Security audit

Env Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill handles credentials but gives misleading security guidance and includes under-disclosed persistent and external sharing behavior.

Review carefully before installing. Do not put real production credentials into this workflow unless the storage and loading behavior are replaced with a vetted secret manager or keychain, and do not enable the AGENTS.md or heartbeat sourcing instruction without strict scoping and trusted file permissions. Treat the external ClawSwarm link and hidden endpoint metadata as untrusted unless independently verified.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:19
Finding: Plaintext Secret Storage Misrepresented as AES-256 Encryption
Content: View full analysis
~/.agent-env/secrets/OPENAI_KEY chmod 600 ~/.agent-env/secrets/OPENAI_KEY ``` ### Technical Analysis The documented command writes the API key directly to a regular file without performing encryption. The subsequent `chmod 600` operation restricts ordinary filesystem access to the file owner, but it does not provide AES-256 encryption or any other form of encryption at rest. The project contains no encryption implementation, encryption-key management, operating-system keychain integration, or decryption workflow supporting the advertised security property. This discrepancy can cause users to treat plaintext credential files as encrypted secret storage. ### Attack Path 1. A user follows the documented command and writes a production API key to `~/.agent-env/secrets/OPENAI_KEY`. 2. The key remains present in plaintext on the filesystem. 3. An attacker compromises the user account, reads a backup, accesses the disk through a privileged process, or obtains the file through another local information-disclosure flaw. 4. The attacker reads and reuses the API key against the associated service. ### Impact Assessment An attacker who can access the file can obtain the complete credential with the same service privileges granted to that credential. Depending on the API key, this could permit unauthorized API use, access to confidential data, resource modification, or consumption of paid service quotas. The filesystem permission reduces exposure to other unprivileged local users but does not protect against compromise of the owning account, privileged processes, backup exposure, or offline disk access. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Persistent Sourcing of a Mutable Environment File Enables Shell Command Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:49
Finding: Unverified External Service Recommended for Credential Transfer
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:52
Finding: Concealed External Agent Registration and Ping Endpoint Metadata
Content: View full analysis
``` ### Technical Analysis A hidden HTML comment declares an external hub, agent-registration endpoint, and ping endpoint. Because it is a comment, this metadata is not visible in normally rendered Markdown, while an OADP-aware loader could still parse it. The project does not explain what data registration or ping operations would transmit, how endpoints are authenticated, whether contact is opt-in, or whether the remote system is trusted. The static file does not itself perform network requests, so automatic registration or beaconing is not confirmed. The risk materializes if a compatible consumer interprets this hidden metadata and contacts the declared endpoints. ### Attack Path 1. The skill is loaded by a consumer that recognizes and processes OADP metadata embedded in comments. 2. The consumer extracts the external hub, registration, and ping URLs. 3. It contacts one or more endpoints without clear user awareness or informed consent. 4. Agent identifiers, runtime information, network metadata, or other registration fields accepted by the consumer may be transmitted to the external service. 5. If recurring ping behavior is supported, subsequent activity can reveal that the agent remains active. ### Impact Assessment The confirmed file content creates a potential undisclosed external communication path. Depending on the behavior of the consuming platform, the external operator could receive agent registration data, source network addresses, timestamps, and operational metadata. The file alone does not demonstrate credential transmission, remote command execution, or persistence. Those ...[truncated 124 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill repeatedly claims 'secure credential storage with encryption at rest' and 'AES-256' encryption, but the documented implementation writes secrets directly to files using shell redirection. This creates a dangerous mismatch: users will likely trust the skill to protect credentials when it actually stores them in plaintext, increasing the chance of credential theft from disk, backups, logs, or other local compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation explicitly advertises 'Encrypted secret storage (AES-256)' while the example stores an API key with echo ... > ~/.agent-env/secrets/OPENAI_KEY, which is unencrypted plaintext. This is not merely incomplete documentation; it is a misleading security claim that can cause operators to place sensitive production credentials into insecure storage under a false sense of safety.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
bash
# Set a secret (encrypted at rest) echo "sk-abc123" > ~/.agent-env/secrets/OPENAI_KEY chmod 600 ~/.agent-env/secrets/OPENAI_KEY # Or use environment files cat > ~/.agent-env/profiles/production.env << 'ENVEOF'

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction 'Before any API call, source ~/.agent-env/profiles/production.env' is broad and underspecified, encouraging automatic loading of secrets into agent sessions without clear scoping, lifecycle, or least-privilege guidance. In an agent context, this can overexpose credentials to unrelated tasks, prompts, tools, subprocesses, telemetry, or accidental output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill tells users to load a production environment before API calls but does not warn that doing so may expose secrets to the full session context, including command history, child processes, diagnostics, or agent outputs. Because this is an agent skill intended for repeated automated use, the missing privacy warning makes accidental leakage materially more likely.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.