Keys

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:28 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent API-key broker, but its key-management instructions can expose plaintext API keys and its broker grants broad authenticated API access.

Review before installing. Use only with tightly scoped API keys, avoid running the documented verification commands that print secrets, do not place real keys in command-line arguments, and require explicit user approval before using the broker for destructive or financial API actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: manage.md:5

Finding

API Keys Exposed Through Command-Line Arguments and Plaintext Verification Output

Content

View full analysis

Remediation

View remediation

/dev/null 2>&1; then echo "Key exists" else echo "Key not found" fi ``` For Linux: ```bash if secret-tool lookup service keys:SERVICE >/dev/null 2>&1; then echo "Key exists" else echo "Key not found" fi ``` 3. **Keep Linux secret entry interactive.** Continue using `secret-tool store`, which prompts for the secret, and warn users not to pipe credentials from shell command lines or store them in environment variables. 4. **Add explicit Agent-safety guidance.** State that an Agent must never execute commands that return decrypted credentials and must not request that users place keys in command arguments, chat messages, or Agent-controlled terminals. 5. **Address existing exposure.** Users who followed the vulnerable instructions should remove affected commands from shell history and terminal logs, rotate the potentially exposed credentials, revoke old keys, and review provider audit logs for unauthorized use. 6. **Apply least privilege at the provider.** Restrict each API key to the minimum required scopes, projects, repositories, source addresses, spending limits, and expiration period so that accidental disclosure has reduced impact. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

To add services, edit `ALLOWED_URLS` in `keys-broker.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

To add services, edit `ALLOWED_URLS` in `keys-broker.sh`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

check_environment() {
    # Detect unsupported environments
    if [[ -f /.dockerenv ]] || grep -q docker /proc/1/cgroup 2>/dev/null; then
        echo '{"ok":false,"error":"Docker containers not supported - no keychain access"}' >&2
        return 1
    fi
    if grep -qi microsoft /proc/version 2>/dev/null; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · keys-broker.sh (reported line 25)May include surrounding context.

sh

check_environment() {
    # Detect unsupported environments
    if [[ -f /.dockerenv ]] || grep -q docker /proc/1/cgroup 2>/dev/null; then
        echo '{"ok":false,"error":"Docker containers not supported - no keychain access"}' >&2
        return 1
    fi
    if grep -qi microsoft /proc/version 2>/dev/null; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.md (reported line 41)May include surrounding context.

md

check_environment() {
    # Detect unsupported environments
    if [[ -f /.dockerenv ]] || grep -q docker /proc/1/cgroup 2>/dev/null; then
        echo '{"ok":false,"error":"Docker containers not supported - no keychain access"}' >&2
        return 1
    fi
    if grep -qi microsoft /proc/version 2>/dev/null; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · keys-broker.sh (reported line 33)May include surrounding context.

sh

return 1
    fi
    if [[ "$(uname)" == "Linux" && -z "${DBUS_SESSION_BUS_ADDRESS:-}" ]]; then
        echo '{"ok":false,"error":"No D-Bus session - cannot access keyring (headless?)"}' >&2
        return 1
    fi
}

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide says users should never paste keys in chat, yet the macOS add/update examples require the API key inline on the command line via the -w argument. Supplying secrets directly on the command line can expose them through shell history, process listings, audit logs, screenshots, or copied transcripts, creating a direct credential leakage path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims keys are never exposed to agent context, but its verification step explicitly retrieves and prints the stored secret value to stdout. In an agent-assisted workflow, terminal output may be captured, echoed back, logged, screen-shared, or otherwise exposed, defeating the stated secrecy boundary and risking credential disclosure.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · setup.md (reported line 17)May include surrounding context.

Keys Setup

Requirements

• macOS or Linux with desktop (GNOME/KDE with keyring)
• curl, jq, bash 4.0+
• NOT supported: Docker, WSL, headless servers

Install

bash

# Copy to PATH
cp keys-broker.sh ~/.local/bin/keys-broker
chmod +x ~/.local/bin/keys-broker

# Ensure ~/.local/bin is in PATH
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

Verify

bash

# Check dependencies
keys-broker ping
# {"ok":true,"status":"running"}

# List configured services
keys-broker services
# {"ok":true,"services":["openai","anthropic","stripe","github"]}

How It Works

text

Agent                        Keys Broker
  │                              │
  │ {"call": "openai", ...}      │
  ├─────────────────────────────►│
  │                              │ ← validates URL against allowli

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents shell-based capability (curl, jq, bash, and a keys-broker command) but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens policy boundaries and makes it harder for the host agent to constrain execution, especially for a skill that can trigger authenticated outbound API requests via a local broker.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

## Rules

1. **Never retrieve keys directly** — always use `keys-broker call`
2. **Never ask user to paste keys in chat** — guide them to keychain commands

## Other Tasks

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · keys-broker.sh (reported line 129)May include surrounding context.

sh

# Build auth header via file (not visible in ps)
    printf 'Authorization: Bearer %s' "$key" > "$tmp_header"
    chmod 600 "$tmp_header"
    
    # Make request with timeout
    local http_code curl_exit

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · keys-broker.sh (reported line 134)May include surrounding context.

sh

# Make request with timeout
    local http_code curl_exit
    if [[ -n "$body" && "$body" != "null" ]]; then
        http_code=$(curl -s \
            --connect-timeout 10 \
            --max-time 120 \
            -X "$method" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

services      List configured services

JSON format for call:
  {"action":"call","service":"openai","url":"https://api.openai.com/v1/...","method":"POST","body":{...}}
EOF
            exit 1
            ;;

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · keys-broker.sh (reported line 248)May include surrounding context.

sh

services      List configured services

JSON format for call:
  {"action":"call","service":"openai","url":"https://api.openai.com/v1/...","method":"POST","body":{...}}
EOF
            exit 1
            ;;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The verification commands reveal the full stored secret without any warning or masking, which encourages unsafe validation behavior. Even if intended for local confirmation, exposing the plaintext key increases the chance it is captured by logs, terminal integrations, remote support sessions, or the agent itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes commands that persistently change the user's shell startup file by appending a PATH export and then reloading the shell configuration. The instructions do not explicitly warn the user that their local environment configuration will be modified, which is a user-impacting system change.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.