xfire Security PR Review

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:25 AM UTC
• Version: 0.1.2

Overview

The skill does what it says: it runs a security-review tool that may send code to external AI providers, so private code and tokens need care.

Install and run this only in repositories where sending code to the selected AI providers is acceptable. Use narrowly scoped, preferably short-lived API and GitHub tokens, avoid exposing unnecessary provider keys, consider pinning or verifying the xfire package version, and keep cache/debug/result files out of commits and CI artifacts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:44

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md:44
Vulnerability Type: Unpinned dependency installation from the default Python package index
Risk Level: Medium

Vulnerable Code

bash

pip install xfire

Technical Analysis

The installation instruction retrieves and installs xfire without specifying an audited version, cryptographic hash, lock file, or explicitly trusted package source. Consequently, the installed artifact can change after this Skill has been reviewed.

This creates a supply-chain risk: compromise of the package publisher account, distribution channel, or a future package release could cause users to install attacker-controlled code. Python packages may execute code during installation, and malicious runtime behavior could also execute when users invoke the installed xfire command.

The risk is particularly relevant because the documented workflow processes repository source code and uses credentials such as ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, and GITHUB_TOKEN.

Attack Path

1. An attacker compromises the xfire package publisher account or its release pipeline and publishes a malicious release.
2. A user follows the documented pip install xfire instruction.
3. Package resolution selects the current malicious release because no trusted version or hash is pinned.
4. Attacker-controlled code executes during installation or when the xfire command is invoked.
5. The malicious package accesses data available to the process, potentially including source repositories, API keys, GitHub credentials, configuration files, and cached review data.
6. The package exfiltrates that data or performs other actions with the invoking user's privileges.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or xfire. Depending on the execution environment, exposed assets may include:

• Source code and Git history from repositories ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a specifically audited release rather than allowing unconstrained resolution:

   bash

   python -m pip install "xfire==<audited-version>"
   

2. Publish cryptographic hashes through a reviewed requirements or lock file and require hash verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate the lock file from a trusted build process, review all transitive dependencies, and commit it to a version-controlled official repository.

4. Link the documentation to the verified official package and source repository. Document publisher identity and package authenticity checks.

5. In CI, install dependencies in an isolated, least-privileged environment without unnecessary credentials. Provide API keys only to the execution step that requires them.

6. Use narrowly scoped, short-lived GitHub and API tokens, restrict outbound network access where feasible, and avoid exposing unrelated repositories or host files to the review process.

7. Establish release signing, protected publisher accounts with multifactor authentication, and automated monitoring for unexpected package releases or dependency changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 438)May include surrounding context.

md

| `ANTHROPIC_API_KEY` | Yes (for Claude API mode) | Anthropic API key for Claude |
| `OPENAI_API_KEY` | For Codex API mode | OpenAI API key for Codex |
| `GOOGLE_API_KEY` | For Gemini API mode | Google API key for Gemini |
| `GITHUB_TOKEN` | For `analyze-pr` | GitHub personal access token |
| `XFIRE_CONFIG_PATH` | No | Override path to config.yaml |
| `XFIRE_CACHE_DIR` | No | Cache directory for context/intent persistence across runs |
| `XFIRE_AUTH_PATH` | No | Override path to auth.json credential store |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that it sends repository code, diffs, PR context, and related materials to three external AI agents, but it does not provide a prominent warning about third-party data disclosure, confidentiality, or suitability for sensitive/private codebases. This creates a real privacy and data-governance risk because users may invoke it on proprietary or regulated code without informed consent about where the data is sent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented cache and debug features indicate persistence of context, intent, and full debug traces, but there is no warning that these artifacts may contain sensitive source code, findings, credentials-adjacent metadata, or model reasoning outputs. This can lead to local exposure through insecure storage, accidental commits, shared workstations, or CI artifact retention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.