Dashboard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 PM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent and user-directed, but its sample fetch script handles a Stripe API key in a way that can expose it locally and stores sensitive dashboard data without clear permission hardening.

Review generated fetch scripts before running them or adding them to cron. Prefer restricted read-only API keys, avoid putting secrets in command-line arguments, keep dashboard directories and data files private, and do not expose the local dashboard to a network without authentication.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Stripe API Key Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–71
Vulnerability Type: Sensitive credential exposure through command-line arguments and insufficient local file-permission controls
Risk Level: Medium

Vulnerable Code

bash

### 3. Fetch Script Template
```bash
#!/bin/bash
# Requires: STRIPE_API_KEY in environment
curl -s -u "$STRIPE_API_KEY:" \
  https://api.stripe.com/v1/balance \
  | jq '.' > ~/dashboard/stripe/data.json

text

### Technical Analysis

The user is correctly instructed to supply the Stripe API key through an environment variable rather than store it directly in a file. However, `curl -u "$STRIPE_API_KEY:"` causes the shell to expand the secret into the `curl` process argument list.

Depending on operating-system process-visibility restrictions and local monitoring configuration, another local user, privileged process, diagnostic utility, audit service, or telemetry agent may be able to capture the expanded command-line argument while `curl` is running. This undermines the intended protection provided by environment-based credential handling.

The fetched Stripe response is also written directly to `~/dashboard/stripe/data.json` without setting a restrictive `umask` or explicit file permissions. Its accessibility therefore depends on the user's existing directory permissions and `umask`. Because Stripe balance data is financially sensitive, relying on ambient defaults is not sufficient hardening.

Sending the credential to `https://api.stripe.com/v1/balance` is otherwise consistent with the declared functionality and is not, by itself, unauthorized exfiltration: Stripe must receive an authentication credential to service the user-requested API call.

### Attack Path

1. The user exports a valid `STRIPE_API_KEY` and runs the generated fetch script.
2. The shell expands `$STRIPE_API_KEY` into the argument supplied to `curl -u`.
3. While the process is active, a local obse
...[truncated 1115 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid expanding the API key directly into command-line arguments. Use a protected, temporary curl configuration or another authentication mechanism that does not expose the secret in the process argument list.
• Create temporary credential material with mode 0600, remove it immediately after use with a shell trap, and ensure it is never committed or logged.
• Prefer a narrowly scoped, read-only Stripe restricted key that grants access only to the data required by the dashboard.
• Add umask 077 at the beginning of generated fetch scripts.
• Create dashboard directories with mode 0700 and data files with mode 0600.
• Write API responses to a securely created temporary file, validate that the request and JSON transformation succeeded, and atomically rename the file to data.json. This prevents both unsafe permissions and partial output.
• Disable shell tracing around credential handling and ensure generated scripts never print secrets in errors or diagnostics.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- Skill generates HTML and fetch scripts

This skill does NOT:
- ❌ Access credentials without user providing them
- ❌ Run automated fetches (user's cron runs scripts)
- ❌ Scrape services without user consent

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

#!/bin/bash

Requires: STRIPE_API_KEY in environment

curl -s -u "$STRIPE_API_KEY:"
https://api.stripe.com/v1/balance
| jq '.' > ~/dashboard/stripe/data.json

text

Static analysis

No suspicious patterns detected.