ClawHub
Back to skill

Security audit

Ink

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Ink cloud-deployment helper, but it gives agents broad cloud mutation authority with weak safeguards around destructive actions, global CLI installation, and temporary secret handling.

Install only if you are comfortable allowing an agent to manage real Ink infrastructure. Confirm the Ink workspace, project, repository, branch, and exact resource before any mutation; require explicit approval for delete, DNS, and secret replacement operations; prefer a pinned or verified CLI install; and avoid leaving secret files in the working tree.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Global Installation of a Mutable Third-Party CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–30; the instruction is repeated at line 295
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
If the CLI is missing, install it:

npm install -g @mldotink/cli      # npm (macOS, Linux, Windows)
brew install mldotink/tap/ink     # Homebrew (macOS)

Technical Analysis

The skill instructs the agent to install the latest available version of @mldotink/cli globally. It does not pin an audited version, verify a package integrity digest, validate the publisher or provenance, or restrict npm lifecycle scripts.

Because the package reference is mutable, the code installed when the skill is invoked may differ from the code that existed when the skill was audited. npm packages can execute lifecycle scripts during installation. A compromised publisher account, malicious release, registry compromise, or compromised transitive dependency could therefore cause attacker-controlled code to execute locally.

The global installation also modifies the user's persistent tool environment rather than using a project-scoped or isolated dependency. The Homebrew alternative similarly references an external mutable tap without pinning or integrity verification.

Attack Path

  1. An attacker compromises the package publisher, distribution account, external tap, or a relevant dependency.
  2. The attacker publishes a malicious version under the expected package name.
  3. The agent finds that ink is not installed and follows the skill instruction.
  4. npm install -g @mldotink/cli resolves the current mutable package release.
  5. Malicious package code or a lifecycle script executes with the privileges of the user running the agent.
  6. The installed global executable remains available for later ink operations and may intercept authentication data, source code, database tokens, or deploymen ...[truncated 680 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specific version that has been reviewed, such as @mldotink/cli@X.Y.Z.
  • Verify the package's expected integrity digest, publisher identity, provenance, and release signatures before installation.
  • Prefer a project-local or isolated installation over a global installation.
  • Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup operations.
  • Use a trusted lockfile and integrity metadata for repeatable installation.
  • Pin and verify the Homebrew formula or commit rather than consuming an unrestricted mutable tap.
  • Require explicit user approval before installing or upgrading external executable dependencies.
  • Revalidate the installed executable path and version before sending credentials or performing cloud operations.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:77
Finding

Secrets Written to a Predictable Plaintext File with Non-Guaranteed Cleanup

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77–88; the pattern is repeated at lines 195–204
Vulnerability Type: Insecure temporary-file handling and plaintext credential exposure
Risk Level: Medium

Vulnerable Code

bash
# From stdin (preferred for agents)
cat > .env.secrets <<EOF
DATABASE_URL=libsql://my-db-myworkspace.turso.io
DATABASE_AUTH_TOKEN=eyJhbG...
API_KEY=sk_live_xxx
EOF
ink secrets import my-app --file .env.secrets
rm .env.secrets

Technical Analysis

Despite being described as a stdin-based workflow, the example writes sensitive credentials to a predictable .env.secrets file in the current working directory. The file's permissions depend on the process umask, and the instructions do not establish a restrictive mode such as 0600.

The cleanup is a separate ordinary command rather than an exit or signal trap. Consequently, interruption, process termination, agent failure, or an incomplete workflow can leave the file on disk. A predictable file in a project directory may also be observed by local processes, indexing or backup software, development tools, or version-control operations. Ordinary deletion does not remove copies already captured by such systems.

If the workflow runs in a directory writable by another local user or process, predictable naming also creates file-manipulation risks. For example, a pre-existing symbolic link could redirect the shell output to another file writable by the invoking user.

Attack Path

  1. The agent obtains a database authentication token, API key, or other deployment credential.
  2. Following the documented workflow, it creates .env.secrets in the current directory using normal shell redirection.
  3. The file is created with permissions derived from the current umask and remains present while the import runs.
  4. A local process or user with sufficient filesystem access reads the predictable file, or repository, ...[truncated 1045 chars]
Remediation
View remediation

Remediation Suggestions

  • Avoid writing secrets to disk when the CLI supports importing them directly from standard input.
  • If a file is required, create it using mktemp in a trusted directory rather than using a predictable project-relative name.
  • Set a restrictive umask and enforce owner-only permissions before writing credentials.
  • Register cleanup before writing the secret so it runs on normal exit and common interruption signals.
  • Reject symbolic links and avoid operating in directories writable by untrusted users.
  • Add secret-file patterns to .gitignore and exclusions for backup, synchronization, and indexing systems.
  • Keep the file lifetime as short as possible and verify that cleanup succeeded.
  • A hardened pattern should follow this structure:
bash
umask 077
secret_file="$(mktemp)"
trap 'rm -f -- "$secret_file"' EXIT HUP INT TERM
cat > "$secret_file" <<EOF
DATABASE_URL=...
DATABASE_AUTH_TOKEN=...
EOF
ink secrets import my-app --file "$secret_file"

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash
# From file
ink secrets import my-app --file .env

# From stdin (preferred for agents)
cat > .env.secrets <<EOF

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: ink
description: >
  Deploy and manage cloud services on Ink (ml.ink): create projects, deploy
  services, provision databases, manage DNS and custom domains, configure
  workspaces, and monitor deployments. Use this skill whenever the user mentions
  Ink, ml.ink, deployments, services, databases, or cloud infrastructure on Ink,

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance is overly broad and instructs use of the skill whenever the user mentions generic deployment, services, databases, or cloud infrastructure concepts. In an agentic environment, this can cause the Ink skill to trigger on unrelated requests and perform actions in the wrong provider or account context, increasing the chance of unauthorized or unintended infrastructure changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents destructive operations such as deleting services and databases without requiring a warning, dry run, or explicit user confirmation. In an autonomous agent setting, this materially raises the risk of irreversible production outages or data loss from misunderstanding, prompt injection, or simple targeting mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

DNS deletion is presented as a routine operation with no warning about traffic interruption, domain validation breakage, or service downtime. Because DNS changes can immediately disrupt application reachability or email/service integrations, omission of confirmation safeguards makes accidental damage more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.