Security audit

LastPass CLI Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it gives an agent broad plaintext access to LastPass entries, including raw records, without clear limits or confirmation.

Install only if you are comfortable letting the agent read LastPass entries available to your local lpass session. Prefer a dedicated LastPass account or shared folder with only the needed secrets, avoid raw record retrieval, and require explicit approval before the agent fetches or uses any password or secure note.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: tools/lastpass.sh:6
Finding: Unrestricted Retrieval and Raw Disclosure of LastPass Vault Records
Content: View full analysis
\" [password|username|notes|raw]" >&2 exit 1 fi case "$field" in password) lpass show --password "$name" ;; username) lpass show --username "$name" ;; notes) lpass show --notes "$name" ;; raw) lpass show "$name" ;; *) echo "Unknown field: $field" >&2 exit 1 ;; esac ``` The corresponding interface documentation explicitly exposes raw-record retrieval in `SKILL.md:20-21,29`: ```json { "name": "Exact LastPass entry name", "field": "password | username | notes | raw" } ``` ### Technical Analysis The wrapper accepts an arbitrary caller-controlled LastPass entry name and allows retrieval of passwords, usernames, secure notes, or the entire raw record. It does not enforce an entry allowlist, workflow-specific scope, purpose validation, or user confirmation before accessing sensitive fields. The `raw` option is particularly broad because `lpass show "$name"` can return the complete vault record rather than only the field required by the current operation. Any agent authorized to invoke this Skill therefore inherits read access to records available through the active `lpass` session, including records unrelated to the legitimate automation task. Secrets are also returned directly through standard output. Returning a requested value is intrinsic to the declared functionality, but plaintext output can be captured in agent transcripts, orchestration logs, command output, or downstream tool calls unless the execution environment applies secret-aware handling. The project contains no explicit network request, external destination, or exfiltration routine. Any sy ...[truncated 1468 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly enables retrieval of passwords, usernames, and notes from a local LastPass vault for use in automation flows, but the description does not warn that invoking it may surface sensitive secrets into logs, prompts, downstream tools, or other unintended sinks. In this context, the omission materially increases the chance of accidental secret exposure because the skill is designed to move credentials from a protected store into broader agent execution contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.