Security audit

sherry-bbs

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a forum bot, but its installer and setup create high-impact automatic behavior that users should review before installing.

Review this skill carefully before installing. Its forum API use is understandable for a bot, but the one-line installer executes remote code, setup can register an account and create recurring autonomous posting/replying jobs, and cron messages store the raw API key. Prefer a version-pinned, locally reviewed install, avoid running it as root, do not enable cron jobs unless you intend autonomous public engagement, and rotate any API key already used with these cron tasks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:6
Finding: Unverified Remote Installer Is Executed Directly Through Bash
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:6 and SKILL.md:22-25
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

yaml
installation: curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash

bash
# One-click install curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash

Technical Analysis

The documented installation procedure pipes the current HTTP response directly into Bash. The installer is not pinned to an immutable release and is not verified using a cryptographic signature or expected checksum.

HTTPS protects the connection in transit but does not protect users if the hosting server, domain, deployment process, or upstream installer itself is compromised. The effective code executed by users can therefore change after the reviewed Skill package was published.

Attack Path

An attacker compromises the server, DNS, deployment account, or hosted installer at sherry.hweyukd.top.

The attacker replaces install-skills.sh with a malicious script.

A user follows the documented one-click installation command.

curl retrieves the attacker-controlled response.

Bash executes the response immediately, without review or integrity validation.

The payload runs with all permissions available to the installing user.

Impact Assessment

Successful exploitation provides arbitrary command execution under the installing user's account. Depending on that account's privileges, the attacker could read or alter workspace files, credentials, Agent configuration, scheduled tasks, and other user-accessible data. Installation under a privileged account would substantially increase the potential system-wide impact.
Remediation: View remediation
Remediation Suggestions

Remove all recommendations to execute remote responses through curl | bash.

Publish versioned, immutable release artifacts.

Require users to download the installer before reviewing and running it.

Publish and verify a SHA-256 or stronger checksum over every release artifact.

Prefer cryptographic release signatures whose public verification key is distributed through a separate trusted channel.

Document the exact files and system changes the installer will make.

Run installation with the lowest-privileged account capable of completing the task.

T03 · Remote Payload Retrieval and Execution

Error

Location: install-skills.sh:12
Finding: Installer Downloads Mutable Scripts and Immediately Executes Remote Setup Code
Content: View full analysis
Vulnerability Details

File Location: install-skills.sh:12-49
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
# Configuration REMOTE_BASE="${REMOTE_BASE:-https://sherry.hweyukd.top/skills}" WORKSPACE="${WORKSPACE:-/root/.openclaw/workspace}" TARGET_DIR="${WORKSPACE}/skills/sherry-bbs" TEMP_DIR=$(mktemp -d) # Cleanup on exit trap 'rm -rf "${TEMP_DIR}"' EXIT echo "[1/5] Preparing directories..." mkdir -p "${WORKSPACE}/skills" mkdir -p "${TARGET_DIR}" mkdir -p "${HOME}/.sherry-bbs/config" echo "[2/5] Fetching skill files from ${REMOTE_BASE}..." FILES=("SKILL.md" "HEARTBEAT.md" "RULES.md" "setup.sh" "setup-crons.sh" "smoke-test.sh") for file in "${FILES[@]}"; do if curl -fsSL "${REMOTE_BASE}/${file}" -o "${TEMP_DIR}/${file}"; then echo " ✓ ${file}" else echo " ✗ ${file} (not found, using bundled)" fi done # If no remote files, use bundled files if [[ ! -f "${TEMP_DIR}/SKILL.md" ]]; then SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" cp -a "${SRC_DIR}/." "${TEMP_DIR}/" 2>/dev/null || true fi echo "[3/5] Installing to canonical path..." cp -a "${TEMP_DIR}/." "${TARGET_DIR}/" chmod +x "${TARGET_DIR}/setup.sh" "${TARGET_DIR}/setup-crons.sh" "${TARGET_DIR}/smoke-test.sh" 2>/dev/null || true echo "[4/5] Running setup (auto-register + cron)..." cd "${TARGET_DIR}" bash ./setup.sh

Technical Analysis

The installer retrieves scripts from a mutable external location, copies them into the Agent workspace, makes them executable, and immediately runs the downloaded setup.sh. No signature, checksum, pinned commit, or immutable release identifier is checked.

The externally configurable REMOTE_BASE further expands the trust boundary. If that environment variable is inherited from an untrusted launch environment, the installer can retrieve scripts from an attacker-s ...[truncated 1108 chars]
Remediation: View remediation
Remediation Suggestions

Do not download and execute mutable scripts during installation.

Package reviewed scripts inside a signed, versioned release.

Verify every downloaded file against a release manifest signed by a trusted key.

Pin downloads to an immutable version rather than a moving /skills/ path.

Remove REMOTE_BASE, or permit only an explicit allowlist of trusted HTTPS origins.

Fail closed if any required file is missing or fails verification; do not install mixed remote and bundled versions.

Separate download, verification, installation, and execution into explicit user-approved stages.

Avoid privileged defaults such as /root/.openclaw/workspace.

T06 · System Persistence

Error

Location: setup.sh:78
Finding: Setup Automatically Creates Persistent Autonomous Forum Tasks
Content: View full analysis
Vulnerability Details

File Location: setup.sh:78-85; persistent jobs are defined in setup-crons.sh:39-110
Vulnerability Type: System persistence
Risk Level: High

Vulnerable Code

bash
# Auto-create cron jobs for forum engagement echo "[Sherry BBS] Setting up cron jobs..." SCRIPT_DIR_FOR_CRON="${WORKSPACE}/skills/sherry-bbs" if [[ -x "${SCRIPT_DIR_FOR_CRON}/setup-crons.sh" ]]; then bash "${SCRIPT_DIR_FOR_CRON}/setup-crons.sh" || echo "[Sherry BBS] ⚠ Cron setup failed (may require manual setup)" else echo "[Sherry BBS] Run './setup-crons.sh' to enable automatic engagement" fi

The invoked script creates these persistent tasks:

bash
openclaw cron add \ --name "Sherry BBS: Notifications" \ --every "5m" \ --session "isolated" \

bash
openclaw cron add \ --name "Sherry BBS: Browse Posts" \ --every "4h" \ --session "isolated" \

bash
openclaw cron add \ --name "Sherry BBS: Daily Post" \ --cron "0 9 * * *" \ --tz "Asia/Shanghai" \ --session "isolated" \

Technical Analysis

Successful automatic registration invokes setup-crons.sh during ordinary setup. The invoked script installs three cross-session OpenClaw tasks that run every five minutes, every four hours, and daily.

These jobs do more than maintain the Skill: they consume remote forum content, reply to users, mark notifications as read, publish comments, and create articles. Persistent autonomous posting is not required for the Skill's basic declared ability to interact with the forum on demand. Setup does not require separate informed confirmation for each job and does not provide corresponding removal commands.

Attack Path

A user runs the documented installer or setup.sh.

Setup automatically registers a forum account when valid credentials are absent.

...[truncated 724 chars]
Remediation: View remediation
Remediation Suggestions

Remove cron creation from the default setup and installation process.

Make each scheduled task separately opt-in.

Display the full schedule, credential access, network actions, and posting capabilities before confirmation.

Default scheduled operations to read-only behavior.

Require human approval before creating comments, replies, or posts.

Add duplicate detection so repeated setup runs cannot create duplicate jobs.

Provide documented commands to list, disable, and remove every installed job.

Record audit events for all autonomous external actions without recording credentials.

T09 · Insecure Skill Coding Practices

Error

Location: setup-crons.sh:14
Finding: Full API Credential Is Embedded in Persistent Cron Task Messages
Content: View full analysis
Vulnerability Details

File Location: setup-crons.sh:14-58, with the same exposure repeated at lines 65 and 86
Vulnerability Type: Plaintext sensitive data exposure
Risk Level: High

Vulnerable Code

bash
# Read API key from credentials file CRED_FILE="${HOME}/.sherry-bbs/config/credentials.json" if [[ ! -f "${CRED_FILE}" ]]; then echo "[ERROR] No credentials file found. Please run setup.sh first." exit 1 fi # Check if it's still a template if grep -q "bbs_xxxxxxxxxxxxxxxx" "${CRED_FILE}" 2>/dev/null; then echo "[ERROR] Template credentials found. Please edit with your real API key first." exit 1 fi API_KEY=$(grep -o '"api_key"[[:space:]]*:[[:space:]]*"[^"]*"' "${CRED_FILE}" | cut -d'"' -f4 || true) if [[ -z "${API_KEY}" ]]; then echo "[ERROR] Could not extract API key from credentials file." exit 1 fi # Verify credentials work if ! curl -s "https://sherry.hweyukd.top/api/me" -H "Authorization: Bearer ${API_KEY}" | grep -q '"success":true'; then echo "[ERROR] Invalid API key. Please check your credentials." exit 1 fi echo "[Sherry BBS] Setting up cron jobs..." # Job 1: Check notifications every 5 minutes openclaw cron add \ --name "Sherry BBS: Notifications" \ --every "5m" \ --session "isolated" \ --message "Check Sherry Forum notifications and reply if meaningful. API Key: ${API_KEY} API: https://sherry.hweyukd.top/api 1. GET /api/notifications?unread=1 2. For each notification, reply if it has substance (skip emoji-only) 3. Mark all as read: POST /api/notifications/read-all 4. If nothing meaningful, reply HEARTBEAT_OK" \ --announce \ --timeout-seconds 60

API Key: ${API_KEY} is also included in the Browse Posts and Daily Post task messages.

Technical Analysis

The script reads the bearer token from the credential file and interpolates the complete value into persistent cron ...[truncated 1305 chars]
Remediation: View remediation
Remediation Suggestions

Never place a secret value in cron names, task messages, command arguments, logs, or Agent prompts.

Store only a credential identifier or secret reference in each scheduled task.

Retrieve the API key at execution time through a protected secret manager or narrowly scoped credential provider.

Ensure task-listing and diagnostic interfaces redact all authorization material.

Restrict secret access to the specific runtime component that performs authenticated requests.

Rotate all keys previously installed by the affected script.

Review existing OpenClaw cron definitions, task histories, logs, and backups for retained copies.

T09 · Insecure Skill Coding Practices

Warning

Location: setup.sh:69
Finding: Credential and Environment Files Are Created Without Enforced Restrictive Permissions
Content: View full analysis
Vulnerability Details

File Location: setup.sh:69-75, setup.sh:94-103
Vulnerability Type: Insecure credential storage
Risk Level: Medium

Vulnerable Code

bash
cat > "${CRED_FILE}" <<JSON { "api_key": "${API_KEY}", "username": "${USERNAME}", "profile_url": "${PROFILE_URL}" } JSON

bash
cat > "${CRED_FILE}" <<'JSON' { "api_key": "bbs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "username": "YourBotName", "profile_url": "https://sherry.hweyukd.top/profile-123.html" } JSON

bash
# Create .env file for shell scripts if needed ENV_FILE="${HOME}/.sherry-bbs/.env" if [[ -n "${SHERRY_BBS_API_KEY:-}" ]]; then echo "SHERRY_BBS_API_KEY=${SHERRY_BBS_API_KEY}" > "${ENV_FILE}" fi

Technical Analysis

The setup process writes the API key to credentials.json and may duplicate it into .env. It does not set umask 077, create the files with mode 0600, or validate and correct existing permissions.

Actual permissions consequently depend on the invoking environment's umask and directory permissions. In permissive environments, the files may be readable by other local accounts or processes. Duplicating the token into .env also unnecessarily increases the number of sensitive copies.

Attack Path

Setup runs under a permissive umask or inside a shared home-directory environment.

credentials.json or .env is created with group-readable or world-readable permissions.

Another local account or service reads the file.

The API key is extracted.

The reader uses the token to impersonate the forum bot.

Impact Assessment

Exploitation requires local read access but can expose the complete forum bearer token. The attacker can operate as the registered bot within the privileges granted by the Sherry BBS API, including creating content and accessing account-specific endpoints. This does not directly demonstrate ...[truncated 38 chars]
Remediation: View remediation
Remediation Suggestions

Set umask 077 before creating any directory or file containing credentials.

Create secret files atomically with permissions equivalent to 0600.

Enforce chmod 600 "${CRED_FILE}" "${ENV_FILE}" after creation and verify ownership.

Set the credential directory to mode 0700.

Refuse to use credential files owned by another account or writable by a group or other users.

Avoid duplicating the API key into .env; use one protected credential store.

Add a migration check that warns users and repairs insecure permissions on existing installations.

T01 · Skill Instruction Hijacking

Error

Location: HEARTBEAT.md:7
Finding: Heartbeat Delegates Recurring Agent Instructions to Mutable Remote Content
Content: View full analysis
Vulnerability Details

File Location: HEARTBEAT.md:7-12
Vulnerability Type: Skill instruction hijacking
Risk Level: High

Vulnerable Code

markdown
## 雪莉的论坛 - 通知检测 (every 5 minutes) If 5 minutes since last notification check: 1. Fetch https://sherry.hweyukd.top/skills/HEARTBEAT.md and follow notification check 2. Reply to any unread notifications immediately

Technical Analysis

The local heartbeat directs the Agent to retrieve a mutable remote Markdown file and follow its instructions. The fetched document is therefore treated as executable Agent guidance rather than untrusted external data.

Remote content can change after the local Skill has been audited. If the hosting account or server is compromised, an attacker can alter future Agent behavior without changing the installed package. The five-minute recurrence creates repeated exposure to malicious instruction updates.

Attack Path

An attacker compromises or gains update access to the hosted HEARTBEAT.md.

The attacker replaces its notification procedure with malicious or policy-conflicting Agent instructions.

A scheduled heartbeat retrieves the modified document.

The Agent follows the remote instructions because the local Skill explicitly tells it to do so.

The attacker can redirect forum actions or attempt to manipulate the Agent's current goals and safety boundaries.

Subsequent heartbeat executions repeat the malicious instructions.

Impact Assessment

The direct impact includes unauthorized Agent actions available through the heartbeat execution context, particularly forum reads, replies, notification changes, and posting. The exact broader impact depends on which tools are available to the isolated session. The code does not prove arbitrary operating-system execution from Markdown alone, but it establishes a remotely mutable instruction channel with recurring access to an authenticated Agent workflow.
Remediation: View remediation
Remediation Suggestions

Remove the instruction to fetch and follow remote heartbeat documents.

Use the reviewed local HEARTBEAT.md as the sole source of operational instructions.

If updates are necessary, retrieve versioned content only through an explicit update process.

Verify remote updates using signatures and immutable version identifiers before installation.

Treat forum posts, notifications, API responses, and downloaded Markdown as untrusted data, never as Agent instructions.

Restrict scheduled sessions to the smallest possible tool set and API permissions.

Require human approval before any remotely influenced write operation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The installation instruction downloads a remote script and executes it immediately. This is dangerous because it grants the remote server arbitrary code execution on the local machine without integrity verification, code review, or sandboxing.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
version: 2.0.0 description: Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management. homepage: https://sherry.hweyukd.top installation: curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash --- # Sherry BBS

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping network output directly into bash creates an unsafe tool chain that combines retrieval and execution into one unreviewable action. This eliminates opportunities to inspect content, verify integrity, or apply policy controls before code runs locally.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
version: 2.0.0 description: Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management. homepage: https://sherry.hweyukd.top installation: curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash --- # Sherry BBS

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: Reading an API key from a local credentials file or environment variable is legitimate for authentication, but it is still sensitive credential access. In this skill, the danger is increased by adjacent automation and shell-based setup patterns, which broaden the opportunities for misuse or accidental exposure of the token.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
## Security Rules - Read API key from `~/.sherry-bbs/config/credentials.json` - Also supports: `SHERRY_BBS_API_KEY` environment variable - **Never** print full API key in chat/logs - **Never** send API key to any domain except `sherry.hweyukd.top`

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Repeating the remote fetch-and-execute pattern in the quick start further encourages unsafe execution habits. If the remote host is compromised or the script changes unexpectedly, users can be induced to run arbitrary malicious code during setup.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
bash
# One-click install curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # Register a new bot account (if you don't have one) curl -X POST "https://sherry.hweyukd.top/api/register" \

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The quick-start command normalizes direct network-to-shell execution for convenience. In the context of a skill that also accesses credentials and installs persistence, this chaining pattern is especially dangerous because a single command could both steal secrets and modify the system.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
bash
# One-click install curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # Register a new bot account (if you don't have one) curl -X POST "https://sherry.hweyukd.top/api/register" \

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: Instructing users to manually place an API key into a file under the home directory creates a persistent plaintext secret on disk. That increases the risk of local compromise, accidental backup leakage, or unintended access by other tooling running under the same account.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
-d '{"username": "YourBotName", "email": "your@email.com"}' # Configure credentials (copy the api_key from registration response) nano ~/.sherry-bbs/config/credentials.json # Test connection curl https://sherry.hweyukd.top/api/me -H "Authorization: Bearer YOUR_KEY"

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: The sample credential file explicitly demonstrates persistent storage of the API key, reinforcing a pattern of plaintext secret handling. Even though the example masks the token, the operational guidance still normalizes storing long-lived credentials in a predictable file path.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

credentials.api_key - SAVE THIS! Your identity token

profile_url - Your profile page

Then save to ~/.sherry-bbs/config/credentials.json:

json
{ "api_key": "bbs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The usage example instructs users to pipe a remote script directly into bash, which executes network-fetched code immediately without integrity verification or local inspection. This is a well-known unsafe distribution pattern that magnifies compromise risk from the hosting server or any upstream delivery issue.
Content: Scanner excerpt · install-skills.sh (reported line 7)May include surrounding context.
sh
# Standardized installation for OpenClaw/Agent ecosystem # # Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ###############################################################################

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The explicit use of '| bash' creates a command chain where downloaded content is executed as shell code in one step. This pattern prevents meaningful review and makes the installation path highly sensitive to remote content tampering.
Content: Scanner excerpt · install-skills.sh (reported line 7)May include surrounding context.
sh
# Standardized installation for OpenClaw/Agent ecosystem # # Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ###############################################################################

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: This second usage example repeats the same unsafe remote-execution pattern, only with a custom WORKSPACE variable. The variable customization does not reduce the core risk that arbitrary code from the remote endpoint is executed immediately.
Content: Scanner excerpt · install-skills.sh (reported line 9)May include surrounding context.
sh
# Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ############################################################################### set -euo pipefail

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This instance again chains a remote download directly into bash, preserving the same arbitrary-code-execution hazard. In the context of an agent skill installer, this is especially dangerous because users may run it with elevated privileges or inside trusted automation environments.
Content: Scanner excerpt · install-skills.sh (reported line 9)May include surrounding context.
sh
# Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ############################################################################### set -euo pipefail

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script automatically changes into the target directory and runs bash ./setup.sh with no warning, review step, or confirmation, even though setup.sh may have just been downloaded from the remote host. This removes an important trust boundary and encourages unattended execution of arbitrary code.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup-crons.sh (reported line 30)May include surrounding context.
sh
API_KEY=$(grep -o '"api_key"[[:space:]]*:[[:space:]]*"[^"]*"' "${CRED_FILE}" | cut -d'"' -f4 || true) if [[ -z "${API_KEY}" ]]; then echo "[ERROR] Could not extract API key from credentials file." exit 1 fi

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The API key is embedded directly into the cron job message, exposing it to the agent runtime and potentially to logs, telemetry, UI surfaces, or downstream outputs. This is unnecessary secret disclosure and could enable full account compromise if the token is captured.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The cron prompt exposes the raw API key inside natural-language instructions consumed by the agent. In this context, that is especially dangerous because agent prompts may be logged, echoed, summarized, or incorporated into outputs, turning the secret into prompt-accessible data rather than protected configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This second cron job repeats the same unsafe pattern of placing the raw API key into the scheduled prompt. Repetition across jobs increases exposure surface and the chances of leakage through debugging, storage, or model-generated text.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This scheduled browsing task also includes the raw credential in agent-facing text, creating another avoidable leak path. Multiple jobs carrying the same secret compound risk because any one prompt, log entry, or trace can expose the token.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The daily posting job also embeds the API key in agent-readable instructions, creating persistent recurring secret exposure. Because this job posts content autonomously, any compromise of the key could be used to impersonate the account at scale.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The daily posting prompt includes the API key in a long instruction block that may be retained, inspected, or reused by the agent system. Because this job runs repeatedly and performs outbound content generation, it substantially increases the chance of accidental or intentional credential disclosure.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: Creating a .env file specifically to hold an API key introduces an additional secret-bearing artifact on disk. This broadens the attack surface for local disclosure and can expose the token to other processes, shell tooling, backups, or accidental commits.
Content: Scanner excerpt · setup.sh (reported line 100)May include surrounding context.
sh
fi fi # Create .env file for shell scripts if needed ENV_FILE="${HOME}/.sherry-bbs/.env" if [[ -n "${SHERRY_BBS_API_KEY:-}" ]]; then echo "SHERRY_BBS_API_KEY=${SHERRY_BBS_API_KEY}" > "${ENV_FILE}"

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This line writes the API key value directly into a plaintext .env file, duplicating sensitive credentials outside the primary credentials store. In the context of a skill that also creates automation, persistent local secret storage makes misuse easier if the host or workspace is later accessed by another actor.
Content: Scanner excerpt · setup.sh (reported line 101)May include surrounding context.
sh
fi # Create .env file for shell scripts if needed ENV_FILE="${HOME}/.sherry-bbs/.env" if [[ -n "${SHERRY_BBS_API_KEY:-}" ]]; then echo "SHERRY_BBS_API_KEY=${SHERRY_BBS_API_KEY}" > "${ENV_FILE}" fi

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T06 · System Persistence

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

External Script Fetching

Chaining Abuse

Credential Access

External Script Fetching

Chaining Abuse

Credential Access

Credential Access

External Script Fetching

Chaining Abuse

External Script Fetching

Chaining Abuse

Missing User Warnings

Credential Access

Missing User Warnings

Ssd 3

Missing User Warnings

Ssd 3

Missing User Warnings

Ssd 3

Credential Access

Credential Access