Vincent - Credentials

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:20 PM UTC
• Version: 1.0.69

Overview

This skill has a coherent credential-management purpose, but it uses high-impact secret handling with under-scoped and under-disclosed execution paths.

Review before installing. Use this only if you trust the Vincent service and the @vincentai/cli package, prefer the dashboard flow where the agent never receives the secret, avoid the documented --value command for human-supplied credentials, pin or preinstall a reviewed CLI version, restrict writes to an intended project .env file, and ensure .env files are gitignored and permission-limited.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:91
• Finding: Mutable npm Package Is Downloaded and Executed for Credential Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 91, 100, 115-126, 172-180, and 221 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash npx @vincentai/cli@latest secret list --type CREDENTIALS ``` ```bash npx @vincentai/cli@latest secret create --type CREDENTIALS --memo "Acme API credentials" ``` ```bash npx @vincentai/cli@latest secret set-value --key-id <KEY_ID> --value '{"username": "alice", "password": "hunter2"}' ``` ```bash npx @vincentai/cli@latest secret set-value --key-id <KEY_ID> --value "sk-my-third-party-api-key" ``` ```bash npx @vincentai/cli@latest secret env --key-id <KEY_ID> --env-var ACME_API_KEY ``` ```bash npx @vincentai/cli@latest secret relink --token <TOKEN_FROM_USER> ``` ### Technical Analysis The Skill repeatedly instructs the agent to run `npx @vincentai/cli@latest`. The `latest` npm tag is mutable and may resolve to a different package version each time a command is executed. In addition, `npx` can download and execute the package automatically when it is not already available locally. The reviewed project does not include the CLI implementation, an npm lockfile, an integrity hash, or an exact audited package version. Consequently, the executable code that performs credential creation, credential transmission, API-key persistence, secret retrieval, and `.env` modification is outside the reviewed artifact and can change after this Skill has been audited. This is particularly sensitive because the package operates while secrets, re-link tokens, persisted Vincent API keys, and writable project files may be accessible. Although use of a third-party credential service is consistent with the Skill's stated purpose, executing a mutable package exceeds the minimum risk necessary to implement that functionality. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another component of the package supply chain. 2. The ...[truncated 1405 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every `@latest` reference with an exact, reviewed package version. 2. Install the dependency through a committed lockfile and enforce npm integrity verification. 3. Avoid automatic package download and execution during sensitive credential operations. 4. Prefer a preinstalled, verified CLI artifact or vendor the relevant implementation for review. 5. Pin the package tarball or executable with a cryptographic checksum and reject integrity mismatches. 6. Run the CLI with restricted filesystem and network permissions, allowing access only to the required target file, credential store, and documented service endpoint. 7. Establish release signing, provenance verification, dependency scanning, and controlled update review. 8. Re-audit the CLI implementation, because the claims concerning endpoint exclusivity, TLS usage, output suppression, file permissions, and overwrite protection cannot be verified from `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:115
• Finding: Raw Credentials Are Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 115-121 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```bash npx @vincentai/cli@latest secret set-value --key-id <KEY_ID> --value '{"username": "alice", "password": "hunter2"}' ``` ```bash npx @vincentai/cli@latest secret set-value --key-id <KEY_ID> --value "sk-my-third-party-api-key" ``` ### Technical Analysis The documented agent-operated workflow places raw passwords, API keys, SSH private keys, or OAuth tokens directly in the `--value` command-line argument. Command-line arguments are not an appropriate secret-input channel. Depending on the host environment, arguments may be exposed through: - Agent transcripts and tool-call records. - Shell history. - Debugging, observability, or command telemetry. - Process-list or operating-system process inspection. - Error reports and wrapper-script logging. - Audit records retained after command completion. This behavior contradicts the Skill's broad statements that credential values never appear in the agent's context and that the workflow avoids exposing values. The dashboard-based workflow can avoid this issue, but the documented “Option B” explicitly requires the agent to possess and interpolate the secret into a command. ### Attack Path 1. The agent obtains a password, API key, OAuth token, SSH key, or structured credential. 2. Following the documented workflow, it inserts the credential into the `--value` argument. 3. The agent framework, shell, operating system, telemetry layer, or process monitor records or exposes the complete command line. 4. A local user, support operator, log reader, compromised monitoring service, or later session retrieves the retained argument. 5. The attacker uses the recovered credential to authenticate to the associated third-party service or system. ### Impact Assessment The impact is determined by the authority of the exposed credential and ...[truncated 546 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the command-line `--value` workflow for raw secrets. 2. Make the owner-controlled dashboard workflow the default and only documented mechanism when the agent does not need to possess the value. 3. If local agent submission is essential, accept the secret through protected standard input or an interactive no-echo prompt rather than a command-line argument. 4. Ensure the CLI does not log, echo, serialize, or include secret input in errors or telemetry. 5. If a temporary file is unavoidable, create it with exclusive `0600` permissions in a protected directory, avoid predictable names, and securely remove it immediately after use. 6. Disable shell tracing and command-history recording around credential operations. 7. Prevent agent frameworks and command wrappers from retaining secret-bearing input in transcripts or tool-call logs. 8. Add explicit warnings that agent-operated submission causes the value to enter the agent's context and should not be used for credentials supplied by a human. 9. Rotate any credential that has already been passed through a logged command-line argument. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Credential Access

High

• Category: Privilege Escalation

Content

name: Vincent - Credentials for agents
description: |
  Secure credential management for agents. Use this skill when users need to store API keys,
  passwords, OAuth tokens, or SSH keys and write them to .env files without exposing values.
  Triggers on "store credentials", "API key", "manage secrets", "write to env", ".env file",
  "credential", "password", "token storage".
allowed-tools: Read, Write, Bash(npx:@vincentai/cli*)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

name: Vincent - Credentials for agents
description: |
  Secure credential management for agents. Use this skill when users need to store API keys,
  passwords, OAuth tokens, or SSH keys and write them to .env files without exposing values.
  Triggers on "store credentials", "API key", "manage secrets", "write to env", ".env file",
  "credential", "password", "token storage".
allowed-tools: Read, Write, Bash(npx:@vincentai/cli*)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

npx @vincentai/cli@latest secret set-value --key-id <KEY_ID> --value "sk-my-third-party-api-key"
```

### 4. Write to .env File

Once the value is set (by the user or the agent), use the CLI to write it to a `.env` file. **The value is never printed to stdout.**

• Confidence: 90% confidence
• Finding: This section instructs writing credentials into a `.env` file while strongly reassuring that values are not printed to stdout, but it downplays the fact that the secret is still being persisted to disk. In context, the danger is not mere credential handling but normalizing disk storage of sensitive values without a strong caution about local exposure, backups, and accidental inclusion in artifacts.

Credential Access

High

• Category: Privilege Escalation

Content

npx @vincentai/cli@latest secret env --key-id <KEY_ID> --env-var DB_PASSWORD --field password

# Write to a specific path (default: ./.env)
npx @vincentai/cli@latest secret env --key-id <KEY_ID> --env-var SERVICE_TOKEN --path ./config/.env
```

The command outputs a confirmation JSON (without the value) so the agent knows it succeeded:

• Confidence: 91% confidence
• Finding: Allowing a caller to specify an arbitrary `--path` for where secrets are written increases the risk of placing credentials into insecure or unintended files and directories. In a skill context with `Write` and `Bash` capability, this flexibility can lead to secret sprawl, accidental exposure, or overwriting sensitive configuration outside the expected project `.env` location.

Credential Access

High

• Category: Privilege Escalation

Content

```json
{
  "written": "ACME_API_KEY",
  "path": "/path/to/.env",
  "type": "API_KEY"
}
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```json
{
  "written": "ACME_API_KEY",
  "path": "/path/to/.env",
  "type": "API_KEY"
}
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 2. Tell the user to claim and set the value via the dashboard

# 3. Once set, write individual fields to .env
npx @vincentai/cli@latest secret env --key-id abc-123 --env-var ACME_USERNAME --field username
npx @vincentai/cli@latest secret env --key-id abc-123 --env-var ACME_PASSWORD --field password

• Confidence: 90% confidence
• Finding: This example explicitly encourages writing individual credential fields, including a password, into `.env`, which increases the chance of long-lived plaintext secret storage in common developer paths. In the context of an agent skill, that is materially risky because such files are often copied, backed up, or accidentally committed despite best intentions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad terms such as `credential` and `password`, which can cause the skill to activate in many contexts where the user did not intend secret-storage or disk-write behavior. Over-broad activation is more dangerous here because the skill is explicitly designed to handle sensitive data and write to `.env` files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill emphasizes that values stay out of the agent context, but it does not prominently warn that writing secrets to `.env` still places them on disk where other local processes, backups, misconfigured permissions, or future reads may expose them. This framing could lead users to underestimate the residual risk of disk persistence.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill invokes `npx @vincentai/cli` without pinning an exact immutable version, so every execution may fetch and run whatever package version is currently published. In a credential-management skill, this creates a supply-chain risk where a compromised or malicious package update could exfiltrate secrets, claim URLs, API keys, or write unexpected files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command uses `npx @vincentai/cli` without an exact pinned version, allowing arbitrary future package updates to be executed at runtime. Because the skill handles credential creation and stores scoped API keys locally, an upstream package compromise could directly subvert the security model.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Running an unpinned `npx` package in a secrets workflow is dangerous because the package code is fetched at execution time and may change independently of the reviewed skill content. A malicious or hijacked release could capture credential values during create/set/env operations or alter destination paths.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command fetches and executes `@vincentai/cli` without an immutable version, exposing the workflow to package substitution or malicious updates. Since this step can set secret values, compromise here could immediately leak raw credentials despite the skill's claim that they stay out of context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This unpinned CLI invocation is part of the path that writes secrets into `.env`, making a supply-chain compromise especially impactful. A malicious package version could print secrets, send them to an external service, or weaken file permissions while appearing to succeed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Because `npx @vincentai/cli` is not pinned, the behavior of credential extraction and env writing can change unexpectedly over time. In the context of secret-field extraction, this could lead to secret disclosure, path tampering, or silent writes to attacker-chosen env vars.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: An unpinned package reference on a command that accepts a custom `--path` compounds supply-chain risk with file-write capability. If the package is compromised, it may abuse the path parameter to overwrite arbitrary files or place secrets in insecure locations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The example still uses an unpinned `npx` package, and examples often become copy-pasted operational practice. Since this step creates secrets and returns claim URLs and key IDs, a compromised package could harvest onboarding artifacts and persist unauthorized access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This env-write example relies on a dynamically resolved package version, which undermines the trust guarantees central to the skill. In a secrets-handling workflow, executing mutable third-party code is a real vulnerability, not just a documentation issue.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This example repeats the same unpinned runtime dependency issue while extracting a password field into `.env`. A malicious upstream release could directly capture the password or alter the write behavior, defeating the stated security model.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The re-link flow also executes an unpinned package, which is especially risky because it handles re-establishing API access with a one-time token. A compromised package could intercept the relink token and obtain persistent unauthorized access to secret management.

Static analysis

No suspicious patterns detected.