Security audit

huly

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate Huly automation guide, but it deserves Review because it installs an unpinned global third-party CLI and manages persistent credentials while enabling powerful workspace changes.

Install only if you trust the @iamcoder18/huly-cli package source and are comfortable giving it access to your Huly workspace. Prefer a pinned, reviewed CLI version, a least-privileged service account, and a short-lived HULY_TOKEN over a stored password. Review any delete, workspace, DM/send, approval, raw huly ws/api, and credential-reset action before allowing the agent to run it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Third-Party CLI Is Installed Globally
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 18–28
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
npm i -g @iamcoder18/huly-cli pnpm add -g @iamcoder18/huly-cli # yarn classic yarn global add @iamcoder18/huly-cli # yarn berry / modern yarn dlx @iamcoder18/huly-cli --version # or use corepack bun add -g @iamcoder18/huly-cli

Technical Analysis

The Skill instructs the Agent to install the latest available version of @iamcoder18/huly-cli from a personal package scope. It does not pin an audited version, verify an integrity digest or package provenance, use a lockfile, or review lifecycle scripts before installation.

Global package installation executes package lifecycle scripts with the privileges of the current user and exposes the installed program to later shell sessions. The audited project only contains documentation and does not include the CLI source, so the actual implementation receiving Huly passwords and JWTs cannot be verified from this artifact.

Although installing the Huly CLI is necessary when it is absent, obtaining a mutable latest release globally exceeds the minimum safe dependency-acquisition approach.

Attack Path

An attacker compromises the package maintainer account, registry release process, or a future package version.

The Agent encounters a system where huly is unavailable.

Following the Skill, the Agent installs the unpinned latest release globally.

Malicious installation lifecycle code or subsequent CLI code executes under the current user's account.

The package can access user-readable files, environment variables, Huly authentication material, and data processed by later CLI invocations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. The compromised package could read or modi ...[truncated 340 chars]
Remediation: View remediation
Remediation Suggestions

Pin the package to an exact, reviewed version, such as @iamcoder18/huly-cli@x.y.z.

Record and verify the registry integrity digest and package provenance.

Prefer a project-local dependency controlled by a committed lockfile rather than a global installation.

Document the expected publisher identity, package repository, and verification procedure.

Review required lifecycle scripts and disable package scripts during installation where feasible.

Execute the CLI under a dedicated, least-privileged service account with a narrowly scoped, short-lived Huly token.

Establish a controlled upgrade process that reviews new versions before changing the pinned release.

T09 · Insecure Skill Coding Practices

Warning

Location: references/auth-and-setup.md:121
Finding: Credential Reset Can Delete an Arbitrary Environment-Selected File
Content: View full analysis
Vulnerability Details

File Location: references/auth-and-setup.md, lines 121–134
Vulnerability Type: Unrestricted file deletion through HULY_ENV_FILE
Risk Level: Medium

Vulnerable Code

bash
# Advanced — manual credentials reset. # Deletes the on-disk token cache (XDG-aware, mode 0600), the active-workspace # pointer, the per-account bootstrap marker, the dotenv file the CLI loaded # (note: dotenv loader is NOT XDG-aware — default is $HOME/.config/huly/.env), # and unsets the auth env vars in the current shell. config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/huly" env_file="${HULY_ENV_FILE:-$HOME/.config/huly/.env}" rm -f "$config_dir/credentials.json" \ "$config_dir/active-workspace" \ "$config_dir/active-account" \ "$config_dir/bootstrap.json" \ "$env_file" unset HULY_TOKEN HULY_EMAIL HULY_PASSWORD HULY_WORKSPACE

Technical Analysis

The reset procedure accepts HULY_ENV_FILE as an unrestricted filesystem path and passes the resulting value directly to rm -f. Shell quoting prevents argument splitting and command substitution at this stage, so this is not shell-command injection. It does not, however, constrain the deletion target to the Huly configuration directory.

A stale, incorrectly configured, or attacker-influenced HULY_ENV_FILE can therefore cause the procedure to delete an unrelated file writable by the current user. The surrounding warning and user-confirmation requirement reduce accidental invocation but do not validate the path or prevent unintended deletion.

Removing the normal Huly token cache is appropriate for logout-like functionality. Unconditionally deleting an arbitrary custom dotenv path is broader than the minimum privilege necessary.

Attack Path

HULY_ENV_FILE is set to an unrelated user-writable file, either accidentally or through attacker influence over the execution environment.

The user asks the Agent to cl ...[truncated 719 chars]
Remediation: View remediation
Remediation Suggestions

Resolve and print the canonical target before deletion.

Require separate explicit confirmation when HULY_ENV_FILE differs from the default Huly dotenv path.

Reject empty values and dangerous targets such as /, $HOME, configuration-directory roots, or paths outside an approved Huly directory.

Prefer retaining a custom dotenv file and instructing the user to remove or edit it manually after reviewing its location.

Delete fixed cache filenames separately from the optional dotenv file so an invalid custom path cannot affect normal cache cleanup.

Use a guarded implementation similar to:

bash
config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/huly" default_env="$HOME/.config/huly/.env" env_file="${HULY_ENV_FILE:-$default_env}" rm -f -- "$config_dir/credentials.json" \ "$config_dir/active-workspace" \ "$config_dir/active-account" \ "$config_dir/bootstrap.json" if [ "$env_file" = "$default_env" ]; then rm -f -- "$env_file" else printf 'Custom HULY_ENV_FILE not deleted automatically: %s\n' "$env_file" fi

Continue requiring user confirmation because credential removal is irreversible until reauthentication.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (147)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 67)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 77)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 97)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 103)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 119)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 151)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 242)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/direct-sdk-access.md (reported line 232)May include surrounding context.
export HULY_NONINTERACTIVE=1

text
After the user finishes either option, re-run the original command to confirm. Cached tokens land in `~/.config/huly/credentials.json` (mode 0600). There is **no `huly logout`** — clearing credentials is a manual file delete (see `references/auth-and-setup.md`). Full env-var cheat sheet, the auth-state machine, and precedence rules live in `references/auth-and-setup.md` and the project README's §Configuration / §Authentication sections.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
ersioned snapshots, controlled-document/e-signature workflow, or training. See `references/cards.md` vs `references/documents.md`. When in doubt about _whether_

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
ersioned snapshots, controlled-document/e-signature workflow, or training. See `references/cards.md` vs `references/documents.md`. When in doubt about _whether_

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.
md
ersioned snapshots, controlled-document/e-signature workflow, or training. See `references/cards.md` vs `references/documents.md`. When in doubt about _whether_

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
| create / list / update / comment on a tracker item | `huly issue …` | `references/issues-and-todos.md` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
| create / list / update / comment on a tracker item | `huly issue …` | `references/issues-and-todos.md` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
| create / list / update / comment on a tracker item | `huly issue …` | `references/issues-and-todos.md` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.
md
| create / list / update / comment on a tracker item | `huly issue …` | `references/issues-and-todos.md` |

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The documented reset command deletes credential and environment files based on environment-influenced paths such as XDG_CONFIG_HOME and HULY_ENV_FILE. In an agent context, executing shell snippets with attacker-controlled environment variables could remove unintended files or disrupt authentication state beyond the intended scope.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 129)May include surrounding context.
md
# and unsets the auth env vars in the current shell. config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/huly" env_file="${HULY_ENV_FILE:-$HOME/.config/huly/.env}" rm -f "$config_dir/credentials.json" \ "$config_dir/active-workspace" \ "$config_dir/active-account" \ "$config_dir/bootstrap.json" \

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: The manual reset snippet performs rm -f on paths derived from environment variables. In an agent/tooling context, if those variables are attacker-influenced or if the agent is induced to execute this snippet, it can delete arbitrary local files within the user's permissions and disrupt authentication or broader system state.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 129)May include surrounding context.
md
# and unsets the auth env vars in the current shell. config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/huly" env_file="${HULY_ENV_FILE:-$HOME/.config/huly/.env}" rm -f "$config_dir/credentials.json" \ "$config_dir/active-workspace" \ "$config_dir/active-account" \ "$config_dir/bootstrap.json" \

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/auth-and-setup.md (reported line 231)May include surrounding context.
Mode 0600 recommended:

bash
chmod 600 ~/.config/huly/.env

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill recommends storing long-lived Huly credentials, including a plaintext password or bearer token, in ~/.config/huly/.env. For an agent skill, this increases exposure through local file compromise, accidental disclosure, backup leakage, or downstream tool access, especially because the same skill also discusses not inspecting config and proceeding with existing auth state.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
prompts for password if HULY_PASSWORD is unset

text
**Option B — `.env` file (CI / headless / service accounts).** Ask the user to create `~/.config/huly/.env` (mode 0600): ```bash # minimal — password login

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
4. **The Issue ↔ Action state machine is one machine.** Changing an issue's status or assignee auto-creates/closes `ProjectToDo` records. Completing/scheduling/deleting an `action` (todo) can auto-advance or auto-rollback the parent issue's status. This is the most common silent cascade you will hit. See the diagram below. 5. **Don't use destructive verbs without checking first.** Run `huly <surface> get <ref> --json` or the surface's `preview-` verb if it has one, then ask the user before proceeding. Bulk deletes (`<ref...>` with 2+ refs) require `--yes`. Single-ref deletes, `dm create --person`, `dm send --person`, `dm send`, `action unschedule --slot-id`, and any raw `huly ws removeDoc`/`tx` are **irreversible and proceed without a CLI prompt** — confirm out loud with the user before invoking. 6. **Ask, don't guess, when context is missing.** Workspace name, project identifier, person email, exact ISO timestamp — none of these can be inferred. If the user gave you one but not the others, ask.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
When the user asks you to do something, pick the right top-level command first. The order below is "from most likely to be correct": | User intent | Surface | Reference | | -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | create / list / update / comment on a tracker item | `huly issue …` | `references/issues-and-todos.md` | | create / list / update a Planner task / todo | `huly action …` (NOT `huly todo` — that doesn't exist) | `references/issues-and-todos.md` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/issues-and-todos.md (reported line 270)May include surrounding context.
md
When the user asks you to do something, pick the right top-level command first. The order below is "from most likely to be correct": | User intent | Surface | Reference | | -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | create / list / update / comment on a tracker item | `huly issue …` | `references/issues-and-todos.md` | | create / list / update a Planner task / todo | `huly action …` (NOT `huly todo` — that doesn't exist) | `references/issues-and-todos.md` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
## Output modes — when to use which | You want to… | Use | Returns | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ----------------------------------------------------------------- | | Read interactively (human) | default (table) | Auto-sized columns, hidden boring fields | | Pipe to `jq` / `xargs`, capture an `_id`, branch on data | `--json` (or `--ci`) | Raw arrays / objects |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
| You want to… | Use | Returns | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ----------------------------------------------------------------- | | Read interactively (human) | default (table) | Auto-sized columns, hidden boring fields | | Pipe to `jq` / `xargs`, capture an `_id`, branch on data | `--json` (or `--ci`) | Raw arrays / objects | | Read the body of a doc/comment/message as Markdown | `--markdown` | Rendered Markdown. Has a 5s timeout; warns on conversion failure. | | Read the raw prosemirror-JSON blob | `--raw-markup` (read commands only) | The literal prosemirror-JSON string stored in MinIO. |

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Credential Access

Tool Parameter Abuse

Credential Access

Session Persistence

prompts for password if HULY_PASSWORD is unset

Autonomous Decision Making

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding