Security audit
Security checks for vulnerabilities and agentic risk
This Proton Pass skill matches its password-manager purpose, but needs Review because its install and some secret-handling examples can expose credentials or run unverified code.
Review before installing. Prefer a package-manager or verified pinned installer over the curl-to-bash path, avoid copying passphrase-free SSH private keys into /tmp, keep generated secret files at 0600 or stricter, avoid --no-masking and long-lived environment-variable secrets except in tightly controlled automation, and use auto-create SSH identities only with a dedicated vault/socket you intend to sync.
SKILL.md:14Remote installation scripts are downloaded and executed without integrity verification
SKILL.md:333Passphrase-free SSH private key is created at a predictable shared temporary path
SKILL.md:58Sensitive authentication material is demonstrated in process environment variables
SKILL.md:768Generated files containing resolved secrets may be made readable by all local users
The installation instructions recommend piping a remote script fetched over the network directly into bash. This removes the opportunity to inspect or verify the installer and turns any compromise of the hosting endpoint, CDN, TLS trust chain, or download path into immediate code execution on the user's machine.
macOS/Linux:
curl -fsSL https://proton.me/download/pass-cli/install.sh | bash
Windows:
The | bash construct is a classic unsafe command chain because it streams unaudited remote content directly into a shell. In a skill that may be followed by automation-oriented agents or users, this pattern is especially dangerous because it normalizes immediate execution of untrusted network input.
macOS/Linux:
curl -fsSL https://proton.me/download/pass-cli/install.sh | bash
Windows:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export PROTON_PASS_EXTRA_PASSWORD='your-extra-password'
# Or from files (more secure)
export PROTON_PASS_PASSWORD_FILE='/secure/password.txt'
export PROTON_PASS_TOTP_FILE='/secure/totp.txt'
export PROTON_PASS_EXTRA_PASSWORD_FILE='/secure/extra-password.txt'
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export PROTON_PASS_EXTRA_PASSWORD='your-extra-password'
# Or from files (more secure)
export PROTON_PASS_PASSWORD_FILE='/secure/password.txt'
export PROTON_PASS_TOTP_FILE='/secure/totp.txt'
export PROTON_PASS_EXTRA_PASSWORD_FILE='/secure/extra-password.txt'
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Import unencrypted key
pass-cli item create ssh-key import \
--from-private-key ~/.ssh/id_ed25519 \
--share-id "abc123def" \
--title "My SSH Key"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Import unencrypted key
pass-cli item create ssh-key import \
--from-private-key ~/.ssh/id_ed25519 \
--share-id "abc123def" \
--title "My SSH Key"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Import unencrypted key
pass-cli item create ssh-key import \
--from-private-key ~/.ssh/id_ed25519 \
--share-id "abc123def" \
--title "My SSH Key"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Import with vault name
pass-cli item create ssh-key import \
--from-private-key ~/.ssh/id_rsa \
--vault-name "Personal Keys" \
--title "Old RSA Key"
The documentation suggests supplying an SSH key passphrase directly via an environment variable. Environment variables are commonly exposed to child processes, crash dumps, debugging tools, CI metadata, and other same-session observers, so recommending this pattern without a strong warning increases passphrase disclosure risk.
# Passphrase from environment
PROTON_PASS_SSH_KEY_PASSWORD="my-key-passphrase" \
pass-cli item create ssh-key import \
--from-private-key ~/.ssh/id_ed25519 \
--share-id "abc123def" \
--title "Automated Import" \
--password
The skill recommends creating an unencrypted temporary copy of an SSH private key in /tmp to facilitate import. Even though cleanup is shown later, the temporary plaintext key can be read, copied, backed up, or recovered before deletion, especially on multi-user or monitored systems.
# Create unencrypted copy
cp ~/.ssh/id_ed25519 /tmp/id_ed25519_temp
ssh-keygen -p -f /tmp/id_ed25519_temp -N ""
# Import
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
shred -u /tmp/id_ed25519_temp # Linux rm -P /tmp/id_ed25519_temp # macOS
### Create email alias
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pass-cli run -- ./my-app
#### Using .env files
Create `.env`:
```bash
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pass-cli run -- ./my-app
#### Using .env files
Create `.env`:
```bash
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pass-cli run
--env-file base.env
--env-file secrets.env
--env-file local.env
-- ./my-app
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
inject)Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
inject)Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
inject)Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
inject)Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
inject)Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export PROTON_PASS_KEY_PROVIDER=keyring # or unset
Uses OS secure storage:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export PROTON_PASS_KEY_PROVIDER=keyring # or unset
Uses OS secure storage:
The auto-create SSH identity feature causes keys added with ssh-add to be uploaded into Proton Pass automatically, but the documentation lacks a clear warning about that side effect. Users may unintentionally sync sensitive local-only identities, including production or personal keys, into a remote vault and alter their trust boundary without realizing it.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Force password authentication:
ssh-copy-id -o PreferredAuthentications=password -o PubkeyAuthentication=no user@server
The skill documents pass-cli run --no-masking and even contrasts masked versus unmasked output, but it does not explicitly warn that command output may print plaintext secrets into terminals, CI logs, shell history-adjacent transcripts, or centralized logging systems. In a secret-management skill, normalizing unmasked execution materially increases the chance of credential disclosure during routine automation.
The inject examples encourage writing resolved secrets directly into output files without clearly warning that the resulting files contain plaintext credentials. Even with a default 0600 mode, generated configs may later be committed, copied into artifacts, backed up, or read by other tooling, causing broad secret leakage.
No suspicious patterns detected.