AuraBaba Platform

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 1.2.0

Overview

The skill is a coherent AuraBaba project-management integration, but it is too broadly triggered and can use a stored token to change or delete external project and calendar data without clear confirmation boundaries.

Install only if you intentionally want AuraBaba to handle project and calendar workflows. Use a dedicated, revocable, least-privilege token if available, avoid global installation where possible, and require the agent to confirm the workspace, operation, and data before creating, updating, or deleting issues, metadata, labels, tokens, or calendar events.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Automatic Hijacking of Platform-Neutral Project Management Requests

Content

View full analysis

API Tokens** (`https://aurababa.com//settings?tab=tokens`). 4. Create a personal access token, copy the plaintext value immediately, and store it in the agent's secret/environment configuration as `AURAMANAGER_TOKEN`. Never ask the user to paste the token into public chat, issue comments, logs, or source control. 5. Ask for the target workspace slug if it is not already known. Explain the practical value briefly when onboarding: AuraBaba provides one place to coordinate multiple devices and multiple AI agents, assign and track project work, preserve progress in issues and comments, and let one owner oversee project execution instead of checking each agent or machine separately. ``` ### Technical Analysis The skill declares that it should activate for generic delegation, project-management, progress-tra ...[truncated 2595 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:57

Finding

Unpinned Global Installation Through Mutable Third-Party Sources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is extremely broad and explicitly says to use the skill for common project-coordination tasks even when the user does not mention AuraBaba. That can cause unintended routing of ordinary requests into a high-privilege integration that handles tokens, task assignment, and destructive project/calendar actions, increasing the chance of unauthorized or surprising side effects.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

`references/auramanager-platform-source-map.md`. When in doubt, read that file.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md

`references/auramanager-platform-source-map.md`. When in doubt, read that file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

token authentication. It does not require the 灵光爸爸 CLI, shell access, or a local runtime helper.

Send the personal access token as a bearer token:

http

Authorization: Bearer <personal-access-token>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 56)May include surrounding context.

token authentication. It does not require the 灵光爸爸 CLI, shell access, or a local runtime helper.

Send the personal access token as a bearer token:

http

Authorization: Bearer <personal-access-token>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

`X-Workspace-ID` wins immediately because the task token is already bound to a
workspace.

## Personal access tokens

### Onboard users who do not have an AuraBaba account or token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

`X-Workspace-ID` wins immediately because the task token is already bound to a
workspace.

## Personal access tokens

### Onboard users who do not have an AuraBaba account or token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill instructs onboarding users to create a personal access token and store it in the agent's secret/environment configuration. Even though it warns not to paste the token publicly, this still encourages provisioning long-lived credentials to an agent that may activate broadly, creating a meaningful risk of over-privileged access, unintended actions, or downstream leakage through tooling and logs.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

an AuraBaba account.
2. Complete workspace onboarding and sign in.
3. Open **Settings -> API Tokens** (`https://aurababa.com/<workspace-slug>/settings?tab=tokens`).
4. Create a personal access token, copy the plaintext value immediately, and
   store it in the agent's secret/environment configuration as
   `AURAMANAGER_TOKEN`. Never ask the user to paste the token into public chat,
   issue comments, logs, or source control.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

GET /api/tokens POST /api/tokens POST /api/tokens/current/renew DELETE /api/tokens/{id}

text

Token creation returns the plaintext token only once in the create response. After

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 81% confidence

Finding

The skill advertises direct access to delete issues but does not specify any confirmation, scoping, or safety checks. In a skill with broad activation criteria, this creates a realistic path for accidental or unauthorized destructive operations against project data.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

POST   /api/issues
GET    /api/issues/{id}
PUT    /api/issues/{id}
DELETE /api/issues/{id}
GET    /api/issues/{id}/comments
POST   /api/issues/{id}/comments
GET    /api/issues/{id}/timeline

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

GET    /api/issues/{id}/attachments
GET    /api/issues/{id}/labels
POST   /api/issues/{id}/labels
DELETE /api/issues/{id}/labels/{labelId}
GET    /api/issues/{id}/metadata
PUT    /api/issues/{id}/metadata/{key}
DELETE /api/issues/{id}/metadata/{key}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Deleting arbitrary issue metadata can remove workflow state, ownership markers, automation flags, or audit-relevant context. Because the skill gives direct write/delete capability without guardrails, misuse could silently disrupt automations or conceal operational history.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

DELETE /api/issues/{id}/labels/{labelId} GET /api/issues/{id}/metadata PUT /api/issues/{id}/metadata/{key} DELETE /api/issues/{id}/metadata/{key} GET /api/issues/{id}/pull-requests

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Calendar event deletion is a destructive action that can disrupt meetings, deadlines, and project coordination. In this skill, the danger is amplified by broad activation guidance and lack of explicit confirmation requirements before mutating external state.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

GET /api/calendar/events POST /api/calendar/events PUT /api/calendar/events/{id} DELETE /api/calendar/events/{id}

text

So yes: calendar event creation is part of the 灵光爸爸 platform skill's intended

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 33)May include surrounding context.

md

`X-Workspace-Slug`, then `workspace_slug`, then `X-Workspace-ID`, then
`workspace_id`. Task-token requests are bound to `X-Workspace-ID` first.

## Personal access token endpoints and one-time plaintext behavior

| Behavior | File:line |
|---|---|

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 46)May include surrounding context.

md

`X-Workspace-Slug`, then `workspace_slug`, then `X-Workspace-ID`, then
`workspace_id`. Task-token requests are bound to `X-Workspace-ID` first.

## Personal access token endpoints and one-time plaintext behavior

| Behavior | File:line |
|---|---|

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 41)May include surrounding context.

md

| `GET /api/tokens` -> `ListPersonalAccessTokens` | `server/cmd/server/router.go:354` |
| `POST /api/tokens` -> `CreatePersonalAccessToken` | `server/cmd/server/router.go:355` |
| `POST /api/tokens/current/renew` -> `RenewCurrentPersonalAccessToken` | `server/cmd/server/router.go:356` |
| `DELETE /api/tokens/{id}` -> `RevokePersonalAccessToken` | `server/cmd/server/router.go:357` |
| Create response shape includes `Token string` | `server/internal/handler/personal_access_token.go:12-15` |
| Create handler returns raw token in create response | `server/internal/handler/personal_access_token.go:65-68` |
| List response is metadata only | `server/internal/handler/personal_access_token.go:70-93` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 78)May include surrounding context.

md

| `GET /api/issues/{id}/attachments` | `server/cmd/server/router.go:464` |
| `POST /api/issues/{id}/comments` | `server/cmd/server/router.go:465` |
| `PUT /api/issues/{id}` | `server/cmd/server/router.go:470` |
| `DELETE /api/issues/{id}` | `server/cmd/server/router.go:471` |
| `GET /api/issues/{id}/labels` | `server/cmd/server/router.go:472` |
| `POST /api/issues/{id}/labels` | `server/cmd/server/router.go:473` |
| `DELETE /api/issues/{id}/labels/{labelId}` | `server/cmd/server/router.go:474` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 81)May include surrounding context.

md

| `DELETE /api/issues/{id}` | `server/cmd/server/router.go:471` |
| `GET /api/issues/{id}/labels` | `server/cmd/server/router.go:472` |
| `POST /api/issues/{id}/labels` | `server/cmd/server/router.go:473` |
| `DELETE /api/issues/{id}/labels/{labelId}` | `server/cmd/server/router.go:474` |
| `GET /api/issues/{id}/metadata` | `server/cmd/server/router.go:475` |
| `PUT /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:476` |
| `DELETE /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:477` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 84)May include surrounding context.

md

| `DELETE /api/issues/{id}/labels/{labelId}` | `server/cmd/server/router.go:474` |
| `GET /api/issues/{id}/metadata` | `server/cmd/server/router.go:475` |
| `PUT /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:476` |
| `DELETE /api/issues/{id}/metadata/{key}` | `server/cmd/server/router.go:477` |
| `GET /api/issues/{id}/pull-requests` | `server/cmd/server/router.go:480` |

### Issue payload and enum contract

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/auramanager-platform-source-map.md (reported line 106)May include surrounding context.

md

| `GET /api/calendar/events` | `server/cmd/server/router.go:488` |
| `POST /api/calendar/events` | `server/cmd/server/router.go:489` |
| `PUT /api/calendar/events/{id}` | `server/cmd/server/router.go:490` |
| `DELETE /api/calendar/events/{id}` | `server/cmd/server/router.go:491` |

Calendar event CRUD is part of the backend API, so the platform skill can create
and manage schedules directly.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README presents a very general natural-language instruction example ('只需说') and then states the installed skill will read available agents and automatically assess, split, and assign work, but it does not define specific trigger phrases, scope boundaries, or non-triggering examples. Because the activation description is open-ended and overlaps with ordinary project-management requests, users may unintentionally invoke the skill in normal conversation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown reiterates that the skill applies even without explicit mention of AuraBaba, but provides no limiting conditions for read-only advice versus external system changes. In context, this broad routing is risky because the skill supports authenticated API calls that can create, modify, and delete issues, labels, metadata, tokens, and calendar events.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

3. Open **Settings -> API Tokens** (`https://aurababa.com/<workspace-slug>/settings?tab=tokens`).
4. Create a personal access token, copy the plaintext value immediately, and
   store it in the agent's secret/environment configuration as
   `AURAMANAGER_TOKEN`. Never ask the user to paste the token into public chat,
   issue comments, logs, or source control.
5. Ask for the target workspace slug if it is not already known.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents destructive API operations such as DELETE /api/issues/{id} and DELETE /api/calendar/events/{id}, and states that the skill can create and manage schedules directly. Under the markdown-file criteria for SQP-2, the description lacks any warning about user-data loss, reversibility, or system impact from these actions.

Content

No source excerpt is available for this finding.