other
Error
- Location
SKILL.md:69- Finding
Plaintext Credentials Disclosed to an External Vault Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Agentlair Vault
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent hosted credential vault, but it asks agents to send and persist high-impact API keys with under-disclosed plaintext handling and weak optional encryption guidance.
Review before installing. Use this only if you are comfortable trusting AgentLair as a custodian for the credentials you store there. Prefer least-privileged and revocable provider keys, avoid storing live financial or admin tokens unless necessary, require explicit confirmation before rotate or delete actions, and do not rely on the optional AES-CBC shell example for zero-knowledge storage.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:267- Finding
Unauthenticated AES-CBC and Unsafe Passphrase Handling in Optional Encryption Workflow
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md primaryEnv: AGENTLAIR_API_KEY requires: bins: - curl tags: - credentials - secrets
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims credentials stay in the vault and only a vault token is held, but the examples explicitly retrieve plaintext secrets into local shell variables such as STRIPE_KEY and PLAINTEXT. That means secrets do exist in agent memory and may be exposed via process inspection, shell history mistakes, logs, or downstream command tracing, so the stated blast-radius reduction is overstated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation includes immediate destructive DELETE operations for removing secrets and all versions without requiring confirmation guidance, backup advice, or user-approval language. In an agent context, this increases the risk of accidental irreversible credential loss or service disruption from an ambiguous or misinterpreted instruction.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Store the Stripe key in vault:
bash curl -s -X PUT "https://agentlair.dev/v1/vault/stripe-live" \ -H "Authorization: Bearer $AGENTLAIR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"ciphertext": "sk_live_USER_PROVIDED_KEY", "metadata": {"label": "Stripe live key", "service": "stripe"}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Use it:
bash curl -s "https://api.stripe.com/v1/balance" \ -H "Authorization: Bearer $STRIPE_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md SECRET="sk-ant-YOUR-KEY" ENCRYPTED=$(echo -n "$SECRET" | openssl enc -aes-256-cbc -base64 -k "$LOCAL_PASSPHRASE") curl -s -X PUT "https://agentlair.dev/v1/vault/anthropic-key" \ -H "Authorization: Bearer $AGENTLAIR_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"ciphertext\": \"$ENCRYPTED\", \"metadata\": {\"encrypted\": \"aes-256-cbc\", \"label\": \"Anthropic API key\"}}"
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims credentials stay in the vault and only a vault token is held, but the examples explicitly retrieve plaintext secrets into local shell variables such as STRIPE_KEY and PLAINTEXT. That means secrets do exist in agent memory and may be exposed via process inspection, shell history mistakes, logs, or downstream command tracing, so the stated blast-radius reduction is overstated.
- Content