Tidepool

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:50 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for building and deploying Tidepool web apps, but it gives agents production deployment, secret, database replacement, remote file deletion, and confirmation-skipping workflows without enough guardrails.

Install only if you trust the Tidepool package source and are comfortable letting an agent deploy production web apps. Before using push options, verify the target app, avoid inline secrets when logs or shell history are captured, back up data, and avoid -y, --replace-db, and --sync unless you explicitly intend those production changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Package Is Installed and Immediately Executed

Content

View full analysis

Remediation

View remediation

" ``` 2. Verify package artifacts with cryptographic hashes through a locked requirements file: ```text tidepool== --hash=sha256: ``` Install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Document the canonical package registry, verified publisher identity, source repository, and release-signing process. 4. Separate installation and execution rather than chaining them with `&&`. This allows the package version, origin, files, and signatures to be inspected before running the CLI. 5. Use an isolated virtual environment or disposable container with only the filesystem and credentials required for the task. 6. Review dependency changes before upgrading the pinned version, and use automated dependency and provenance scanning in the release process. 7. Do not expose production secrets or deployment credentials during installation or initial verification. Grant them only when a reviewed operation specifically requires them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Before building anything, fetch the full API reference:

bash

curl -s https://tidepool.sh/api | python3 -m json.tool

This returns every endpoint, every tp.* runtime tool, and usage examples. Read it first.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

| `tp.files` | `.read(name)`, `.write(name, data)`, `.list()`, `.delete(name)` |
| `tp.email()` | `tp.email('[e-mail]', 'Subject', 'body', html='<p>hi</p>')` |
| `tp.http` | `tp.http.get(url)`, `.post(url, json={})` |
| `tp.secrets` | Read-only dict from `tp_data/secrets.json` |
| `tp.state` | Public JSON state, readable at `?format=json` |
| `tp.background()` | `@tp.background(seconds=3600)` for recurring tasks |
| `tp.markdown()` | Convert markdown string to HTML |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

| `tp.files` | `.read(name)`, `.write(name, data)`, `.list()`, `.delete(name)` |
| `tp.email()` | `tp.email('[e-mail]', 'Subject', 'body', html='<p>hi</p>')` |
| `tp.http` | `tp.http.get(url)`, `.post(url, json={})` |
| `tp.secrets` | Read-only dict from `tp_data/secrets.json` |
| `tp.state` | Public JSON state, readable at `?format=json` |
| `tp.background()` | `@tp.background(seconds=3600)` for recurring tasks |
| `tp.markdown()` | Convert markdown string to HTML |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

| `tp.files` | `.read(name)`, `.write(name, data)`, `.list()`, `.delete(name)` |
| `tp.email()` | `tp.email('[e-mail]', 'Subject', 'body', html='<p>hi</p>')` |
| `tp.http` | `tp.http.get(url)`, `.post(url, json={})` |
| `tp.secrets` | Read-only dict from `tp_data/secrets.json` |
| `tp.state` | Public JSON state, readable at `?format=json` |
| `tp.background()` | `@tp.background(seconds=3600)` for recurring tasks |
| `tp.markdown()` | Convert markdown string to HTML |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation advertises --replace-db and --sync as routine workflow steps but does not clearly warn that they can overwrite or delete production data. In an autonomous-agent context, this increases the chance of accidental destructive operations because an agent may execute these commands without understanding the blast radius.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example shows overriding a secret on the command line (--secret STRIPE_KEY=sk_xxx) without warning that shell history, process listings, logs, and transcripts may expose secret values. In an agent-driven CLI environment, this can lead to inadvertent credential leakage even if the platform intends secrets to be handled securely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

tidepool push -y suppresses confirmation for an operation that may include code, database, secret, and file changes to production. In an autonomous agent workflow, removing the last human checkpoint increases the likelihood of unintended deployment or destructive state changes.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

tidepool push --secret STRIPE_KEY=sk_xxx # override a secret tidepool push --replace-db # replace all db keys instead of merging tidepool push --sync # also delete remote files not present locally tidepool push -y # skip confirmation prompt

text

## Runtime (`import tp`)

Static analysis

No suspicious patterns detected.