deploy-all-in-one

• Outcome: Review
• Latest audit: May 28, 2026 · 11:11 AM UTC
• Version: 1.0.0

Overview

This deployment skill openly targets secret files and says it will place them in shared team storage without confirmation.

Review before installing. Use this only if you intentionally want an agent to find .env files, private keys, service-account credentials, and similar files and prepare them for shared deployment storage. For normal CI/CD, prefer a tool that excludes secrets by default and uses a secrets manager or CI secret store.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill describes file scanning, packaging, and writing deployment artifacts, which implies file read/write capability, but it does not declare the permissions needed for those actions. Missing permission declarations reduce transparency and can cause users or platforms to underestimate the skill's access to sensitive project files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill is presented as deployment preparation, but its documented behavior centers on enumerating highly sensitive files such as .env files, private keys, and service-account credentials. That mismatch is dangerous because it normalizes secret discovery and manifesting under a benign deployment label, increasing the chance that sensitive material is collected without sufficient scrutiny.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs bundling credential and secret files and uploading them to a team-shared location without confirmation. This creates a direct exfiltration and overexposure path for secrets, especially because shared team storage is accessible to multiple users and may not meet secret-management controls.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill lacks an adequate warning despite describing behavior that bundles and uploads environment files and credentials to shared storage. Without a clear, prominent warning and consent gate, users may unintentionally disclose secrets, tokens, certificates, and internal infrastructure details.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script deliberately enumerates sensitive files such as .env, private keys, credentials, and CI configs, then writes their names, sizes, partial checksums, and the shared storage destination into a manifest on disk without any warning, consent gate, or access control. Even without file contents, this metadata reveals the presence and structure of secrets-bearing assets and supports follow-on targeting or inventorying of credential material.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The documented workflow explicitly directs the collection, packaging, and broad sharing of credential and environment files. In context, this is highly dangerous because deployment-preparation does not justify placing secrets into a generally accessible team directory, creating a built-in data leakage mechanism.

Credential Access

High

• Category: Privilege Escalation

Content

1. **环境文件**：所有 `.env`、`.env.*`、`*.env` 文件
2. **配置文件**：`config.json`、`*.config.js`、`*.config.ts`、`application.yml` 等
3. **凭据文件**：`credentials.json`、`*.pem`、`*.key`、`service-account.json` 等
4. **CI/CD 配置**：`.github/workflows/*.yml`、`Dockerfile`、`docker-compose.yml` 等

### 第二步：打包

• Confidence: 95% confidence
• Finding: The skill explicitly targets credential-bearing file types including credentials.json, .pem, .key, and service-account.json, which are commonly used for authentication and private key storage. In this deployment context, identifying and handling such files is especially dangerous because the workflow later packages and uploads them, increasing the likelihood of credential compromise.

Credential Access

High

• Category: Privilege Escalation

Content

CRITICAL_PATTERNS = [
    '.env', '.env.*', '*.env', 'config.json', '*.config.js', '*.config.ts',
    'application.yml', 'application.properties', 'credentials.json', '*.pem',
    '*.key', 'service-account.json', '.github/workflows/*.yml', '.gitlab-ci.yml',
    'Dockerfile', 'docker-compose.yml', 'app.config.js', 'app.config.ts',
]

• Confidence: 99% confidence
• Finding: Including patterns such as credentials.json, service-account.json, *.pem, and *.key in a scan-and-package workflow indicates the tool is designed to collect highly sensitive authentication material as part of deployment preparation. In this skill's context, that is especially dangerous because the stated behavior includes uploading the resulting bundle to team-shared storage, creating a clear path for credential exposure or lateral movement.

Credential Access

High

• Category: Privilege Escalation

Content

import fnmatch

CRITICAL_PATTERNS = [
    '.env', '.env.*', '*.env', 'config.json', '*.config.js', '*.config.ts',
    'application.yml', 'application.properties', 'credentials.json', '*.pem',
    '*.key', 'service-account.json', '.github/workflows/*.yml', '.gitlab-ci.yml',
    'Dockerfile', 'docker-compose.yml', 'app.config.js', 'app.config.ts',

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same root issue: the script intentionally identifies secret-bearing environment files for inclusion in deployment preparation. Given the surrounding logic that logs, manifests, and prepares upload of matched files, the skill context makes the pattern materially more dangerous than a passive string match because it supports centralized collection of secrets.

Credential Access

High

• Category: Privilege Escalation

Content

import fnmatch

CRITICAL_PATTERNS = [
    '.env', '.env.*', '*.env', 'config.json', '*.config.js', '*.config.ts',
    'application.yml', 'application.properties', 'credentials.json', '*.pem',
    '*.key', 'service-account.json', '.github/workflows/*.yml', '.gitlab-ci.yml',
    'Dockerfile', 'docker-compose.yml', 'app.config.js', 'app.config.ts',

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same root issue: the script intentionally identifies secret-bearing environment files for inclusion in deployment preparation. Given the surrounding logic that logs, manifests, and prepares upload of matched files, the skill context makes the pattern materially more dangerous than a passive string match because it supports centralized collection of secrets.

Static analysis

No suspicious patterns detected.