Ink

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:14 PM UTC
• Version: 0.1.0

Overview

The skill is mostly a coherent Ink cloud-deployment helper, but it gives agents broad cloud mutation authority with weak safeguards around destructive actions, global CLI installation, and temporary secret handling.

Install only if you are comfortable allowing an agent to manage real Ink infrastructure. Confirm the Ink workspace, project, repository, branch, and exact resource before any mutation; require explicit approval for delete, DNS, and secret replacement operations; prefer a pinned or verified CLI install; and avoid leaving secret files in the working tree.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Global Installation of a Mutable Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md`, lines 25–30; the instruction is repeated at line 295 **Vulnerability Type**: Unverified and unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash If the CLI is missing, install it: npm install -g @mldotink/cli # npm (macOS, Linux, Windows) brew install mldotink/tap/ink # Homebrew (macOS) ``` ### Technical Analysis The skill instructs the agent to install the latest available version of `@mldotink/cli` globally. It does not pin an audited version, verify a package integrity digest, validate the publisher or provenance, or restrict npm lifecycle scripts. Because the package reference is mutable, the code installed when the skill is invoked may differ from the code that existed when the skill was audited. npm packages can execute lifecycle scripts during installation. A compromised publisher account, malicious release, registry compromise, or compromised transitive dependency could therefore cause attacker-controlled code to execute locally. The global installation also modifies the user's persistent tool environment rather than using a project-scoped or isolated dependency. The Homebrew alternative similarly references an external mutable tap without pinning or integrity verification. ### Attack Path 1. An attacker compromises the package publisher, distribution account, external tap, or a relevant dependency. 2. The attacker publishes a malicious version under the expected package name. 3. The agent finds that `ink` is not installed and follows the skill instruction. 4. `npm install -g @mldotink/cli` resolves the current mutable package release. 5. Malicious package code or a lifecycle script executes with the privileges of the user running the agent. 6. The installed global executable remains available for later `ink` operations and may intercept authentication data, source code, database tokens, or deploymen ...[truncated 680 chars]
• Remediation: ## Remediation Suggestions - Pin the CLI to a specific version that has been reviewed, such as `@mldotink/cli@X.Y.Z`. - Verify the package's expected integrity digest, publisher identity, provenance, and release signatures before installation. - Prefer a project-local or isolated installation over a global installation. - Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup operations. - Use a trusted lockfile and integrity metadata for repeatable installation. - Pin and verify the Homebrew formula or commit rather than consuming an unrestricted mutable tap. - Require explicit user approval before installing or upgrading external executable dependencies. - Revalidate the installed executable path and version before sending credentials or performing cloud operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:77
• Finding: Secrets Written to a Predictable Plaintext File with Non-Guaranteed Cleanup## Vulnerability Details **File Location**: `SKILL.md`, lines 77–88; the pattern is repeated at lines 195–204 **Vulnerability Type**: Insecure temporary-file handling and plaintext credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash # From stdin (preferred for agents) cat > .env.secrets <<EOF DATABASE_URL=libsql://my-db-myworkspace.turso.io DATABASE_AUTH_TOKEN=eyJhbG... API_KEY=sk_live_xxx EOF ink secrets import my-app --file .env.secrets rm .env.secrets ``` ### Technical Analysis Despite being described as a stdin-based workflow, the example writes sensitive credentials to a predictable `.env.secrets` file in the current working directory. The file's permissions depend on the process umask, and the instructions do not establish a restrictive mode such as `0600`. The cleanup is a separate ordinary command rather than an exit or signal trap. Consequently, interruption, process termination, agent failure, or an incomplete workflow can leave the file on disk. A predictable file in a project directory may also be observed by local processes, indexing or backup software, development tools, or version-control operations. Ordinary deletion does not remove copies already captured by such systems. If the workflow runs in a directory writable by another local user or process, predictable naming also creates file-manipulation risks. For example, a pre-existing symbolic link could redirect the shell output to another file writable by the invoking user. ### Attack Path 1. The agent obtains a database authentication token, API key, or other deployment credential. 2. Following the documented workflow, it creates `.env.secrets` in the current directory using normal shell redirection. 3. The file is created with permissions derived from the current umask and remains present while the import runs. 4. A local process or user with sufficient filesystem access reads the predictable file, or repository, ...[truncated 1045 chars]
• Remediation: ## Remediation Suggestions - Avoid writing secrets to disk when the CLI supports importing them directly from standard input. - If a file is required, create it using `mktemp` in a trusted directory rather than using a predictable project-relative name. - Set a restrictive umask and enforce owner-only permissions before writing credentials. - Register cleanup before writing the secret so it runs on normal exit and common interruption signals. - Reject symbolic links and avoid operating in directories writable by untrusted users. - Add secret-file patterns to `.gitignore` and exclusions for backup, synchronization, and indexing systems. - Keep the file lifetime as short as possible and verify that cleanup succeeded. - A hardened pattern should follow this structure: ```bash umask 077 secret_file="$(mktemp)" trap 'rm -f -- "$secret_file"' EXIT HUP INT TERM cat > "$secret_file" <<EOF DATABASE_URL=... DATABASE_AUTH_TOKEN=... EOF ink secrets import my-app --file "$secret_file" ```

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: ink
description: >
  Deploy and manage cloud services on Ink (ml.ink): create projects, deploy
  services, provision databases, manage DNS and custom domains, configure
  workspaces, and monitor deployments. Use this skill whenever the user mentions
  Ink, ml.ink, deployments, services, databases, or cloud infrastructure on Ink,

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation guidance is overly broad and instructs use of the skill whenever the user mentions generic deployment, services, databases, or cloud infrastructure concepts. In an agentic environment, this can cause the Ink skill to trigger on unrelated requests and perform actions in the wrong provider or account context, increasing the chance of unauthorized or unintended infrastructure changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents destructive operations such as deleting services and databases without requiring a warning, dry run, or explicit user confirmation. In an autonomous agent setting, this materially raises the risk of irreversible production outages or data loss from misunderstanding, prompt injection, or simple targeting mistakes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: DNS deletion is presented as a routine operation with no warning about traffic interruption, domain validation breakage, or service downtime. Because DNS changes can immediately disrupt application reachability or email/service integrations, omission of confirmation safeguards makes accidental damage more likely.

Static analysis

No suspicious patterns detected.