T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-examples.md:8- Finding
Secret Exposure Through Unmasked Output, Terminal Capture, and Insecure File Persistence
- Content
View full analysis
- Remediation
View remediation
Security audit
1password Temp
Security checks for vulnerabilities and agentic risk
Overview
This 1Password CLI skill is coherent and not deceptive, but its examples can expose secrets in terminal output or files without enough containment guidance.
Install only if you are comfortable letting the agent operate an authenticated 1Password CLI session. Do not ask it to print passwords, OTPs, keys, or injected configs into chat or terminal output, and avoid examples that use --no-masking or write secret files unless you add strict permissions and cleanup.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
op run --no-masking -- printenv DB_PASSWORDintentionally resolves a secret and prints it in cleartext to stdout with masking disabled. This can leak credentials to terminal scrollback, logs, CI job output, screen recordings, or other monitoring systems, making credential exposure highly likely.- Content
md ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
op run --env-file="./.env" -- printenv DB_PASSWORDstill demonstrates printing a resolved secret to stdout, which exposes the secret even without the explicit--no-maskingflag. In many environments, command output is captured by logs or CI systems, so this pattern normalizes unsafe handling of secrets.- Content
md - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples demonstrate reading secrets, writing secret material to disk, disabling masking, and injecting secrets into files without any safety guidance. In a security-sensitive skill for a password manager CLI, omission of handling warnings increases the chance that users will expose credentials in shells, logs, or world-readable files during normal use.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md - macOS: Settings > Developer > Integrate with 1Password CLI (Touch ID optional). - Windows: turn on Windows Hello, then Settings > Developer > Integrate. - Linux: Settings > Security > Unlock using system authentication, then Settings > Developer > Integrate. - After integration, run any command to sign in (example in docs: `op vault list`). - If multiple accounts: use `op signin` to pick one, or `--account` / `OP_ACCOUNT`. - For non-integration auth, use `op account add`.
Static analysis
No suspicious patterns detected.