Security audit

s1cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Stage1st forum CLI helper, but it documents credential handling and installation patterns that users should review before installing.

Install only if you are comfortable with s1cli and its upstream package source. Prefer a virtual environment, pin or review the exact package/repository version, use the interactive login prompt instead of -p PASS, and avoid letting the agent post, reply, check in, or change config unless you explicitly requested that action.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Third-Party Package and Source Repository Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:13-17 and SKILL.md:34
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip3 install s1cli git clone https://github.com/Geoion/s1cli.git && cd s1cli && pip3 install -e .

Additional dependency installation:

bash
pip3 install "httpx[socks]" socksio

Technical Analysis

The Skill directs users to install executable Python packages without specifying reviewed versions or verifying package hashes. The alternative Git installation clones and installs the mutable default branch rather than a reviewed commit.

Consequently, the code executed by these commands can differ from the code that existed when the Skill was audited. If the PyPI packages, maintainer accounts, release process, Git repository, or referenced default branch are compromised, an attacker could distribute modified installation or runtime code.

Because Python package installation may execute build backend logic, compromise does not necessarily require the user to invoke the installed CLI after installation. Malicious behavior could potentially run during package build or installation.

Attack Path

An attacker compromises an upstream package, package-publishing account, source repository, or dependency release process.

The attacker publishes a malicious release or modifies the repository's default branch.

A user follows the Skill and executes the unpinned pip3 install or Git clone-and-install command.

The package manager retrieves the attacker-controlled version.

Malicious build, installation, or runtime code executes with the privileges of the user running the command.

The malicious code can access resources available to that account, potentially including the forum session file and other user-owned data.

Impact Assessment

Successful exploitation could provide ...[truncated 447 chars]
Remediation: View remediation
Remediation Suggestions

Pin every Python dependency to a reviewed exact version.

Maintain a lock file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes -r requirements.txt.

Replace installation from a mutable Git branch with a reviewed full commit hash.

Verify package provenance, release signatures, repository ownership, and build artifacts before recommending installation.

Install dependencies inside a dedicated virtual environment rather than the user's global Python environment.

Prefer prebuilt, reproducible artifacts from a controlled registry after reviewing their source and dependency graph.

Document the expected package version and periodically repeat the security review before updating that version.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: Forum Password Exposed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:42 and references/commands.md:7
Vulnerability Type: Plaintext credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

In SKILL.md:

bash
python3 -m s1cli login -u USER -p PASS

The command reference provides the equivalent pattern:

bash
python3 -m s1cli login -u <username> -p <password>

Technical Analysis

The documentation encourages users to pass their forum password directly in a command-line argument. Depending on the operating system and execution environment, command arguments may be exposed through shell history, process-listing utilities, process-monitoring systems, terminal transcripts, audit logs, debugging output, or CI/CD logs.

Quoting the password would only affect shell parsing and would not prevent it from being present in the process argument list. The exposure can also persist after the login command exits if the shell or another system records the command.

Attack Path

A user follows the documented non-interactive login example and places the forum password after -p.

The shell records the command in its history, or a process monitor captures the process argument list while the command is running.

Another local user, administrator, monitoring service, log reader, or later attacker with access to the account's history files retrieves the plaintext password.

The exposed credential is used to authenticate to the forum.

The attacker performs actions available to the compromised forum account, such as reading account information, posting, replying, or modifying account-accessible data.

Impact Assessment

Exploitation can disclose the user's forum username and password and may lead to account takeover. The resulting privileges are limited to those held by the affected forum account unless the password was reused elsewhere. Password reuse could expand ...[truncated 221 chars]
Remediation: View remediation
Remediation Suggestions

Remove all examples that pass passwords with the -p command-line option.

Make hidden interactive password entry the documented and preferred authentication method.

If non-interactive authentication is necessary, use a protected secret-input mechanism that does not expose the password in process arguments or logs.

Avoid plaintext credential files. If a credential file is unavoidable, enforce restrictive permissions and document its lifecycle and deletion requirements.

Ensure automation systems use secret stores with log masking and avoid expanding secrets directly into command strings.

Advise users who already used the documented command to remove affected shell-history entries, inspect relevant logs, and rotate the password if exposure is possible.

Warn users not to reuse the forum password on other services.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation description is broad enough to trigger on generic forum-related requests such as browsing, posting, searching, or replying whenever the user mentions S1/Stage1st. Overbroad activation can cause the agent to invoke this skill in unintended contexts, leading to unnecessary command execution, credential prompts, or actions against a real user account on an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings