Security audit

TinkerClaw Backlink Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed backlink-auditing tool with optional, scoped network and credential use that matches its stated purpose.

Before installing, confirm you are comfortable with optional calls to GitHub via gh and backlinks.sh, possible paid backlinks.sh usage, and opt-in writes to your OpenClaw state or control-panel store. Replace the shipped example allowlist and historical dataset with your own data before using write options.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (72)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
Read `references/sources.md` before picking — it has the auth setup, the backlinks.sh signup/limits, how to export the GSC CSV, and the per-source caveats.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
Read `references/sources.md` before picking — it has the auth setup, the backlinks.sh signup/limits, how to export the GSC CSV, and the per-source caveats.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/sources.md (reported line 15)May include surrounding context.
md
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/backlink-audit.mjs (reported line 87)May include surrounding context.
js
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/backlink-audit.mjs (reported line 94)May include surrounding context.
js
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tests/test-credentials.sh (reported line 19)May include surrounding context.
sh
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tests/test-credentials.sh (reported line 72)May include surrounding context.
sh
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tests/test-credentials.sh (reported line 86)May include surrounding context.
sh
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tests/test-credentials.sh (reported line 102)May include surrounding context.
sh
- Target: a bare domain (`thetinkerzone.com`). - Endpoint: `GET https://api.backlinks.sh/v1/backlinks?target=<domain>`, header `x-api-key: <key>`. That URL is a constant in the script — it is the only host this skill ever contacts on its own. - Auth: a backlinks.sh API key. Sign up at https://backlinks.sh — **3 free calls**, then pay-as-you-go (~$0.01/call, no subscription). This is the only paid thing in the skill, and only the `backlinks` source spends it. - **Where the key lives**: the `BACKLINKS_SH_API_KEY` env var, or your OS keychain (`secret-tool` on Linux, `security` on macOS; service `backlinks-sh`, account `api-key`). Nowhere else — there is no plaintext-file fallback. If no keychain is available, `--login` refuses and writes nothing. A `~/.config/backlinks-sh/credentials.json` left by an older version is detected only to explain why it stopped working; it is never used to authenticate. - Store it: `printf %s "$KEY" | node scripts/backlink-audit.mjs --login` (stdin, never argv). - Remove it: `node scripts/backlink-audit.mjs --logout` — clears the keychain entry **and** deletes that legacy file if present. Local removal does not revoke the key server-side; rotate it in your backlinks.sh account. - Returns up to ~10k referring domains. Response shape is parsed defensively (backlinks/referring_domains/results array; string or object items). If the live shape differs, adjust `fromBacklinks` in the script.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/sources.md (reported line 17)May include surrounding context.
md
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/backlink-audit.mjs (reported line 21)May include surrounding context.
js
#!/usr/bin/env bash # Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere. # # Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So # every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/backlink-audit.mjs:153