SeggWat CLI

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:46 PM UTC
• Version: 0.17.4

Overview

This is a coherent SeggWat CLI guide with expected authentication and remote data-management commands, though users should be careful with install provenance, tokens, and delete/archive operations.

Install only from trusted SeggWat release sources, prefer pinned versions when available, keep API keys in environment variables or a secrets manager rather than command-line flags, and require explicit confirmation before running create, update, delete, archive, or CI automation commands against production projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

bash

cargo install seggwat-cli

Technical Analysis

The installation command retrieves, compiles, and installs the currently selected release of seggwat-cli without pinning a reviewed version or requiring a locked dependency graph. Consequently, the software and transitive dependencies installed in the future may differ from those present when this Skill was audited.

If the package publisher account, package registry, release process, or a transitive dependency is compromised, following this instruction could build or execute attacker-controlled code. Cargo packages can run build scripts during compilation, so exploitation does not necessarily require the user to invoke the installed CLI after installation.

Attack Path

1. An attacker compromises the seggwat-cli publication process, registry account, or one of its newly resolved dependencies.
2. The attacker publishes a malicious release or introduces malicious build-time behavior.
3. A user or CI runner follows the documented cargo install seggwat-cli instruction.
4. Cargo retrieves the unreviewed version and compiles it, potentially executing a malicious build script.
5. The resulting code operates with the privileges and environment access of the user or CI runner.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing user's privileges. On a developer workstation, this may expose source code, local credentials, and accessible configuration files. In CI, it may expose repository tokens, deployment credentials, environment secrets, and build artifacts. The exact scope is constrained by the privileges and isolation of the installation environment.

Remediation

View remediation

Remediation Suggestions

• Pin an explicitly reviewed release instead of installing the latest available version:

  bash

  cargo install seggwat-cli --version 0.17.2 --locked
  

• Use --locked so Cargo honors the package's committed lockfile rather than resolving potentially different transitive dependency versions.

• Document the authoritative package registry and source repository.

• Where prebuilt artifacts are offered, publish and verify cryptographic checksums or signatures before execution.

• Perform installations in a restricted environment without production secrets or unnecessary filesystem access.

• Establish a controlled update process in which new versions are reviewed before changing the documented pin.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-31
Vulnerability Type: Sensitive credential passed through a command-line argument
Risk Level: Medium

Vulnerable Code

bash

# Or inline flag
seggwat --api-key oat_<your-token> project list

Technical Analysis

The documentation recommends placing an organization access token directly in a command-line argument. After replacing the placeholder with a real token, the credential may be recorded in shell history, terminal transcripts, CI command logs, debugging output, or process-monitoring telemetry.

Depending on the operating system and process isolation configuration, command-line arguments may also be visible to other local processes or users while the command is running. This unnecessarily broadens exposure compared with a protected environment variable, credential file, or secret-management integration.

Attack Path

1. A user replaces the placeholder with a valid organization access token.
2. The user executes the documented command.
3. The shell, CI system, terminal recorder, process monitor, or diagnostic tooling stores or displays the complete command line.
4. An attacker with access to that history, log, telemetry stream, or process information obtains the token.
5. The attacker submits requests using the stolen token before it expires or is revoked.
6. The attacker performs SeggWat operations allowed by the token's assigned permissions.

Impact Assessment

A stolen token could grant access to SeggWat projects, feedback, ratings, and related organization data within the token's authorization scope. Based on the documented CLI operations, an attacker may be able to enumerate projects, read feedback, modify feedback state or content, create misleading feedback records, archive feedback, or archive ratings. The maximum impact depends on server-side token permissions and may include confidentiality loss, unauthorized ...[truncated 46 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the inline --api-key example from the recommended authentication workflow.

• Prefer the documented environment-variable mechanism:

  bash

  export SEGGWAT_API_KEY="oat_REDACTED"
  seggwat project list
  

• In CI, inject the value through the platform's protected secret store and enable log masking.

• Avoid shell tracing such as set -x while handling credentials.

• If persistent local storage is needed, use a credential manager or a permissions-restricted configuration file rather than shell history.

• Document least-privilege token creation, expiration, rotation, and immediate revocation procedures.

• Treat any token previously entered directly on a command line as potentially exposed and rotate it.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

seggwat --api-key oat_ project list

text

API keys use the `oat_` prefix (Organization Access Token) and are created in the SeggWat Dashboard under Settings > API Tokens.

### OAuth Login (interactive)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to activate on generic feedback-, ratings-, or CI-related requests even when the user did not explicitly ask to use SeggWat. In an agent setting, this can cause inappropriate tool selection and unintended actions against a real remote service, especially because the skill includes authenticated and state-changing commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents deletion/archive commands for feedback without any warning that they modify remote data or may be difficult to reverse. In an agent workflow, concise examples are often copied directly into execution, so omission of caution increases the chance of accidental destructive actions on production feedback records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The rating deletion command is presented as a normal example with no caution about deleting or archiving remote ratings. Because the skill is for terminal automation and CI/CD workflows, users or agents may execute it non-interactively, causing unintended loss or suppression of rating data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.