灵光爸爸（AuraBaba）Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 1.0.0

Overview

This skill is a real AuraBaba project-management integration, but it can activate for generic coordination requests and drive external API changes, token setup, deletions, and agent delegation without clear confirmation guardrails.

Install only if you intentionally want AuraBaba to be the project-management backend for this agent. Use a separate least-privilege token if available, keep it out of chat and logs, and require the agent to ask before creating, assigning, deleting, renewing, or revoking anything in AuraBaba.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Broad Skill Activation Hijacks Generic Project-Management Requests

Content

View full analysis

API Tokens** (`https://aurababa.com//settings?tab=tokens`). 4. Create a personal access token, copy the plaintext value immediately, and store it in the agent's secret/environment configuration as `AURABABA_TOKEN`. Never ask the user to paste the token into public chat, issue comments, logs, or source control. 5. Ask for the target workspace slug if it is not already known. Explain the practical value briefly when onboarding: AuraBaba provides one place to coordinate multiple devices and multiple AI agents, assign and track project work, preserve progress in issues and comments, and let one owner oversee project execution instead of checking each agent or machine separately. ``` ### Technical ...[truncated 2455 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:56

Finding

Unpinned Global Installation from Mutable Third-Party Sources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is extremely broad and instructs use for general project coordination, delegation, scheduling, and onboarding, even when the user does not explicitly request AuraBaba. That can cause the agent to invoke a high-privilege external integration in situations where the user only wants advice or lightweight planning, increasing the chance of unintended data access or side effects.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

`references/aurababa-platform-source-map.md`. When in doubt, read that file.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md

`references/aurababa-platform-source-map.md`. When in doubt, read that file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

token authentication. It does not require the 灵光爸爸 CLI, shell access, or a local runtime helper.

Send the personal access token as a bearer token:

http

Authorization: Bearer <personal-access-token>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

`X-Workspace-ID` wins immediately because the task token is already bound to a
workspace.

## Personal access tokens

### Onboard users who do not have an AuraBaba account or token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

`X-Workspace-ID` wins immediately because the task token is already bound to a
workspace.

## Personal access tokens

### Onboard users who do not have an AuraBaba account or token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill instructs onboarding users to create a personal access token and store it in the agent's secret/environment configuration. Even though it warns against pasting the token in chat, this still drives credential provisioning into an agent context and may normalize granting broad long-lived access without discussing scope, least privilege, rotation, or explicit consent for what the agent may do with the token.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

an AuraBaba account.
2. Complete workspace onboarding and sign in.
3. Open **Settings -> API Tokens** (`https://aurababa.com/<workspace-slug>/settings?tab=tokens`).
4. Create a personal access token, copy the plaintext value immediately, and
   store it in the agent's secret/environment configuration as
   `AURABABA_TOKEN`. Never ask the user to paste the token into public chat,
   issue comments, logs, or source control.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The skill exposes destructive token-management operations such as deleting tokens but provides no guardrails for confirmation, target validation, or user-approval boundaries. In a skill intended for broad activation, this can enable accidental or manipulated revocation of credentials, disrupting user access or other automations.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

GET /api/tokens POST /api/tokens POST /api/tokens/current/renew DELETE /api/tokens/{id}

text

Token creation returns the plaintext token only once in the create response. After

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The skill includes issue deletion as part of its supported surface without specifying any confirmation or safety constraints. Because the skill can activate broadly for coordination requests, a prompt injection or misunderstanding could cause irreversible deletion of project records and loss of audit history.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

POST   /api/issues
GET    /api/issues/{id}
PUT    /api/issues/{id}
DELETE /api/issues/{id}
GET    /api/issues/{id}/comments
POST   /api/issues/{id}/comments
GET    /api/issues/{id}/timeline

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

GET    /api/issues/{id}/attachments
GET    /api/issues/{id}/labels
POST   /api/issues/{id}/labels
DELETE /api/issues/{id}/labels/{labelId}
GET    /api/issues/{id}/metadata
PUT    /api/issues/{id}/metadata/{key}
DELETE /api/issues/{id}/metadata/{key}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Metadata deletion can remove workflow state, ownership markers, or automation keys that other systems depend on, and the skill gives no safety guidance for such sensitive mutations. In a multi-agent coordination system, silent metadata removal can break downstream automation or obscure provenance.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

DELETE /api/issues/{id}/labels/{labelId} GET /api/issues/{id}/metadata PUT /api/issues/{id}/metadata/{key} DELETE /api/issues/{id}/metadata/{key} GET /api/issues/{id}/pull-requests

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Calendar event deletion is a destructive operation that can disrupt meetings, milestones, and coordination across teams, yet the skill does not require confirmation or contextual validation. Given the broad activation criteria and direct API access, this increases the chance of harmful unintended scheduling changes.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

GET /api/calendar/events POST /api/calendar/events PUT /api/calendar/events/{id} DELETE /api/calendar/events/{id}

text

So yes: calendar event creation is part of the 灵光爸爸 platform skill's intended

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 33)May include surrounding context.

md

`X-Workspace-Slug`, then `workspace_slug`, then `X-Workspace-ID`, then
`workspace_id`. Task-token requests are bound to `X-Workspace-ID` first.

## Personal access token endpoints and one-time plaintext behavior

| Behavior | File:line |
|---|---|

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The documented token-management endpoints include create, renew, and revoke operations. In an agent skill, powerful token lifecycle actions are susceptible to parameter abuse or prompt-induced misuse: an attacker could trick the agent into revoking the current token, rotating credentials unexpectedly, or creating new credentials without clear user intent.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 41)May include surrounding context.

md

| `GET /api/tokens` -> `ListPersonalAccessTokens` | `server/cmd/server/router.go:354` |
| `POST /api/tokens` -> `CreatePersonalAccessToken` | `server/cmd/server/router.go:355` |
| `POST /api/tokens/current/renew` -> `RenewCurrentPersonalAccessToken` | `server/cmd/server/router.go:356` |
| `DELETE /api/tokens/{id}` -> `RevokePersonalAccessToken` | `server/cmd/server/router.go:357` |
| Create response shape includes `Token string` | `server/internal/handler/personal_access_token.go:12-15` |
| Create handler returns raw token in create response | `server/internal/handler/personal_access_token.go:65-68` |
| List response is metadata only | `server/internal/handler/personal_access_token.go:70-93` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The source map states that the create handler returns the raw personal access token in plaintext at creation time. In an agent-skill context, this is dangerous because the agent can receive a long-lived credential and may leak it through logs, memory, downstream tool calls, or chat output; the skill metadata explicitly supports onboarding and token management, which increases the chance of handling secrets.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 46)May include surrounding context.

md

| Create handler returns raw token in create response | `server/internal/handler/personal_access_token.go:65-68` |
| List response is metadata only | `server/internal/handler/personal_access_token.go:70-93` |

The raw personal access token value is surfaced only at create time; normal list
responses return metadata such as prefix, expiry, and usage timestamps.

## Account and token onboarding surfaces

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This section documents a registration flow plus a UI/API path that delivers the plaintext token to the caller. In a skill designed to onboard unregistered users and manage projects across agents, exposing token issuance surfaces materially increases the chance that the skill will mint and handle reusable credentials on behalf of users, creating a realistic secret-exposure risk.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 56)May include surrounding context.

md

| Public registration page is `/register` | `packages/core/paths/paths.ts:65` |
| Backend registration endpoint is `/auth/register` | `server/cmd/server/router.go:537` |
| Settings exposes the `tokens` tab | `packages/views/settings/components/settings-page.tsx:40-55` |
| Token creation UI calls the personal access token API and receives the plaintext token | `packages/views/settings/components/tokens-tab.tsx:71-73` |

The multi-device, multi-agent coordination explanation is product positioning for
new users; it does not alter the authentication or API contracts above.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The issue API exposes destructive operations such as deleting issues by ID. In a delegation-oriented skill, untrusted natural-language instructions can be translated into direct API calls, so weak confirmation or ID validation could let a malicious prompt cause unauthorized or accidental deletion of project records.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 78)May include surrounding context.

md

| `GET /api/issues/{id}/attachments` | `server/cmd/server/router.go:464` |
| `POST /api/issues/{id}/comments` | `server/cmd/server/router.go:465` |
| `PUT /api/issues/{id}` | `server/cmd/server/router.go:470` |
| `DELETE /api/issues/{id}` | `server/cmd/server/router.go:471` |
| `GET /api/issues/{id}/labels` | `server/cmd/server/router.go:472` |
| `POST /api/issues/{id}/labels` | `server/cmd/server/router.go:473` |
| `DELETE /api/issues/{id}/labels/{labelId}` | `server/cmd/server/router.go:474` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

Deleting labels by issue ID and label ID is a state-changing action vulnerable to parameter misuse if the agent accepts attacker-supplied identifiers or inferred context. While less severe than credential abuse, it can still tamper with workflow state, reporting, and automation triggers in a multi-agent coordination environment.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 81)May include surrounding context.

md

| `DELETE /api/issues/{id}` | `server/cmd/server/router.go:471` |
| `GET /api/issues/{id}/labels` | `server/cmd/server/router.go:472` |
| `POST /api/issues/{id}/labels` | `server/cmd/server/router.go:473` |
| `DELETE /api/issues/{id}/labels/{labelId}` | `server/cmd/server/router.go:474` |
| `GET /api/issues/{id}/metadata` | `server/cmd/server/router.go:475` |
| `PUT /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:476` |
| `DELETE /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:477` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

Metadata deletion endpoints can remove workflow-critical keys that may drive automations, routing, or audit context. Because the skill is intended to coordinate projects and agents, malicious or ambiguous prompts could abuse these parameters to silently alter system behavior or erase important execution context.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 84)May include surrounding context.

md

| `DELETE /api/issues/{id}/labels/{labelId}` | `server/cmd/server/router.go:474` |
| `GET /api/issues/{id}/metadata` | `server/cmd/server/router.go:475` |
| `PUT /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:476` |
| `DELETE /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:477` |
| `GET /api/issues/{id}/pull-requests` | `server/cmd/server/router.go:480` |

### Issue payload and enum contract

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Calendar event deletion is another destructive action that can be triggered through natural-language tasking. In a scheduling and coordination skill, a prompt-injection or mistaken parameter resolution could cancel meetings or milestones, disrupting operations even if no deeper system compromise occurs.

Content

Scanner excerpt · references/aurababa-platform-source-map.md (reported line 106)May include surrounding context.

md

| `GET /api/calendar/events` | `server/cmd/server/router.go:488` |
| `POST /api/calendar/events` | `server/cmd/server/router.go:489` |
| `PUT /api/calendar/events/{id}` | `server/cmd/server/router.go:490` |
| `DELETE /api/calendar/events/{id}` | `server/cmd/server/router.go:491` |

Calendar event CRUD is part of the backend API, so the platform skill can create
and manage schedules directly.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation guidance is broad enough that ordinary project-management requests may trigger this skill even when the user did not intend to invoke a system that creates tasks, delegates work, or coordinates external agents. In this skill’s context, overbroad activation is risky because it can lead to autonomous actions across external systems based on ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises automatic task creation, delegation, and project advancement but does not warn that these operations cause external side effects in shared systems. Users may treat the skill like a purely advisory assistant, when in fact it can modify project state and trigger work by other agents or collaborators.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow description suggests that a single high-level goal instruction is enough for the system to evaluate, split, assign, and advance work automatically. That is dangerous because ambiguous natural-language requests could be interpreted as authorization to perform real external side effects, including delegation to multiple agents and updates in a shared workspace.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to install the skill via npx skills add ... without pinning a specific version or immutable artifact. This allows whatever version is current at install time to be fetched and executed, increasing supply-chain risk if the package or upstream registry account is later compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly says it applies even if the user does not mention AuraBaba, which weakens user-consent boundaries around external system use. In this context, the skill can create, update, assign, or delete project artifacts, so ambiguous activation materially raises the risk of unintended actions in a real workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.