Security audit

Arena Research

Security checks for vulnerabilities and agentic risk

Overview

This Are.na research skill is mostly purpose-aligned, but it asks the agent to load a broad global environment file that may expose unrelated secrets or execute local shell content.

Install only if you are comfortable with the agent loading your global shell environment. Prefer changing the setup to provide only ARENA_ACCESS_TOKEN through a skill-specific env file or per-command environment, and verify the missing referenced CLI files before relying on the skill.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: Unsafe Sourcing of a Global Environment File
Content: View full analysis
Remediation: View remediation
" ``` - If file-based configuration is required, use a dedicated Are.na configuration file containing only `ARENA_ACCESS_TOKEN`. - Parse the configuration file as data rather than executing it as shell code. Reject unknown keys and malformed values. - Restrict the dedicated configuration file to the owning user, such as mode `0600`, and verify its ownership before reading it. - Ensure the CLI does not log tokens, include them in saved research output, or expose them in error messages. - Run the CLI with the minimum necessary environment instead of inheriting unrelated credentials from a global configuration. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to source a global environment file before running commands, which can expose unrelated credentials and sensitive variables to the skill runtime. Even though this skill appears intended to access an Are.na token legitimately, loading a broad shared env file violates least privilege and increases the blast radius if the tool, dependencies, or future modifications are compromised.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.