Security audit

Keychains.dev

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate-looking credential proxy, but it gives a third-party service and globally installed CLI broad ongoing authority over authenticated API requests.

Review keychains.dev's security, privacy, retention, and audit controls before installing. Avoid using it for regulated or highly sensitive data unless approved by your organization, prefer pinned package versions, avoid global installation where possible, and verify requested API scopes before approving provider access.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:6
Finding: Unpinned Third-Party Packages and Global CLI Installation Create Supply-Chain Risk
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:6, SKILL.md:68-71, and SKILL.md:91-94
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:6:

yaml
metadata: {"openclaw": {"emoji": "🔐", "homepage": "https://keychains.dev", "requires": {"bins": ["keychains"]}, "install": [{"id": "npm", "kind": "node", "package": "keychains@latest", "global": true, "bins": ["keychains"], "label": "Install Keychains CLI (npm)"}]}}

SKILL.md:68-71:

markdown
For TypeScript/Node.js agents, `@keychains/machine-sdk` provides `keychainsFetch()` — a drop-in `fetch()` replacement with the same automatic registration and credential handling as the CLI.

npm install @keychains/machine-sdk

text

SKILL.md:91-94:

markdown
| SDK | Install | Description | |-----|---------|-------------| | [Python SDK](https://pypi.org/project/keychains/) | `pip install keychains` | Drop-in `requests` replacement. `keychains.get()`, `keychains.post()`, `keychains.Session()`. | | [Client SDK](https://www.npmjs.com/package/@keychains/client-sdk) | `npm install @keychains/client-sdk` | TypeScript SDK for delegated environments (VMs, cloud functions). |

Technical Analysis

The primary installation configuration resolves keychains@latest, while the documented Node.js and Python SDK installation commands omit versions entirely. These mutable dependency specifications allow the installed code to differ from the code that was reviewed.

The primary CLI is also configured for global installation. If a malicious package version is resolved, its lifecycle scripts or runtime code may execute with the privileges of the user performing the installation. A global installation also increases exposure because the resulting executable remains available to unrelated sessions and projects.

This is particularly sensitive because the installed components mediate authenticated API re ...[truncated 2004 chars]
Remediation: View remediation
Remediation Suggestions

Replace keychains@latest with a reviewed, exact version such as keychains@X.Y.Z.

Pin exact versions for @keychains/machine-sdk, @keychains/client-sdk, and the Python keychains package.

Use lockfiles and registry-supported integrity hashes to ensure reproducible dependency resolution.

Avoid global installation where possible. Prefer a project-local dependency invoked through a controlled package script or an isolated environment.

Do not run package installation with administrator or root privileges.

Review package lifecycle scripts before installation and disable them where operationally feasible.

Verify package publisher identity, provenance attestations, signatures, and registry source.

Add automated dependency scanning and require manual security review before updating pinned versions.

Run the proxy client with restricted filesystem and network permissions, limiting outbound traffic to the documented proxy and approved API destinations.

Present the user with the destination, HTTP method, requested authorization scope, and consequential action before approval.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
text
```typescript import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk'; try { const res = await keychainsFetch('https://api.github.com/user/repos', {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
text
```typescript import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk'; try { const res = await keychainsFetch('https://api.github.com/user/repos', {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
Basic usage:

text
keychains curl https://api.github.com/user/repos \ -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples encourage sending requests containing potentially sensitive headers, bodies, and query parameters through keychains.dev without an immediate, prominent warning in the example section that all request content is proxied via a third-party service. While the document discloses proxying later, users may copy-paste the examples before understanding that API payload data—not just credentials—will transit and potentially be retained or logged by an external provider.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
- "List GitHub repos: `keychains curl https://api.github.com/user/repos -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'`" - "Send Slack message: `keychains curl https://slack.com/api/chat.postMessage -X POST -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}' -H 'Content-Type: application/json' -d '{\"channel\":\"#general\",\"text\":\"Hello!\"}'`" - "List Stripe customers: `keychains curl https://api.stripe.com/v1/customers?limit=5 -H 'Authorization: Bearer {{STRIPE_SECRET_KEY}}'`" - "Read Gmail: `keychains curl 'https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10' -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'`" ## How It Works

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Basic usage:

Credential Access

Credential Access

External Transmission

Basic usage:

External Transmission

Basic usage:

External Transmission

Basic usage:

External Transmission

Basic usage:

External Transmission

Basic usage:

External Transmission

Basic usage:

Missing User Warnings

External Transmission