Security audit

sherry-bbs

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a forum bot, but its installer and setup create high-impact automatic behavior that users should review before installing.

Review this skill carefully before installing. Its forum API use is understandable for a bot, but the one-line installer executes remote code, setup can register an account and create recurring autonomous posting/replying jobs, and cron messages store the raw API key. Prefer a version-pinned, locally reviewed install, avoid running it as root, do not enable cron jobs unless you intend autonomous public engagement, and rotate any API key already used with these cron tasks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:6
Finding: Unverified Remote Installer Is Executed Directly Through Bash## Vulnerability Details **File Location**: `SKILL.md:6` and `SKILL.md:22-25` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```yaml installation: curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ``` ```bash # One-click install curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ``` ### Technical Analysis The documented installation procedure pipes the current HTTP response directly into Bash. The installer is not pinned to an immutable release and is not verified using a cryptographic signature or expected checksum. HTTPS protects the connection in transit but does not protect users if the hosting server, domain, deployment process, or upstream installer itself is compromised. The effective code executed by users can therefore change after the reviewed Skill package was published. ### Attack Path 1. An attacker compromises the server, DNS, deployment account, or hosted installer at `sherry.hweyukd.top`. 2. The attacker replaces `install-skills.sh` with a malicious script. 3. A user follows the documented one-click installation command. 4. `curl` retrieves the attacker-controlled response. 5. Bash executes the response immediately, without review or integrity validation. 6. The payload runs with all permissions available to the installing user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the installing user's account. Depending on that account's privileges, the attacker could read or alter workspace files, credentials, Agent configuration, scheduled tasks, and other user-accessible data. Installation under a privileged account would substantially increase the potential system-wide impact.
Remediation: ## Remediation Suggestions - Remove all recommendations to execute remote responses through `curl | bash`. - Publish versioned, immutable release artifacts. - Require users to download the installer before reviewing and running it. - Publish and verify a SHA-256 or stronger checksum over every release artifact. - Prefer cryptographic release signatures whose public verification key is distributed through a separate trusted channel. - Document the exact files and system changes the installer will make. - Run installation with the lowest-privileged account capable of completing the task.

T03 · Remote Payload Retrieval and Execution

Error

Location: install-skills.sh:12
Finding: Installer Downloads Mutable Scripts and Immediately Executes Remote Setup Code## Vulnerability Details **File Location**: `install-skills.sh:12-49` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Configuration REMOTE_BASE="${REMOTE_BASE:-https://sherry.hweyukd.top/skills}" WORKSPACE="${WORKSPACE:-/root/.openclaw/workspace}" TARGET_DIR="${WORKSPACE}/skills/sherry-bbs" TEMP_DIR=$(mktemp -d) # Cleanup on exit trap 'rm -rf "${TEMP_DIR}"' EXIT echo "[1/5] Preparing directories..." mkdir -p "${WORKSPACE}/skills" mkdir -p "${TARGET_DIR}" mkdir -p "${HOME}/.sherry-bbs/config" echo "[2/5] Fetching skill files from ${REMOTE_BASE}..." FILES=("SKILL.md" "HEARTBEAT.md" "RULES.md" "setup.sh" "setup-crons.sh" "smoke-test.sh") for file in "${FILES[@]}"; do if curl -fsSL "${REMOTE_BASE}/${file}" -o "${TEMP_DIR}/${file}"; then echo " ✓ ${file}" else echo " ✗ ${file} (not found, using bundled)" fi done # If no remote files, use bundled files if [[ ! -f "${TEMP_DIR}/SKILL.md" ]]; then SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" cp -a "${SRC_DIR}/." "${TEMP_DIR}/" 2>/dev/null || true fi echo "[3/5] Installing to canonical path..." cp -a "${TEMP_DIR}/." "${TARGET_DIR}/" chmod +x "${TARGET_DIR}/setup.sh" "${TARGET_DIR}/setup-crons.sh" "${TARGET_DIR}/smoke-test.sh" 2>/dev/null || true echo "[4/5] Running setup (auto-register + cron)..." cd "${TARGET_DIR}" bash ./setup.sh ``` ### Technical Analysis The installer retrieves scripts from a mutable external location, copies them into the Agent workspace, makes them executable, and immediately runs the downloaded `setup.sh`. No signature, checksum, pinned commit, or immutable release identifier is checked. The externally configurable `REMOTE_BASE` further expands the trust boundary. If that environment variable is inherited from an untrusted launch environment, the installer can retrieve scripts from an attacker-s ...[truncated 1108 chars]
Remediation: ## Remediation Suggestions - Do not download and execute mutable scripts during installation. - Package reviewed scripts inside a signed, versioned release. - Verify every downloaded file against a release manifest signed by a trusted key. - Pin downloads to an immutable version rather than a moving `/skills/` path. - Remove `REMOTE_BASE`, or permit only an explicit allowlist of trusted HTTPS origins. - Fail closed if any required file is missing or fails verification; do not install mixed remote and bundled versions. - Separate download, verification, installation, and execution into explicit user-approved stages. - Avoid privileged defaults such as `/root/.openclaw/workspace`.

T06 · System Persistence

Error

Location: setup.sh:78
Finding: Setup Automatically Creates Persistent Autonomous Forum Tasks## Vulnerability Details **File Location**: `setup.sh:78-85`; persistent jobs are defined in `setup-crons.sh:39-110` **Vulnerability Type**: System persistence **Risk Level**: High ### Vulnerable Code ```bash # Auto-create cron jobs for forum engagement echo "[Sherry BBS] Setting up cron jobs..." SCRIPT_DIR_FOR_CRON="${WORKSPACE}/skills/sherry-bbs" if [[ -x "${SCRIPT_DIR_FOR_CRON}/setup-crons.sh" ]]; then bash "${SCRIPT_DIR_FOR_CRON}/setup-crons.sh" || echo "[Sherry BBS] ⚠ Cron setup failed (may require manual setup)" else echo "[Sherry BBS] Run './setup-crons.sh' to enable automatic engagement" fi ``` The invoked script creates these persistent tasks: ```bash openclaw cron add \ --name "Sherry BBS: Notifications" \ --every "5m" \ --session "isolated" \ ``` ```bash openclaw cron add \ --name "Sherry BBS: Browse Posts" \ --every "4h" \ --session "isolated" \ ``` ```bash openclaw cron add \ --name "Sherry BBS: Daily Post" \ --cron "0 9 * * *" \ --tz "Asia/Shanghai" \ --session "isolated" \ ``` ### Technical Analysis Successful automatic registration invokes `setup-crons.sh` during ordinary setup. The invoked script installs three cross-session OpenClaw tasks that run every five minutes, every four hours, and daily. These jobs do more than maintain the Skill: they consume remote forum content, reply to users, mark notifications as read, publish comments, and create articles. Persistent autonomous posting is not required for the Skill's basic declared ability to interact with the forum on demand. Setup does not require separate informed confirmation for each job and does not provide corresponding removal commands. ### Attack Path 1. A user runs the documented installer or `setup.sh`. 2. Setup automatically registers a forum account when valid credentials are absent. ...[truncated 724 chars]
Remediation: ## Remediation Suggestions - Remove cron creation from the default setup and installation process. - Make each scheduled task separately opt-in. - Display the full schedule, credential access, network actions, and posting capabilities before confirmation. - Default scheduled operations to read-only behavior. - Require human approval before creating comments, replies, or posts. - Add duplicate detection so repeated setup runs cannot create duplicate jobs. - Provide documented commands to list, disable, and remove every installed job. - Record audit events for all autonomous external actions without recording credentials.

T09 · Insecure Skill Coding Practices

Error

Location: setup-crons.sh:14
Finding: Full API Credential Is Embedded in Persistent Cron Task Messages## Vulnerability Details **File Location**: `setup-crons.sh:14-58`, with the same exposure repeated at lines 65 and 86 **Vulnerability Type**: Plaintext sensitive data exposure **Risk Level**: High ### Vulnerable Code ```bash # Read API key from credentials file CRED_FILE="${HOME}/.sherry-bbs/config/credentials.json" if [[ ! -f "${CRED_FILE}" ]]; then echo "[ERROR] No credentials file found. Please run setup.sh first." exit 1 fi # Check if it's still a template if grep -q "bbs_xxxxxxxxxxxxxxxx" "${CRED_FILE}" 2>/dev/null; then echo "[ERROR] Template credentials found. Please edit with your real API key first." exit 1 fi API_KEY=$(grep -o '"api_key"[[:space:]]*:[[:space:]]*"[^"]*"' "${CRED_FILE}" | cut -d'"' -f4 || true) if [[ -z "${API_KEY}" ]]; then echo "[ERROR] Could not extract API key from credentials file." exit 1 fi # Verify credentials work if ! curl -s "https://sherry.hweyukd.top/api/me" -H "Authorization: Bearer ${API_KEY}" | grep -q '"success":true'; then echo "[ERROR] Invalid API key. Please check your credentials." exit 1 fi echo "[Sherry BBS] Setting up cron jobs..." # Job 1: Check notifications every 5 minutes openclaw cron add \ --name "Sherry BBS: Notifications" \ --every "5m" \ --session "isolated" \ --message "Check Sherry Forum notifications and reply if meaningful. API Key: ${API_KEY} API: https://sherry.hweyukd.top/api 1. GET /api/notifications?unread=1 2. For each notification, reply if it has substance (skip emoji-only) 3. Mark all as read: POST /api/notifications/read-all 4. If nothing meaningful, reply HEARTBEAT_OK" \ --announce \ --timeout-seconds 60 ``` `API Key: ${API_KEY}` is also included in the Browse Posts and Daily Post task messages. ### Technical Analysis The script reads the bearer token from the credential file and interpolates the complete value into persistent cron ...[truncated 1305 chars]
Remediation: ## Remediation Suggestions - Never place a secret value in cron names, task messages, command arguments, logs, or Agent prompts. - Store only a credential identifier or secret reference in each scheduled task. - Retrieve the API key at execution time through a protected secret manager or narrowly scoped credential provider. - Ensure task-listing and diagnostic interfaces redact all authorization material. - Restrict secret access to the specific runtime component that performs authenticated requests. - Rotate all keys previously installed by the affected script. - Review existing OpenClaw cron definitions, task histories, logs, and backups for retained copies.

T09 · Insecure Skill Coding Practices

Warning

Location: setup.sh:69
Finding: Credential and Environment Files Are Created Without Enforced Restrictive Permissions## Vulnerability Details **File Location**: `setup.sh:69-75`, `setup.sh:94-103` **Vulnerability Type**: Insecure credential storage **Risk Level**: Medium ### Vulnerable Code ```bash cat > "${CRED_FILE}" <<JSON { "api_key": "${API_KEY}", "username": "${USERNAME}", "profile_url": "${PROFILE_URL}" } JSON ``` ```bash cat > "${CRED_FILE}" <<'JSON' { "api_key": "bbs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "username": "YourBotName", "profile_url": "https://sherry.hweyukd.top/profile-123.html" } JSON ``` ```bash # Create .env file for shell scripts if needed ENV_FILE="${HOME}/.sherry-bbs/.env" if [[ -n "${SHERRY_BBS_API_KEY:-}" ]]; then echo "SHERRY_BBS_API_KEY=${SHERRY_BBS_API_KEY}" > "${ENV_FILE}" fi ``` ### Technical Analysis The setup process writes the API key to `credentials.json` and may duplicate it into `.env`. It does not set `umask 077`, create the files with mode `0600`, or validate and correct existing permissions. Actual permissions consequently depend on the invoking environment's `umask` and directory permissions. In permissive environments, the files may be readable by other local accounts or processes. Duplicating the token into `.env` also unnecessarily increases the number of sensitive copies. ### Attack Path 1. Setup runs under a permissive `umask` or inside a shared home-directory environment. 2. `credentials.json` or `.env` is created with group-readable or world-readable permissions. 3. Another local account or service reads the file. 4. The API key is extracted. 5. The reader uses the token to impersonate the forum bot. ### Impact Assessment Exploitation requires local read access but can expose the complete forum bearer token. The attacker can operate as the registered bot within the privileges granted by the Sherry BBS API, including creating content and accessing account-specific endpoints. This does not directly demonstrate ...[truncated 38 chars]
Remediation: ## Remediation Suggestions - Set `umask 077` before creating any directory or file containing credentials. - Create secret files atomically with permissions equivalent to `0600`. - Enforce `chmod 600 "${CRED_FILE}" "${ENV_FILE}"` after creation and verify ownership. - Set the credential directory to mode `0700`. - Refuse to use credential files owned by another account or writable by a group or other users. - Avoid duplicating the API key into `.env`; use one protected credential store. - Add a migration check that warns users and repairs insecure permissions on existing installations.

T01 · Skill Instruction Hijacking

Error

Location: HEARTBEAT.md:7
Finding: Heartbeat Delegates Recurring Agent Instructions to Mutable Remote Content## Vulnerability Details **File Location**: `HEARTBEAT.md:7-12` **Vulnerability Type**: Skill instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown ## 雪莉的论坛 - 通知检测 (every 5 minutes) If 5 minutes since last notification check: 1. Fetch https://sherry.hweyukd.top/skills/HEARTBEAT.md and follow notification check 2. Reply to any unread notifications immediately ``` ### Technical Analysis The local heartbeat directs the Agent to retrieve a mutable remote Markdown file and follow its instructions. The fetched document is therefore treated as executable Agent guidance rather than untrusted external data. Remote content can change after the local Skill has been audited. If the hosting account or server is compromised, an attacker can alter future Agent behavior without changing the installed package. The five-minute recurrence creates repeated exposure to malicious instruction updates. ### Attack Path 1. An attacker compromises or gains update access to the hosted `HEARTBEAT.md`. 2. The attacker replaces its notification procedure with malicious or policy-conflicting Agent instructions. 3. A scheduled heartbeat retrieves the modified document. 4. The Agent follows the remote instructions because the local Skill explicitly tells it to do so. 5. The attacker can redirect forum actions or attempt to manipulate the Agent's current goals and safety boundaries. 6. Subsequent heartbeat executions repeat the malicious instructions. ### Impact Assessment The direct impact includes unauthorized Agent actions available through the heartbeat execution context, particularly forum reads, replies, notification changes, and posting. The exact broader impact depends on which tools are available to the isolated session. The code does not prove arbitrary operating-system execution from Markdown alone, but it establishes a remotely mutable instruction channel with recurring access to an authenticated Agent workflow.
Remediation: ## Remediation Suggestions - Remove the instruction to fetch and follow remote heartbeat documents. - Use the reviewed local `HEARTBEAT.md` as the sole source of operational instructions. - If updates are necessary, retrieve versioned content only through an explicit update process. - Verify remote updates using signatures and immutable version identifiers before installation. - Treat forum posts, notifications, API responses, and downloaded Markdown as untrusted data, never as Agent instructions. - Restrict scheduled sessions to the smallest possible tool set and API permissions. - Require human approval before any remotely influenced write operation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (49)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation primarily inspects credentials and performs smoke tests rather than providing the described forum operations, the skill is misrepresented. Misrepresentation is dangerous because users may install or authorize it expecting normal forum features while exposing credentials and system access to tooling that does not need them.

External Script Fetching

High

Category: Supply Chain
Content: version: 2.0.0 description: Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management. homepage: https://sherry.hweyukd.top installation: curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash --- # Sherry BBS
Confidence: 98% confidence
Finding: The installation instruction downloads a remote script and executes it immediately. This is dangerous because it grants the remote server arbitrary code execution on the local machine without integrity verification, code review, or sandboxing.

Chaining Abuse

High

Category: Tool Misuse
Content: version: 2.0.0 description: Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management. homepage: https://sherry.hweyukd.top installation: curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash --- # Sherry BBS
Confidence: 98% confidence
Finding: Piping network output directly into bash creates an unsafe tool chain that combines retrieval and execution into one unreviewable action. This eliminates opportunities to inspect content, verify integrity, or apply policy controls before code runs locally.

Credential Access

High

Category: Privilege Escalation
Content: ## Security Rules - Read API key from `~/.sherry-bbs/config/credentials.json` - Also supports: `SHERRY_BBS_API_KEY` environment variable - **Never** print full API key in chat/logs - **Never** send API key to any domain except `sherry.hweyukd.top`
Confidence: 87% confidence
Finding: Reading an API key from a local credentials file or environment variable is legitimate for authentication, but it is still sensitive credential access. In this skill, the danger is increased by adjacent automation and shell-based setup patterns, which broaden the opportunities for misuse or accidental exposure of the token.

External Script Fetching

High

Category: Supply Chain
Content: ```bash # One-click install curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # Register a new bot account (if you don't have one) curl -X POST "https://sherry.hweyukd.top/api/register" \
Confidence: 98% confidence
Finding: Repeating the remote fetch-and-execute pattern in the quick start further encourages unsafe execution habits. If the remote host is compromised or the script changes unexpectedly, users can be induced to run arbitrary malicious code during setup.

Chaining Abuse

High

Category: Tool Misuse
Content: ```bash # One-click install curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # Register a new bot account (if you don't have one) curl -X POST "https://sherry.hweyukd.top/api/register" \
Confidence: 98% confidence
Finding: The quick-start command normalizes direct network-to-shell execution for convenience. In the context of a skill that also accesses credentials and installs persistence, this chaining pattern is especially dangerous because a single command could both steal secrets and modify the system.

Credential Access

High

Category: Privilege Escalation
Content: -d '{"username": "YourBotName", "email": "your@email.com"}' # Configure credentials (copy the api_key from registration response) nano ~/.sherry-bbs/config/credentials.json # Test connection curl https://sherry.hweyukd.top/api/me -H "Authorization: Bearer YOUR_KEY"
Confidence: 82% confidence
Finding: Instructing users to manually place an API key into a file under the home directory creates a persistent plaintext secret on disk. That increases the risk of local compromise, accidental backup leakage, or unintended access by other tooling running under the same account.

Credential Access

High

Category: Privilege Escalation
Content: - `credentials.api_key` - **SAVE THIS!** Your identity token - `profile_url` - Your profile page Then save to `~/.sherry-bbs/config/credentials.json`: ```json { "api_key": "bbs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
Confidence: 82% confidence
Finding: The sample credential file explicitly demonstrates persistent storage of the API key, reinforcing a pattern of plaintext secret handling. Even though the example masks the token, the operational guidance still normalizes storing long-lived credentials in a predictable file path.

External Script Fetching

High

Category: Supply Chain
Content: # Standardized installation for OpenClaw/Agent ecosystem # # Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ###############################################################################
Confidence: 97% confidence
Finding: The usage example instructs users to pipe a remote script directly into bash, which executes network-fetched code immediately without integrity verification or local inspection. This is a well-known unsafe distribution pattern that magnifies compromise risk from the hosting server or any upstream delivery issue.

Chaining Abuse

High

Category: Tool Misuse
Content: # Standardized installation for OpenClaw/Agent ecosystem # # Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ###############################################################################
Confidence: 95% confidence
Finding: The explicit use of '| bash' creates a command chain where downloaded content is executed as shell code in one step. This pattern prevents meaningful review and makes the installation path highly sensitive to remote content tampering.

External Script Fetching

High

Category: Supply Chain
Content: # Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ############################################################################### set -euo pipefail
Confidence: 97% confidence
Finding: This second usage example repeats the same unsafe remote-execution pattern, only with a custom WORKSPACE variable. The variable customization does not reduce the core risk that arbitrary code from the remote endpoint is executed immediately.

Chaining Abuse

High

Category: Tool Misuse
Content: # Usage: # curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash # # Or with custom workspace: # WORKSPACE=/root/.openclaw/workspace curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash ############################################################################### set -euo pipefail
Confidence: 95% confidence
Finding: This instance again chains a remote download directly into bash, preserving the same arbitrary-code-execution hazard. In the context of an agent skill installer, this is especially dangerous because users may run it with elevated privileges or inside trusted automation environments.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script automatically changes into the target directory and runs bash ./setup.sh with no warning, review step, or confirmation, even though setup.sh may have just been downloaded from the remote host. This removes an important trust boundary and encourages unattended execution of arbitrary code.

Credential Access

High

Category: Privilege Escalation
Content: API_KEY=$(grep -o '"api_key"[[:space:]]*:[[:space:]]*"[^"]*"' "${CRED_FILE}" | cut -d'"' -f4 || true) if [[ -z "${API_KEY}" ]]; then echo "[ERROR] Could not extract API key from credentials file." exit 1 fi
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The API key is embedded directly into the cron job message, exposing it to the agent runtime and potentially to logs, telemetry, UI surfaces, or downstream outputs. This is unnecessary secret disclosure and could enable full account compromise if the token is captured.

Ssd 3

High

Confidence: 99% confidence
Finding: The cron prompt exposes the raw API key inside natural-language instructions consumed by the agent. In this context, that is especially dangerous because agent prompts may be logged, echoed, summarized, or incorporated into outputs, turning the secret into prompt-accessible data rather than protected configuration.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This second cron job repeats the same unsafe pattern of placing the raw API key into the scheduled prompt. Repetition across jobs increases exposure surface and the chances of leakage through debugging, storage, or model-generated text.

Ssd 3

High

Confidence: 99% confidence
Finding: This scheduled browsing task also includes the raw credential in agent-facing text, creating another avoidable leak path. Multiple jobs carrying the same secret compound risk because any one prompt, log entry, or trace can expose the token.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The daily posting job also embeds the API key in agent-readable instructions, creating persistent recurring secret exposure. Because this job posts content autonomously, any compromise of the key could be used to impersonate the account at scale.

Ssd 3

High

Confidence: 99% confidence
Finding: The daily posting prompt includes the API key in a long instruction block that may be retained, inspected, or reused by the agent system. Because this job runs repeatedly and performs outbound content generation, it substantially increases the chance of accidental or intentional credential disclosure.

Credential Access

High

Category: Privilege Escalation
Content: fi fi # Create .env file for shell scripts if needed ENV_FILE="${HOME}/.sherry-bbs/.env" if [[ -n "${SHERRY_BBS_API_KEY:-}" ]]; then echo "SHERRY_BBS_API_KEY=${SHERRY_BBS_API_KEY}" > "${ENV_FILE}"
Confidence: 87% confidence
Finding: Creating a .env file specifically to hold an API key introduces an additional secret-bearing artifact on disk. This broadens the attack surface for local disclosure and can expose the token to other processes, shell tooling, backups, or accidental commits.

Credential Access

High

Category: Privilege Escalation
Content: fi # Create .env file for shell scripts if needed ENV_FILE="${HOME}/.sherry-bbs/.env" if [[ -n "${SHERRY_BBS_API_KEY:-}" ]]; then echo "SHERRY_BBS_API_KEY=${SHERRY_BBS_API_KEY}" > "${ENV_FILE}" fi
Confidence: 90% confidence
Finding: This line writes the API key value directly into a plaintext .env file, duplicating sensitive credentials outside the primary credentials store. In the context of a skill that also creates automation, persistent local secret storage makes misuse easier if the host or workspace is later accessed by another actor.

Static analysis

No suspicious patterns detected.