Verifiable Data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its stated Cryptowerk proof workflow, but it needs review because it issues and stores service credentials without strong overwrite or symlink safeguards.

Review this skill before installing if you will use real Cryptowerk credentials. Use a private, non-repository secret path, do not reuse an existing file path for issued keys, avoid sensitive names in lookupInfo, and expect local sidecar files to be created next to target files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/issue-key.sh:28

Finding

Unsafe Credential File Creation Allows Disclosure and Unintended Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/issue-key.sh, lines 28-31
Vulnerability Type: Unsafe credential storage, symbolic-link following, and non-exclusive file creation
Risk Level: High

bash

if [[ -n "$OUTPUT_FILE" ]]; then
  mkdir -p "$(dirname "$OUTPUT_FILE")"
  umask 077
  printf '%s\n' "$TOKEN" > "$OUTPUT_FILE"

Technical Analysis

The credential is written using ordinary shell redirection. This operation truncates an existing destination and follows a symbolic link if the supplied path is a symlink. It does not enforce exclusive creation or verify that the destination is a regular file owned by the current user.

Although umask 077 protects a newly created file, it does not change the permissions of an existing file. If the destination already exists with group-readable or world-readable permissions, those permissions remain in place after the new credential is written.

The implementation also contradicts the documented rule in SKILL.md that new keys should be saved to fresh files without overwriting old credentials by default. Exploitation requires the attacker to influence the selected output path or pre-create an entry in a directory where both the attacker and victim can write.

Attack Path

1. An attacker predicts or influences the credential output path.
2. The attacker creates either:
   • a permissively readable file at that path; or
   • a symbolic link from that path to another file writable by the victim process.
3. The victim runs scripts/issue-key.sh with the affected path.
4. Shell redirection follows the link or truncates the existing file.
5. The newly issued API credential is exposed through existing file permissions, or an unintended writable file is overwritten.

Impact Assessment

An attacker may obtain the newly issued Cryptowerk credential if it is written into a file the attacker can read. The flaw may also destroy an existing credential or ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

• Refuse to overwrite an existing destination unless the user explicitly requests replacement.
• Reject symbolic links and require the destination to be a regular file.
• Create the credential file atomically with exclusive creation and mode 0600.
• Set umask 077 before creating any credential-related filesystem objects.
• Use a safe implementation such as Python os.open() with O_CREAT | O_EXCL | O_WRONLY and, where supported, O_NOFOLLOW.
• Write the credential completely, flush it, and close the file before reporting success.
• If replacement is supported, write to an exclusively created temporary file in the same trusted directory and use a controlled atomic rename after validating the destination.
• Require that the parent directory is trusted and not writable by untrusted users.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/register-file.sh:29

Finding

Sensitive Workflow Metadata Is Transmitted in URL Query Strings

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/register-file.sh, lines 29-34
• scripts/get-seal.sh, lines 30-35
• scripts/verify-file.sh, lines 48-53

Vulnerability Type: Sensitive metadata exposure through URL query parameters
Risk Level: Low

scripts/register-file.sh:

bash

RESPONSE=$($CURL_BIN --silent --show-error --fail-with-body -X POST "https://aiagent.cryptowerk.com/platform/API/v8/register" \
  -H "Accept: application/json" \
  -H "X-API-Key: $X_API_KEY" \
  --get \
  --data-urlencode "hashes=$HASH" \
  --data-urlencode "lookupInfo=$LOOKUP_INFO")

scripts/get-seal.sh:

bash

RESPONSE=$($CURL_BIN --silent --show-error --fail-with-body -X POST "https://aiagent.cryptowerk.com/platform/API/v8/getseal" \
  -H "Accept: application/json" \
  -H "X-API-Key: $X_API_KEY" \
  --get \
  --data-urlencode "retrievalId=$RID" \
  --data-urlencode "provideVerificationInfos=true")

scripts/verify-file.sh:

bash

RESPONSE=$($CURL_BIN --silent --show-error --fail-with-body -X POST "https://aiagent.cryptowerk.com/platform/API/v8/verifyseal" \
  -H "Accept: application/json" \
  -H "X-API-Key: $X_API_KEY" \
  --get \
  --data-urlencode "verifyDocHashes=$HASH" \
  --data-urlencode "seals=$SEAL")

Technical Analysis

The scripts combine -X POST with curl's --get option. The latter appends values supplied through --data-urlencode to the request URL rather than placing them in the POST body.

As a result, document hashes, user-controlled lookupInfo, retrieval identifiers, and seal data become part of request URLs. URLs are more likely than request bodies to be retained in reverse-proxy logs, API access logs, monitoring systems, diagnostic traces, and other operational telemetry.

The API credential itself remains in the HTTPS X-API-Key header and is not placed in the URL. The transmitted metadata is sent only to the declared Cryptowerk service and ...[truncated 1642 chars]

Remediation

View remediation

Remediation Suggestions

• Confirm whether the Cryptowerk API accepts these parameters in the POST body.
• If body parameters are supported, remove --get and send the values as form-encoded POST data, for example through --data-urlencode without --get.
• Prefer a documented JSON request body if the API supports JSON.
• If query parameters are mandatory, clearly document that hashes, retrieval IDs, seals, and lookupInfo may appear in service and proxy logs.
• Warn users not to place filenames, personal information, secrets, or confidential business identifiers in lookupInfo.
• Configure URL logging and telemetry to redact or omit query strings where the deployment is under the operator's control.
• Establish retention and access controls for logs containing these request URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description says the skill requires service credentials, but the workflow also provisions fresh credentials and instructs users to persist them locally. That mismatch is security-relevant because reviewers or users may assume the skill only consumes pre-existing credentials, while it actually performs credential issuance and local secret handling, expanding the attack surface to account/token compromise.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

1. Obtain a fresh service credential with `scripts/issue-key.sh`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

1. Obtain a fresh service credential with `scripts/issue-key.sh`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

1. Obtain a fresh service credential with `scripts/issue-key.sh`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

1. Obtain a fresh service credential with `scripts/issue-key.sh`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

3. Register a file hash with `scripts/register-file.sh`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

3. Register a file hash with `scripts/register-file.sh`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

3. Register a file hash with `scripts/register-file.sh`

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly performs shell execution plus file read/write operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and increases the chance the skill is run with broader capabilities than intended, especially since it handles credentials and writes artifacts to disk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill explicitly supports writing freshly issued tokens to a user-chosen file and then reloading them into an environment variable. Persisting service credentials on disk creates a durable secret that may be exposed through weak permissions, backups, watched directories, accidental commits, or other local processes, making this context more dangerous because the skill is centered around repeated shell-based local artifact handling.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- one of `shasum`, `sha256sum`, or `openssl`

Credential handling:
- `scripts/issue-key.sh` can write a fresh token to a file you choose
- runtime scripts expect `CRYPTOWERK_X_API_KEY` to contain the exact combined token value
- keep issued tokens out of watched or committed trees
- the skill uses service credentials only for the documented proof APIs

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs a POST to an external issue-key endpoint and extracts an apiKey/apiCredential pair, which is credential issuance behavior. That exceeds the stated skill scope of using existing service credentials for verification workflows and can create or obtain new account credentials without explicit declaration, increasing the chance of unauthorized account changes or secret sprawl.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends the file's SHA-256 hash and lookup metadata to an external HTTPS endpoint using curl. Although the behavior is visible in code, there is no confirmation prompt, user-facing notice, or explanatory comment/docstring warning that local file information will be transmitted off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file states that multiple scripts require CRYPTOWERK_X_API_KEY, and earlier lines describe obtaining apiKey and apiCredential, but it does not include any caution about treating these values as sensitive secrets or avoiding accidental disclosure. Under the markdown-specific missing-warning criterion, credentials usage that may affect privacy or account security should be accompanied by a warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script creates additional files next to the source file (.rid and .cw.json), which modifies the user's filesystem. While these writes are part of the script's function, the file contains no user-facing notice, confirmation, or comments explaining that companion files will be created.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates or overwrites a sidecar file at "$FILE_PATH.verify.json", which is a filesystem write operation. Although the behavior is visible in code, there is no confirmation prompt, user-facing notice, or inline warning near the write to alert callers that running the script will persist output to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.