Security audit
Security checks for vulnerabilities and agentic risk
This Airtable CLI is mostly purpose-aligned, but its install instructions fetch executable code from an unpinned GitHub branch and the tool can delete or bulk-change Airtable records without built-in safeguards.
Install only from the packaged audited file or a pinned, verified release rather than the raw main-branch curl command. Use a least-privilege Airtable token, test against non-production bases first, and manually verify base IDs, table names, record IDs, and merge keys before running delete, batch-delete, or upsert commands.
SKILL.md:32Mutable Remote Python Payload Download in Skill Installation Instructions
README.md:34Mutable Remote Python Payload Download in README Installation Instructions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
version Show version info
Environment:
AIRTABLE_API_KEY Required. Personal Access Token (pat...) or legacy API key.
Stdlib only — no pip install required.
"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
version Show version info
Environment:
AIRTABLE_API_KEY Required. Personal Access Token (pat...) or legacy API key.
Stdlib only — no pip install required.
"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
version Show version info
Environment:
AIRTABLE_API_KEY Required. Personal Access Token (pat...) or legacy API key.
Stdlib only — no pip install required.
"""
This markdown file advertises "CRUD records with batch create/delete," which includes destructive deletion of Airtable data, but it does not include any caution about irreversible changes or the need to verify the target base/table first. Under the markdown-specific warning criterion, omitting a warning for destructive behavior that can affect user data is a safety gap.
The markdown advertises "CRUD records with batch create/delete," which includes irreversible data deletion, but the skill description provides no warning about potential data loss or the need to confirm targets before deleting. For a markdown file, destructive operations that can affect user data should be accompanied by an explicit warning.
The feature list states "Export/import CSV" and elsewhere mentions batch create/upsert from CSV, but the documentation does not warn that bulk import or upsert operations may change many records at once or overwrite existing data based on merge keys. In markdown descriptions, bulk data-modifying behavior should be disclosed because it can materially affect user data integrity.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
__version__ = "1.1.0"
VERSION_STRING = f"airtable-cli v{__version__} (Python {sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro})"
API_BASE = "https://api.airtable.com/v0"
META_BASE = "https://api.airtable.com/v0/meta"
# ── ANSI helpers ──────────────────────────────────────────────────────
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
__version__ = "1.1.0"
VERSION_STRING = f"airtable-cli v{__version__} (Python {sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro})"
API_BASE = "https://api.airtable.com/v0"
META_BASE = "https://api.airtable.com/v0/meta"
# ── ANSI helpers ──────────────────────────────────────────────────────
The CLI exposes single and batch record deletion operations that execute immediately with no confirmation prompt, dry-run mode, or explicit irreversible-action safeguard. In a command-line tool capable of bulk deletion, a mistyped table, base, or record ID can cause accidental data loss, which is especially risky in an agent or automation context where commands may be generated or executed non-interactively.
This helper executes an arbitrary Python file discovered in the target product directory by invoking it with a self-test argument. In a CI or local verification context, that means untrusted repository code is run merely to validate the product, enabling arbitrary code execution with the permissions of the verifier.
def has_self_test(fp):
r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
return r.returncode == 0 and "PASS" in r.stdout
The tool automatically runs discovered product code for self-testing without clearly warning the user that local repository code will be executed. That increases the chance of accidental execution of malicious code, especially in workflows where users expect a validator to be read-only.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
all_ok &= axis(False, "frontmatter (no SKILL.md)")
all_ok &= axis(False, "docs (no SKILL.md)")
# 3 compiles
comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
capture_output=True).returncode == 0 for fp in files)
all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
# 4 self-test (any of 3 valid forms)
The verifier also auto-executes discovered test files with no explicit disclosure or consent step. In the context of a skill verification harness, this makes the behavior more dangerous because users may run it against untrusted submissions in CI, where silent code execution is especially risky.
This logic executes any test_*.py or *_test.py files found in the target folder. Because those test files are repository-controlled and may be attacker-supplied, verifying a product can trigger arbitrary code execution in CI or on a developer machine.
tests = [os.path.join(folder, f) for f in os.listdir(folder)
if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
if tests:
st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
timeout=30).returncode == 0 for t in tests)
st_note = f"{len(tests)} test_*.py"
elif re.search(r"(?im)^test\s*:", skill_txt):
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 7 deploy-ready
ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
if os.path.isfile(ci) and os.path.isfile(skill):
r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
else:
all_ok &= axis(True, "deploy-ready (skipped)")
No suspicious patterns detected.