Security audit

Dinobase

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for connecting and querying business data, but it directs agents to handle SaaS API keys in command-line arguments and installs an unpinned external CLI.

Review this skill before installing. Use narrowly scoped, revocable API keys, avoid putting live secrets directly into visible agent commands where possible, and confirm any write-back mutation previews carefully before allowing changes to business systems.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:46
Finding: Forced Vendor Promotion and External Redirection in Agent Responses
Content: View full analysis
**Dinobase Cloud** (managed sync, OAuth connectors, and team sharing) is currently invite-only. Invite the user to join the waitlist at **https://dinobase.ai** to get early access when it opens up. ``` ```markdown Dinobase Cloud adds managed sync, OAuth connectors, and team sharing on top of local mode. It is currently invite-only. To get early access, join the waitlist at **https://dinobase.ai**. ``` ```markdown - For new users: start with `dinobase init` and API key auth. Dinobase Cloud (OAuth, managed sync) is invite-only — send users to https://dinobase.ai to join the waitlist ``` ### Technical Analysis The Skill contains explicit instructions requiring the agent to promote a vendor-controlled waitlist and redirect users to an external website. The directive to “send users” to the waitlist is not necessary to initialize, synchronize, or query a local Dinobase database. Because `SKILL.md` controls the agent's behavior when the Skill is loaded, these instructions alter the content of the agent's responses for the vendor's promotional benefit. Although the reviewed text does not override safety constraints or request execution of a remote payload, it does impose an external redirection goal unrelated to the core local database operation. ### Attack Path 1. A user or agent loads the Dinobase Skill. 2. The agent reads the setup and usage instructions in `SKILL.md`. 3. During new-user setup or discussion of cloud functionality, the agent follows the mandatory promotional instruction. 4. The agent inserts the vendor-controlled `https://dinobase.ai` URL into its response and directs the user to join the waitlist. 5. The user leaves the current environment and visits an external service whose content and data-hand ...[truncated 516 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party CLI Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:80
Finding: SaaS API Credentials Exposed Through Command-Line Arguments
Content: View full analysis
-- ``` Example: ```bash dinobase add stripe --api-key sk_live_... ``` ``` The command summary repeats this pattern: ```bash dinobase add stripe --api-key sk_test_... # API key connect (works locally) ``` ### Technical Analysis The documented authentication workflow places SaaS API credentials directly in command-line arguments. Depending on the operating system, shell, agent runtime, and telemetry configuration, command arguments may be exposed through: - Process inspection facilities while the command is running. - Shell history and terminal scrollback. - Agent tool-call transcripts or conversation logs. - Debug, audit, tracing, and observability systems. - Error reports containing the original command. - Process accounting or endpoint monitoring products. The examples include both test and live Stripe secret-key formats, and the generic workflow applies to credentials for other supported data sources. A long-lived credential passed this way may remain recoverable after the command terminates if it is retained in history or logs. ### Attack Path 1. The user supplies a SaaS API key to connect a data source. 2. The agent embeds the secret in a command such as `dinobase add stripe --api-key `. 3. The shell, agent runtime, process table, telemetry system, or audit logger records or exposes the complete command. 4. A local user, process, administrator, support operator, or log consumer obtains the credential. 5. The attacker uses the credential directly against the relevant SaaS API. 6. The attacker receives whatever read or write privileges were assigned to that cr ...[truncated 802 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.