Security audit

HashiCorp Vault

Security checks for vulnerabilities and agentic risk

Overview

This Vault helper is mostly coherent, but it can automatically use a local Vault token against a hard-coded plain-HTTP address unless the user overrides it.

Review this carefully before installing. Set VAULT_ADDR explicitly to the intended HTTPS Vault endpoint before using the scripts, avoid the hard-coded lab address for real credentials, verify any installed vault binary comes from HashiCorp, and treat get/list/put outputs and arguments as sensitive.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vault-env.sh:4
Finding: Automatic Vault Token Transmission to a Hard-Coded Plaintext Endpoint
Content: View full analysis
Remediation: View remediation
&2 exit 2 fi ``` 2. Require HTTPS by default. Reject plaintext HTTP unless the user supplies a deliberate, narrowly scoped opt-in intended only for disposable local development environments. 3. Validate the destination before reading or exporting `VAULT_TOKEN`. Endpoint validation must occur before accessing `~/.vault-token`. 4. Use TLS certificate verification and a trusted CA. Do not disable certificate validation as a workaround. 5. Avoid automatically loading credentials for an unverified destination. Require explicit authentication or explicit confirmation when the configured endpoint changes. 6. Prefer short-lived, least-privileged tokens with narrowly scoped policies. Apply TTLs, periodic rotation, and CIDR restrictions where appropriate. 7. Revoke and rotate any token that may already have been transmitted through the plaintext default endpoint. 8. Update `SKILL.md` and the troubleshooting reference so plaintext HTTP addresses are clearly identified as unsafe lab-only examples rather than operational defaults. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Ambiguous and Unpinned APT Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description contains very broad trigger phrases such as 'Use when tasks mention HashiCorp Vault' and references to common terms like secret paths, environment variables, policies, mounts, and the vault command. This can cause over-activation on routine Vault-related discussion and may steer an agent into using a powerful secrets-management skill in contexts where narrower intent detection would be safer, increasing the chance of unnecessary secret access or operational changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script reads a sensitive credential from ${HOME}/.vault-token and exports it as VAULT_TOKEN, but there is no comment, log message, or other user-facing disclosure explaining that credential material will be loaded into the environment. For code files, access to sensitive environment variables or credentials should include some form of visible warning or documentation unless already clearly disclosed elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script executes vault kv get to retrieve secrets from Vault, which is a sensitive operation involving access to confidential data. While the script shows usage information when arguments are missing, it does not provide any confirmation, warning, or user-facing notice that it is accessing secret material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This shell script writes secrets to Vault via vault kv put, which is a safety-relevant operation affecting stored credentials or sensitive data. The file provides only a usage message and contains no confirmation prompt, user-facing disclosure, or explanatory comment warning that it will persist provided key/value pairs to the target Vault path.
Content: No source excerpt is available for this finding.