Security audit
Security checks for vulnerabilities and agentic risk
This skill asks to share every website task, but its privacy filter can upload numeric secrets unchanged.
Review before installing. Avoid sensitive-task uploads until numeric redaction is fixed, and explicitly limit which tasks may be shared. Preview each trace with the mask command and inspect the result yourself; the sensitive flag does not stop uploading. Pass only a bare domain to --site. Verify the downloaded client's version and hash. The bundled clients were fully reviewed, but remote download contents and server privacy promises remain unverified.
.Numeric sensitive values bypass redaction before upload
Numeric PINs, verification codes, card numbers, and account identifiers can be disclosed to the trace service. The client also labels the body masked and omits those values from masking counts.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
data = json.dumps(body, ensure_ascii=False).encode("utf-8")
req = urllib.request.Request(url, data=data, headers=headers, method=method)
try:
with _OPENER.open(req, timeout=30) as res:
status, text = res.status, res.read().decode("utf-8", "replace")
except urllib.error.HTTPError as e:
status, text = e.code, e.read().decode("utf-8", "replace")
The unconditional local-masking promise is undermined by numeric sensitive values bypassing masking and the recipe site argument being transmitted unchanged. This can disclose numeric credentials or personal identifiers, or credentials and query parameters if a full URL is supplied as the site; encouraging use for every website task increases exposure.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
re: new RegExp(`(?<![A-Za-z0-9])${value.split(' ').map(escapeRe).join('[ \\t\\r\\n\\u00a0]+')}(?![A-Za-z0-9])`, 'gi'),
}));
privateCache.set(pv, rules);
return rules;
}
function applyPrivate(s, rules, counts) {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
words = value.split(" ")
src = r"(?<!(?-i:[A-Za-z0-9]))" + r"[ \t\r\n\u00a0]+".join(_escape_re(w) for w in words) + r"(?!(?-i:[A-Za-z0-9]))"
rules.append({"label": label, "probe": words[0].lower(), "re": re.compile(src, re.IGNORECASE)})
return rules
def _apply_private(s, rules, counts):
The walker applies forced sensitive-key labels only to strings and returns numeric primitives unchanged, so values such as numeric PINs, OTPs, SSNs, and account numbers survive even under explicitly sensitive keys. These values can then be uploaded or queued locally while the trace is marked masked; a second pass using the same logic does not resolve the defect.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// CLI
// ---------------------------------------------------------------------------
const configDir = () => process.env.WISPTRACE_DIR || path.join(os.homedir(), '.config', 'wisptrace');
const credsPath = () => path.join(configDir(), 'credentials.json');
const privatePath = () => path.join(configDir(), 'private-values.json');
const queueDir = () => path.join(configDir(), 'queue');
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _creds_path():
return os.path.join(_config_dir(), "credentials.json")
def _private_path():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
owner-link private link for your human to see and delete traces
template print an example trace
Files: ${configDir()} (credentials.json, private-values.json, queue/)
Env: WISPTRACE_URL (default ${DEFAULT_URL}), WISPTRACE_DIR (default ~/.config/wisptrace)`;
async function cmdRegister(opts) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
owner-link private link for your human to see and delete traces
template print an example trace
Files: %s (credentials.json, private-values.json, queue/)
Env: WISPTRACE_URL (default %s), WISPTRACE_DIR (default ~/.config/wisptrace)"""
The recursive masking function applies a sensitive-key label only to string values and returns numeric values unchanged, so fields such as {"pin": 1234} or {"ssn": 123456789} survive masking. These values can be uploaded or queued while the trace is marked masked, making the defect especially dangerous in a skill that encourages sharing detailed traces on the assurance that secrets and personal data are removed locally.
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill directs recipe requests and trace uploads for every website task, including tasks where third-party sharing was not specifically requested. Registration and an opt-out provide some protection, but neither clearly establishes informed consent to this broad collection, and masking does not remove all sensitive task context.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.config/wisptrace
curl -fsSL https://wisptrace.com/skill/wisptrace.mjs -o ~/.config/wisptrace/wisptrace.mjs # Node 18+, no dependencies
# or: curl -fsSL https://wisptrace.com/skill/wisptrace.py -o ~/.config/wisptrace/wisptrace.py (Python 3.8+)
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
if isinstance(opts.get(k), str):
body[k] = opts[k]
origin = _base_url(None)
status, d = _api("POST", "/api/v1/agents/register", None, body, auth=False)
if status != 201 or not isinstance(d, dict) or not d.get("api_key"):
raise CliError("register failed (%d): %s" % (status, _explain(status, d)))
_write_private(_creds_path(), _dumps({"api_key": d["api_key"], "agent": d.get("agent"), "claim": d.get("claim"),