle scripts during installation where compatible: ```bash npm install -g --ignore-scripts hoist-cli@ ``` 7. If lifecycle scripts are required, review them and run installation with minimal filesystem and network permissions. 8. Use short-lived, least-privileged provider credentials so compromise of the CLI cannot grant unrestricted infrastructure access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: COMMANDS.md:87

Finding

Plaintext Secrets Exposed Through Structured Output and Command-Line Arguments

Content

View full analysis

[--server ] # Connection string, status ``` `COMMANDS.md:87-92`: ```bash hoist env set KEY=VAL KEY2=VAL2 # Server auto-resolved from hoist.json hoist env get hoist env list # Returns real values in JSON mode hoist env delete hoist env import .env hoist env export ``` `SKILL.md:170-172`: ```text 1. `hoist template inspect ` - get credentials and the connection string 2. `hoist env set DATABASE_URL=` - inject it into the app 3. `hoist template public --server ` - only if the user explicitly needs public access ``` ### Technical Analysis The command reference states that `hoist env list` returns real environment-variable values in JSON mode. It also documents commands that retrieve or export individual and bulk environment values. Since the Skill is designed for non-TTY agent execution with structured JSON output, these plaintext values can be captured by tool output, agent transcripts, telemetry, debugging systems, or execution logs. The deployment procedure additionally instructs the agent to retrieve database credentials and then place the full connection string directly in a command argument: ```bash hoist env set DATABASE_URL= ``` Secrets supplied through command-line arguments may be exposed through process inspection, audit systems, command logging, shell history, or orchestration telemetry. Although the documentation elsewhere mentions stdin for environment assignment, the database workflow does not use that safer mechanism. The ...[truncated 1972 chars]

Remediation

View remediation

--stdin ``` The CLI should define a non-ambiguous stdin format that does not require the secret in argv. 6. Prefer provider-side secret references or protected temporary file descriptors over plaintext environment values. 7. If temporary files are unavoidable, create them with mode `0600`, store them outside shared directories, and securely delete them immediately after use. 8. Add output-level secret masking to the CLI and the agent integration before data reaches transcript or telemetry systems. 9. Restrict transcript, audit-log, and telemetry access and define short retention periods. 10. Rotate any credential that may already have appeared in command history, process telemetry, or agent transcripts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

hoist template destroy <name> ... [--delete-volumes] can permanently remove database/service instances and associated storage, but the documentation does not emphasize the resulting data loss. In an agent context, terse command references increase the chance that an automated system executes a destructive operation without sufficient human awareness or backup validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The env commands explicitly note that hoist env list returns real values in JSON mode and also support env get and env export, which can expose live secrets such as API keys, database passwords, and tokens. In an agent-operated environment, documenting these commands without clear secret-handling warnings increases the risk of credential disclosure into logs, transcripts, downstream tools, or untrusted outputs.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The environment-variable management section includes .env import/export and commands that retrieve real secret values, which creates a clear credential-access capability. In this skill context, the danger is elevated because the CLI is explicitly designed for agents and structured JSON output, making it easier for an automated workflow to collect and propagate secrets at scale if not tightly constrained.

Content

Scanner excerpt · COMMANDS.md (reported line 93)May include surrounding context.

hoist env get hoist env list # Returns real values in JSON mode hoist env delete hoist env import .env hoist env export

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · DOCKERFILES.md (reported line 209)May include surrounding context.

md

ENV PYTHONUNBUFFERED=1
RUN adduser --system --uid 1001 app
COPY --from=builder /app/wheels /wheels
RUN pip install --no-cache /wheels/* && rm -rf /wheels
COPY . .
USER app
EXPOSE 8000

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · DOCKERFILES.md (reported line 209)May include surrounding context.

md

ENV PYTHONUNBUFFERED=1
RUN adduser --system --uid 1001 app
COPY --from=builder /app/wheels /wheels
RUN pip install --no-cache /wheels/* && rm -rf /wheels
COPY . .
USER app
EXPOSE 8000

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · DOCKERFILES.md (reported line 209)May include surrounding context.

md

ENV PYTHONUNBUFFERED=1
RUN adduser --system --uid 1001 app
COPY --from=builder /app/wheels /wheels
RUN pip install --no-cache /wheels/* && rm -rf /wheels
COPY . .
USER app
EXPOSE 8000

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · DOCKERFILES.md (reported line 261)May include surrounding context.

md

ENV PYTHONUNBUFFERED=1
RUN adduser --system --uid 1001 app
COPY --from=builder /app/wheels /wheels
RUN pip install --no-cache /wheels/* && rm -rf /wheels
COPY . .
USER app
EXPOSE 8000

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DOCKERFILES.md (reported line 320)May include surrounding context.

md

environment:
      - NODE_ENV=production
    env_file:
      - .env.production
    deploy:
      resources:
        limits:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DOCKERFILES.md (reported line 378)May include surrounding context.

secrets: db_password: file: ./secrets/db_password.txt

text

**Docker Compose best practices:**

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · DOCKERFILES.md (reported line 393)May include surrounding context.

md

## Security

- **Never expose Docker socket** (`-v /var/run/docker.sock`) to containers
- **Never use `--privileged`**
- **Drop all capabilities:** `docker run --cap-drop all --cap-add CHOWN`
- **Read-only filesystem:** `docker run --read-only --tmpfs /tmp`

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · DOCKERFILES.md (reported line 394)May include surrounding context.

md

## Security

- **Never expose Docker socket** (`-v /var/run/docker.sock`) to containers
- **Never use `--privileged`**
- **Drop all capabilities:** `docker run --cap-drop all --cap-add CHOWN`
- **Read-only filesystem:** `docker run --read-only --tmpfs /tmp`
- **No new privileges:** `docker run --security-opt=no-new-privileges`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents automatic detection and use of provider API keys from environment variables, but it does not include any warning about handling sensitive credentials or avoiding accidental exposure. Because this file is user-facing command documentation, the omission leaves privacy/security implications undisclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The command reference includes hoist server destroy but does not warn that it can permanently remove infrastructure or data. In markdown skill documentation, destructive operations that affect user systems should be clearly disclosed so users understand the risk before invoking them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Application and proxy logs can contain credentials, tokens, personal data, or operational secrets, especially when streamed in real time. The markdown lists these commands as routine troubleshooting steps without disclosing the privacy/security risk of viewing or sharing log output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.