Vincent - Credentials

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:20 PM UTC
• Version: 1.0.69

Overview

This skill has a coherent credential-management purpose, but it uses high-impact secret handling with under-scoped and under-disclosed execution paths.

Review before installing. Use this only if you trust the Vincent service and the @vincentai/cli package, prefer the dashboard flow where the agent never receives the secret, avoid the documented --value command for human-supplied credentials, pin or preinstall a reviewed CLI version, restrict writes to an intended project .env file, and ensure .env files are gitignored and permission-limited.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:91

Finding

Mutable npm Package Is Downloaded and Executed for Credential Operations

Content

View full analysis

--value '{"username": "alice", "password": "hunter2"}' ``` ```bash npx @vincentai/cli@latest secret set-value --key-id --value "sk-my-third-party-api-key" ``` ```bash npx @vincentai/cli@latest secret env --key-id --env-var ACME_API_KEY ``` ```bash npx @vincentai/cli@latest secret relink --token ``` ### Technical Analysis The Skill repeatedly instructs the agent to run `npx @vincentai/cli@latest`. The `latest` npm tag is mutable and may resolve to a different package version each time a command is executed. In addition, `npx` can download and execute the package automatically when it is not already available locally. The reviewed project does not include the CLI implementation, an npm lockfile, an integrity hash, or an exact audited package version. Consequently, the executable code that performs credential creation, credential transmission, API-key persistence, secret retrieval, and `.env` modification is outside the reviewed artifact and can change after this Skill has been audited. This is particularly sensitive because the package operates while secrets, re-link tokens, persisted Vincent API keys, and writable project files may be accessible. Although use of a third-party credential service is consistent with the Skill's stated purpose, executing a mutable package exceeds the minimum risk necessary to implement that functionality. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another component of the package supply chain. 2. The ...[truncated 1405 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:115

Finding

Raw Credentials Are Passed Through Command-Line Arguments

Content

View full analysis

--value '{"username": "alice", "password": "hunter2"}' ``` ```bash npx @vincentai/cli@latest secret set-value --key-id --value "sk-my-third-party-api-key" ``` ### Technical Analysis The documented agent-operated workflow places raw passwords, API keys, SSH private keys, or OAuth tokens directly in the `--value` command-line argument. Command-line arguments are not an appropriate secret-input channel. Depending on the host environment, arguments may be exposed through: - Agent transcripts and tool-call records. - Shell history. - Debugging, observability, or command telemetry. - Process-list or operating-system process inspection. - Error reports and wrapper-script logging. - Audit records retained after command completion. This behavior contradicts the Skill's broad statements that credential values never appear in the agent's context and that the workflow avoids exposing values. The dashboard-based workflow can avoid this issue, but the documented “Option B” explicitly requires the agent to possess and interpolate the secret into a command. ### Attack Path 1. The agent obtains a password, API key, OAuth token, SSH key, or structured credential. 2. Following the documented workflow, it inserts the credential into the `--value` argument. 3. The agent framework, shell, operating system, telemetry layer, or process monitor records or exposes the complete command line. 4. A local user, support operator, log reader, compromised monitoring service, or later session retrieves the retained argument. 5. The attacker uses the recovered credential to authenticate to the associated third-party service or system. ### Impact Assessment The impact is determined by the authority of the exposed credential and ...[truncated 546 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: Vincent - Credentials for agents
description: |
  Secure credential management for agents. Use this skill when users need to store API keys,
  passwords, OAuth tokens, or SSH keys and write them to .env files without exposing values.
  Triggers on "store credentials", "API key", "manage secrets", "write to env", ".env file",
  "credential", "password", "token storage".
allowed-tools: Read, Write, Bash(npx:@vincentai/cli*)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

name: Vincent - Credentials for agents
description: |
  Secure credential management for agents. Use this skill when users need to store API keys,
  passwords, OAuth tokens, or SSH keys and write them to .env files without exposing values.
  Triggers on "store credentials", "API key", "manage secrets", "write to env", ".env file",
  "credential", "password", "token storage".
allowed-tools: Read, Write, Bash(npx:@vincentai/cli*)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This section instructs writing credentials into a .env file while strongly reassuring that values are not printed to stdout, but it downplays the fact that the secret is still being persisted to disk. In context, the danger is not mere credential handling but normalizing disk storage of sensitive values without a strong caution about local exposure, backups, and accidental inclusion in artifacts.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

npx @vincentai/cli@latest secret set-value --key-id <KEY_ID> --value "sk-my-third-party-api-key"

text

### 4. Write to .env File

Once the value is set (by the user or the agent), use the CLI to write it to a `.env` file. **The value is never printed to stdout.**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Allowing a caller to specify an arbitrary --path for where secrets are written increases the risk of placing credentials into insecure or unintended files and directories. In a skill context with Write and Bash capability, this flexibility can lead to secret sprawl, accidental exposure, or overwriting sensitive configuration outside the expected project .env location.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

npx @vincentai/cli@latest secret env --key-id <KEY_ID> --env-var DB_PASSWORD --field password

Write to a specific path (default: ./.env)

npx @vincentai/cli@latest secret env --key-id <KEY_ID> --env-var SERVICE_TOKEN --path ./config/.env

text

The command outputs a confirmation JSON (without the value) so the agent knows it succeeded:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

json

{
  "written": "ACME_API_KEY",
  "path": "/path/to/.env",
  "type": "API_KEY"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

json

{
  "written": "ACME_API_KEY",
  "path": "/path/to/.env",
  "type": "API_KEY"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This example explicitly encourages writing individual credential fields, including a password, into .env, which increases the chance of long-lived plaintext secret storage in common developer paths. In the context of an agent skill, that is materially risky because such files are often copied, backed up, or accidentally committed despite best intentions.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

# 2. Tell the user to claim and set the value via the dashboard

# 3. Once set, write individual fields to .env
npx @vincentai/cli@latest secret env --key-id abc-123 --env-var ACME_USERNAME --field username
npx @vincentai/cli@latest secret env --key-id abc-123 --env-var ACME_PASSWORD --field password

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad terms such as credential and password, which can cause the skill to activate in many contexts where the user did not intend secret-storage or disk-write behavior. Over-broad activation is more dangerous here because the skill is explicitly designed to handle sensitive data and write to .env files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill emphasizes that values stay out of the agent context, but it does not prominently warn that writing secrets to .env still places them on disk where other local processes, backups, misconfigured permissions, or future reads may expose them. This framing could lead users to underestimate the residual risk of disk persistence.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill invokes npx @vincentai/cli without pinning an exact immutable version, so every execution may fetch and run whatever package version is currently published. In a credential-management skill, this creates a supply-chain risk where a compromised or malicious package update could exfiltrate secrets, claim URLs, API keys, or write unexpected files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command uses npx @vincentai/cli without an exact pinned version, allowing arbitrary future package updates to be executed at runtime. Because the skill handles credential creation and stores scoped API keys locally, an upstream package compromise could directly subvert the security model.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Running an unpinned npx package in a secrets workflow is dangerous because the package code is fetched at execution time and may change independently of the reviewed skill content. A malicious or hijacked release could capture credential values during create/set/env operations or alter destination paths.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command fetches and executes @vincentai/cli without an immutable version, exposing the workflow to package substitution or malicious updates. Since this step can set secret values, compromise here could immediately leak raw credentials despite the skill's claim that they stay out of context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This unpinned CLI invocation is part of the path that writes secrets into .env, making a supply-chain compromise especially impactful. A malicious package version could print secrets, send them to an external service, or weaken file permissions while appearing to succeed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Because npx @vincentai/cli is not pinned, the behavior of credential extraction and env writing can change unexpectedly over time. In the context of secret-field extraction, this could lead to secret disclosure, path tampering, or silent writes to attacker-chosen env vars.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

An unpinned package reference on a command that accepts a custom --path compounds supply-chain risk with file-write capability. If the package is compromised, it may abuse the path parameter to overwrite arbitrary files or place secrets in insecure locations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The example still uses an unpinned npx package, and examples often become copy-pasted operational practice. Since this step creates secrets and returns claim URLs and key IDs, a compromised package could harvest onboarding artifacts and persist unauthorized access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This env-write example relies on a dynamically resolved package version, which undermines the trust guarantees central to the skill. In a secrets-handling workflow, executing mutable third-party code is a real vulnerability, not just a documentation issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example repeats the same unpinned runtime dependency issue while extracting a password field into .env. A malicious upstream release could directly capture the password or alter the write behavior, defeating the stated security model.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The re-link flow also executes an unpinned package, which is especially risky because it handles re-establishing API access with a one-time token. A compromised package could intercept the relink token and obtain persistent unauthorized access to secret management.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.