Proton Pass CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:02 AM UTC
• Version: 1.1.0

Overview

This Proton Pass skill matches its password-manager purpose, but needs Review because its install and some secret-handling examples can expose credentials or run unverified code.

Review before installing. Prefer a package-manager or verified pinned installer over the curl-to-bash path, avoid copying passphrase-free SSH private keys into /tmp, keep generated secret files at 0600 or stricter, avoid --no-masking and long-lived environment-variable secrets except in tightly controlled automation, and use auto-create SSH identities only with a dedicated vault/socket you intend to sync.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Remote installation scripts are downloaded and executed without integrity verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-22` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash macOS/Linux: ```bash curl -fsSL https://proton.me/download/pass-cli/install.sh | bash ``` Windows: ```powershell Invoke-WebRequest -Uri https://proton.me/download/pass-cli/install.ps1 -OutFile install.ps1; .\install.ps1 ``` ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external URL and immediately execute them. The Unix command streams the HTTP response directly into Bash, while the Windows command downloads and executes the PowerShell script without an intervening authenticity check. HTTPS protects the connection in transit but does not establish that a particular reviewed version of the script is being executed. The instructions do not pin a release, verify a cryptographic checksum, validate a digital signature, or provide an opportunity to inspect the downloaded script. Consequently, the effective installation payload can change after the Skill itself has been audited. The domain appears related to the declared Proton Pass functionality, but domain relevance alone does not mitigate compromise of the hosting service, vendor account, DNS/TLS trust chain, or release process. ### Attack Path 1. A user or agent follows the documented quick-install instructions. 2. The command requests the current installation script from the external endpoint. 3. An attacker who has compromised the endpoint or its delivery chain changes the returned script. 4. The response is passed directly to Bash or executed by PowerShell. 5. The malicious payload runs with all privileges available to the invoking user. ### Impact Assessment A substituted installer can execute arbitrary commands as the user running the installation. This may permit access to that user's files, credentials, SSH material, shell configuration, and Proton Pass session data. If th ...[truncated 165 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an authenticated package-manager installation from a trusted, pinned source. 2. Download the installer to a local file instead of piping it directly into a shell. 3. Pin the intended CLI version rather than executing the latest mutable script. 4. Publish and verify a cryptographic checksum obtained through an authenticated, independent release channel. 5. Where available, verify a vendor digital signature before execution. 6. Allow the installer to be inspected before running it. 7. Execute installation with the minimum necessary privileges and explicitly warn users not to use an elevated shell unless required. A safer general workflow is: ```bash curl -fL -o install.sh 'https://proton.me/download/pass-cli/install.sh' printf '%s %s\n' '<PINNED_SHA256>' 'install.sh' | sha256sum -c - less install.sh bash install.sh ``` The checksum must be replaced with an authentic value for a pinned release and must not be fetched from the same unauthenticated execution path. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:333
• Finding: Passphrase-free SSH private key is created at a predictable shared temporary path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:333-344` **Vulnerability Type**: Unsafe temporary-file and private-key handling **Risk Level**: High ### Vulnerable Code ```bash # Create unencrypted copy cp ~/.ssh/id_ed25519 /tmp/id_ed25519_temp ssh-keygen -p -f /tmp/id_ed25519_temp -N "" # Import pass-cli item create ssh-key import \ --from-private-key /tmp/id_ed25519_temp \ --share-id "abc123def" \ --title "My SSH Key" # Securely delete temp copy shred -u /tmp/id_ed25519_temp # Linux rm -P /tmp/id_ed25519_temp # macOS ``` ### Technical Analysis The workflow copies an SSH private key to a fixed name under the shared `/tmp` directory and then removes its passphrase. A predictable path in a shared temporary directory can be monitored or pre-created by another local process. The instructions do not create a private temporary directory, enforce a restrictive `umask`, use exclusive file creation, verify file ownership, or protect against symbolic-link and race-condition scenarios. After `ssh-keygen` completes, the temporary copy is an unencrypted private key. Cleanup occurs only at the end of the successful command sequence. Interruption, shell termination, import failure, or a system crash can leave the unencrypted key on disk. The documented `shred` and `rm -P` commands do not guarantee physical erasure on every filesystem, particularly copy-on-write, journaled, virtualized, or snapshot-backed storage. ### Attack Path 1. A local attacker observes the documented predictable path or creates a conflicting object at `/tmp/id_ed25519_temp`. 2. The victim follows the workflow and copies the SSH private key to that location. 3. The workflow removes the key's passphrase. 4. The attacker reads the unencrypted file during the interval before cleanup, or recovers it after interrupted cleanup. 5. The attacker uses the copied key against systems that trust its corresponding public key. ### Impact Assessment Successful exploitation disclo ...[truncated 515 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer importing the passphrase-protected private key directly and allow the CLI to prompt securely. 2. Do not recommend removing the SSH key passphrase merely because the vault encrypts stored data. 3. If a temporary plaintext key is unavoidable: - Set `umask 077`. - Create a private temporary directory with `mktemp -d`. - Verify ownership and permissions before writing. - Register a signal-safe `trap` immediately so cleanup occurs on normal exit and interruption. - Keep the plaintext lifetime as short as possible. 4. Do not claim that `shred` or `rm -P` guarantees secure erasure on all storage systems. 5. Recommend rotating the SSH key if an unencrypted temporary copy may have been left behind. A hardened temporary workflow should use a unique directory and immediate cleanup registration: ```bash umask 077 tmpdir="$(mktemp -d)" || exit 1 trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM cp -- "$HOME/.ssh/id_ed25519" "$tmpdir/id_ed25519" ssh-keygen -p -f "$tmpdir/id_ed25519" -N "" pass-cli item create ssh-key import \ --from-private-key "$tmpdir/id_ed25519" \ --share-id "abc123def" \ --title "My SSH Key" ``` Direct protected-key import remains preferable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58
• Finding: Sensitive authentication material is demonstrated in process environment variables<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58-69` **Additional Locations**: `SKILL.md:291`, `SKILL.md:321`, `SKILL.md:1125`, `SKILL.md:1163-1174` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Credentials as plain text (less secure) export PROTON_PASS_PASSWORD='your-password' export PROTON_PASS_TOTP='123456' export PROTON_PASS_EXTRA_PASSWORD='your-extra-password' # Or from files (more secure) export PROTON_PASS_PASSWORD_FILE='/secure/password.txt' export PROTON_PASS_TOTP_FILE='/secure/totp.txt' export PROTON_PASS_EXTRA_PASSWORD_FILE='/secure/extra-password.txt' pass-cli login --interactive [e-mail] ``` The pattern is repeated for other sensitive values: ```bash PROTON_PASS_SSH_KEY_PASSWORD="my-passphrase" \ pass-cli item create ssh-key generate \ --share-id "abc123def" \ --title "Automated Key" \ --password ``` ```bash export PROTON_PASS_KEY_PROVIDER=env export PROTON_PASS_ENCRYPTION_KEY=your-secret-key ``` ### Technical Analysis The examples demonstrate placing account passwords, TOTP values, extra passwords, SSH-key passphrases, and a session-encryption key in environment variables. The document correctly labels plaintext credential variables as less secure and supplies file-based alternatives, but repeatedly presents the environment-variable pattern as an automation mechanism. Environment variables are inherited by child processes and may be captured by CI debugging output, process diagnostics, crash reports, shell tracing, or tools that dump execution environments. Literal assignment commands may also be retained in interactive shell history. Exposure of `PROTON_PASS_ENCRYPTION_KEY` is particularly sensitive when an attacker can also obtain the associated encrypted session data. ### Attack Path 1. A user replaces the placeholders with real credentials or encryption keys. 2. The values are entered into an interactive shell, automation script, or ...[truncated 959 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make protected credential files, OS keyrings, CI secret mounts, or interactive prompts the primary documented methods. 2. Remove literal secret assignments from examples, especially assignments likely to be copied into shell history. 3. Ensure credential files are owned by the intended user and have mode `0600` or stricter. 4. Disable shell tracing before handling secrets and avoid printing the environment in CI jobs. 5. Limit environment-variable use to cases where the execution environment is explicitly controlled and ephemeral. 6. Unset sensitive variables immediately after the operation: ```bash pass-cli login --interactive [e-mail] unset PROTON_PASS_PASSWORD PROTON_PASS_TOTP PROTON_PASS_EXTRA_PASSWORD ``` 7. Prefer secret-file interfaces such as: ```bash export PROTON_PASS_PASSWORD_FILE='/run/secrets/proton-pass-password' export PROTON_PASS_TOTP_FILE='/run/secrets/proton-pass-totp' pass-cli login --interactive [e-mail] ``` 8. Document that file-based storage is only safer when file ownership, permissions, lifecycle, backup handling, and mount security are properly controlled. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:768
• Finding: Generated files containing resolved secrets may be made readable by all local users<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:768-774` **Vulnerability Type**: Excessive permissions on secret-bearing output **Risk Level**: Medium ### Vulnerable Code ```bash #### Custom file permissions ```bash pass-cli inject \ --in-file template.txt \ --out-file config.txt \ --file-mode 0644 ``` ``` ### Technical Analysis The `inject` command resolves Proton Pass references and writes their plaintext values into an output file. The documentation states that the secure Unix default is `0600`, but the custom-permission example changes the mode to `0644`. Mode `0644` gives the owner read/write access and grants read access to the owner's group and every other local user. If the template contains passwords, API keys, connection strings, or other vault values, those secrets become readable outside the security boundary of the invoking account. ### Attack Path 1. A user creates a template containing Proton Pass secret references. 2. The user follows the custom-permission example and invokes `pass-cli inject` with `--file-mode 0644`. 3. Proton Pass resolves the references and writes plaintext secrets to `config.txt`. 4. Another local account or process reads the world-readable output file. 5. The exposed credentials are reused against their corresponding applications or services. ### Impact Assessment An attacker with local read access can obtain every resolved secret written to the generated file. The resulting external access is determined by those credentials and may include databases, APIs, deployment services, or production applications. No privilege escalation is required beyond the ability to read files permitted by mode `0644`. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Retain mode `0600` for every file that may contain resolved secrets. 2. Remove the `0644` example or clearly restrict it to templates guaranteed not to contain sensitive values. 3. Add an explicit warning that generated output contains plaintext vault data. 4. Validate the resulting ownership and permissions before launching an application that consumes the file. 5. Store generated files in a directory inaccessible to other users. 6. Delete generated secret files as soon as they are no longer required. 7. Where possible, use `pass-cli run` to provide short-lived secrets directly to a process instead of persisting them to disk. A safer example is: ```bash umask 077 pass-cli inject \ --in-file template.txt \ --out-file config.txt \ --file-mode 0600 ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

External Script Fetching

High

• Category: Supply Chain

Content

macOS/Linux:
```bash
curl -fsSL https://proton.me/download/pass-cli/install.sh | bash
```

Windows:

• Confidence: 99% confidence
• Finding: The installation instructions recommend piping a remote script fetched over the network directly into `bash`. This removes the opportunity to inspect or verify the installer and turns any compromise of the hosting endpoint, CDN, TLS trust chain, or download path into immediate code execution on the user's machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

macOS/Linux:
```bash
curl -fsSL https://proton.me/download/pass-cli/install.sh | bash
```

Windows:

• Confidence: 99% confidence
• Finding: The `| bash` construct is a classic unsafe command chain because it streams unaudited remote content directly into a shell. In a skill that may be followed by automation-oriented agents or users, this pattern is especially dangerous because it normalizes immediate execution of untrusted network input.

Credential Access

High

• Category: Privilege Escalation

Content

export PROTON_PASS_EXTRA_PASSWORD='your-extra-password'

# Or from files (more secure)
export PROTON_PASS_PASSWORD_FILE='/secure/password.txt'
export PROTON_PASS_TOTP_FILE='/secure/totp.txt'
export PROTON_PASS_EXTRA_PASSWORD_FILE='/secure/extra-password.txt'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

export PROTON_PASS_EXTRA_PASSWORD='your-extra-password'

# Or from files (more secure)
export PROTON_PASS_PASSWORD_FILE='/secure/password.txt'
export PROTON_PASS_TOTP_FILE='/secure/totp.txt'
export PROTON_PASS_EXTRA_PASSWORD_FILE='/secure/extra-password.txt'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Import unencrypted key
pass-cli item create ssh-key import \
  --from-private-key ~/.ssh/id_ed25519 \
  --share-id "abc123def" \
  --title "My SSH Key"

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Import unencrypted key
pass-cli item create ssh-key import \
  --from-private-key ~/.ssh/id_ed25519 \
  --share-id "abc123def" \
  --title "My SSH Key"

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Import unencrypted key
pass-cli item create ssh-key import \
  --from-private-key ~/.ssh/id_ed25519 \
  --share-id "abc123def" \
  --title "My SSH Key"

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Import with vault name
pass-cli item create ssh-key import \
  --from-private-key ~/.ssh/id_rsa \
  --vault-name "Personal Keys" \
  --title "Old RSA Key"

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Passphrase from environment
PROTON_PASS_SSH_KEY_PASSWORD="my-key-passphrase" \
  pass-cli item create ssh-key import \
  --from-private-key ~/.ssh/id_ed25519 \
  --share-id "abc123def" \
  --title "Automated Import" \
  --password

• Confidence: 90% confidence
• Finding: The documentation suggests supplying an SSH key passphrase directly via an environment variable. Environment variables are commonly exposed to child processes, crash dumps, debugging tools, CI metadata, and other same-session observers, so recommending this pattern without a strong warning increases passphrase disclosure risk.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Create unencrypted copy
cp ~/.ssh/id_ed25519 /tmp/id_ed25519_temp
ssh-keygen -p -f /tmp/id_ed25519_temp -N ""

# Import

• Confidence: 92% confidence
• Finding: The skill recommends creating an unencrypted temporary copy of an SSH private key in `/tmp` to facilitate import. Even though cleanup is shown later, the temporary plaintext key can be read, copied, backed up, or recovered before deletion, especially on multi-user or monitored systems.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Securely delete temp copy
shred -u /tmp/id_ed25519_temp  # Linux
rm -P /tmp/id_ed25519_temp     # macOS
```

### Create email alias

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

pass-cli run -- ./my-app
```

#### Using .env files

Create `.env`:
```bash

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

pass-cli run -- ./my-app
```

#### Using .env files

Create `.env`:
```bash

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Multiple env files (later override earlier)
pass-cli run \
  --env-file base.env \
  --env-file secrets.env \
  --env-file local.env \
  -- ./my-app
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
```

### Inject secrets into templates (`inject`)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
```

### Inject secrets into templates (`inject`)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
```

### Inject secrets into templates (`inject`)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
```

### Inject secrets into templates (`inject`)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
#!/bin/bash
# Load production secrets
pass-cli run --env-file .env.production -- ./deploy.sh
```

### Inject secrets into templates (`inject`)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### 1. Keyring storage (default, most secure)

```bash
export PROTON_PASS_KEY_PROVIDER=keyring  # or unset
```

Uses OS secure storage:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### 1. Keyring storage (default, most secure)

```bash
export PROTON_PASS_KEY_PROVIDER=keyring  # or unset
```

Uses OS secure storage:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The auto-create SSH identity feature causes keys added with `ssh-add` to be uploaded into Proton Pass automatically, but the documentation lacks a clear warning about that side effect. Users may unintentionally sync sensitive local-only identities, including production or personal keys, into a remote vault and alter their trust boundary without realizing it.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

Force password authentication:
```bash
ssh-copy-id -o PreferredAuthentications=password -o PubkeyAuthentication=no user@server
```

## Pass URI Syntax (Secret References)

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill documents `pass-cli run --no-masking` and even contrasts masked versus unmasked output, but it does not explicitly warn that command output may print plaintext secrets into terminals, CI logs, shell history-adjacent transcripts, or centralized logging systems. In a secret-management skill, normalizing unmasked execution materially increases the chance of credential disclosure during routine automation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The `inject` examples encourage writing resolved secrets directly into output files without clearly warning that the resulting files contain plaintext credentials. Even with a default `0600` mode, generated configs may later be committed, copied into artifacts, backed up, or read by other tooling, causing broad secret leakage.

Static analysis

No suspicious patterns detected.