Security checks for vulnerabilities and agentic risk
Overview
SupportForge is mostly a coherent support-API skill, but it sends customer data and credentials to an external service with weak disclosure and unsafe credential handling.
Review this before installing. Only use it if you trust the SupportForge/Voss endpoint, understand that support content and email addresses leave your environment, avoid setting SUPPORTFORGE_API_URL to untrusted hosts, and do not use the email auto-signup path where logs or agent transcripts may capture the generated API key.
The script accepts SUPPORTFORGE_API_URL as the API base URL without validating its scheme, hostname, port, or ownership. The create and search operations then send the SupportForge bearer token and user-supplied JSON body to that destination.
An attacker who can influence the process environment does not need to execute injected shell commands. Setting the environment variable to an attacker-controlled HTTP or HTTPS service is sufficient to redirect legitimate-looking API requests. The absence of HTTPS enforcement also permits configuration of a plaintext HTTP endpoint, exposing credentials and data to network interception.
Attack Path
The attacker gains the ability to define or modify environment variables used when the script runs, such as through CI configuration, a wrapper process, deployment settings, or a compromised shell environment.
The attacker sets SUPPORTFORGE_API_URL to an endpoint under their control, for example https://attacker.example.
A user or agent invokes:
bash
./scripts/forge-client.sh create '{"subject":"Login issue","message":"Sensitive support content"}'
After email-based registration, the script extracts the complete API key and writes it to standard error. Standard error is not a secure secret channel: terminals, agent execution traces, CI systems, centralized log collectors, shell wrappers, and process supervisors commonly capture it.
The disclosure occurs during intended use and does not require command injection or elevated local privileges. Anyone with access to retained output can obtain the credential.
Attack Path
A user runs the client with SUPPORTFORGE_EMAIL set and without an existing SUPPORTFORGE_API_KEY.
The remote service returns a newly issued API key.
The script emits the full key to stderr:
text
Free key: <complete-secret>
The execution environment captures stderr in a terminal transcript, agent trace, CI artifact, or centralized log.
An attacker or unauthorized operator with access to that output retrieves the key.
The attacker uses the key to perform API operations allowed by the credential until it is revoked or expires.
Impact Assessment
The exposed credential can enable unauthorized use of the associated SupportForge account or tenant within the key's permissions. Potential effects include unauthorized ticket creation, knowledge-base searches, service quota consumption, and access to any additional API operations granted to the key. This finding does not establish local host compromise or privilege escalation.
Remediation
View remediation
Remediation Suggestions
Do not print the complete API key to stdout or stderr.
Emit only a generic success message, such as API key created successfully.
If key identification is operationally necessary, display only a short, non-sensitive suffix.
Deliver or persist the key through an approved secret-management mechanism with restrictive access controls.
Ensure CI systems and agent frameworks redact known secret patterns from logs as defense in depth.
Restrict access to existing execution logs and remove historical records containing exposed keys.
Revoke and rotate any keys that may already have appeared in captured output.
The documented behavior does not fully match the actual actions: it includes API-key/signup generation via email submission to /v1/keys while omitting that from the declared purpose, and claims routing/auto-reply capabilities not evidenced in the file. This mismatch is dangerous because it can trigger unexpected external account creation or data transmission under a broader support-automation label, reducing user awareness and informed consent.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill includes shell-based network actions but does not declare any tool scope or allowed-tools restrictions. That makes the runtime capabilities under-specified and can permit broader-than-expected command execution or external requests, increasing the chance of misuse or accidental data exposure.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The activation text is broad enough to match many generic support-related requests, which can cause the skill to be invoked in situations where users did not intend to use a third-party support API. In this context, overbroad triggering is risky because the skill can send support content and potentially personal data to an external service.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The documentation does not warn that support messages, ticket content, and email addresses may be transmitted to external SupportForge endpoints. This is dangerous because users may share sensitive customer data or personal identifiers without realizing it leaves the local environment and is processed by a third party.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding
The skill instructs posting an email address to an external endpoint to generate an API key, which is a real external transmission of user data. In a customer-support skill, this is more sensitive because setup may occur automatically and can bootstrap further outbound actions using generated credentials.
Content
Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
Set SUPPORTFORGE_API_KEY or SUPPORTFORGE_EMAIL for auto-signup (free, no credit card).
bash
curl -X POST https://anton.vosscg.com/v1/keys -H 'Content-Type: application/json' -d '{"email":"you@example.com"}'
Usage
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The script silently provisions an API key by sending a user-supplied email address to an external service, even though the declared skill scope is customer support operations rather than account registration or credential issuance. This expands the skill’s capabilities beyond what a user may reasonably expect and can cause unintended data disclosure and account creation on a third-party system.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding
This line transmits the user’s email address to an external endpoint to obtain credentials, creating a privacy and trust risk. The danger is increased because the default API base points to a non-obviously official domain, so sensitive data is sent off-host without strong assurance that the destination matches the expected vendor.
Content
Scanner excerpt · scripts/forge-client.sh (reported line 7)May include surrounding context.
The script prints the newly generated API key directly to stderr, which can expose the credential in terminal logs, CI logs, agent transcripts, or other observability systems. Anyone with access to those logs could reuse the key to interact with the SupportForge API as the victim.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding
The script sends arbitrary user-provided JSON and an API bearer token to external ticketing and knowledge-base endpoints. External transmission is expected for this skill category, but it still creates a real security risk because support payloads often contain sensitive customer data, and the script provides no validation, warning, redaction, or destination trust controls.
Content
Scanner excerpt · scripts/forge-client.sh (reported line 14)May include surrounding context.
