Security audit

Token Manager

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local token-cost tracker, but its API-key handling can expose credentials in ways users would not expect.

Install only if you are comfortable with a local tool retaining usage metadata and making provider API calls. Do not pass API keys on the command line, avoid running it with unrelated provider keys in the environment, and review or remove any .data/config.json before using balance checks.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/manager.js:507
Finding: Provider-independent credential selection can disclose API keys to the wrong service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/manager.js:90
Finding: Mutable local configuration can redirect credential-bearing requests to an arbitrary host
Content: View full analysis
{ const lib = config.protocol === 'https' ? https : http; const options = { hostname: config.baseUrl, path: path, method: method, headers: { 'Content-Type': 'application/json', ...headers }, timeout: 10000 }; ``` ```js // scripts/manager.js:164-182 async function queryBalance(providerName, apiKey) { const config = loadConfig().providers[providerName]; if (!config) return { success: false, error: 'Unknown provider' }; if (!config.supportsBalance) { return { success: false, error: 'Provider does not support balance query via API', hint: 'Please check balance in console', consoleUrl: getConsoleUrl(providerName) }; } try { switch (providerName) { case 'moonshot': const result = await makeRequest( config, config.balanceEndpoint, 'GET', null, { 'Authorization': `Bearer ${apiKey}` } ); ``` ### Technical Analysis The application loads `.data/config.json` and shallow-merges it into the default configuration. A saved `providers` property replaces the complete default provider map rather than safely merging approved values. Security-sensitive provider fields, including `baseUrl`, `protoco ...[truncated 2309 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/manager.js:495
Finding: API keys accepted through command-line arguments can leak through process metadata and shell history
Content: View full analysis
[balance] [provider] [model] [apiKey] const sessionData = { tokensIn: parseInt(args[1]) || 0, tokensOut: parseInt(args[2]) || 0, contextUsed: parseInt(args[3]) || 0, contextMax: parseInt(args[4]) || 200000, thinking: args[5] || 'off', balance: parseFloat(args[6]) || 0, model: args[8] || 'kimi-k2.5' }; const provider = args[7] || config.activeProvider || 'moonshot'; const apiKey = args[9] || process.env.MOONSHOT_API_KEY || process.env.OPENAI_API_KEY; ``` ```js // scripts/manager.js:514-515 case 'balance': const p = args[1] || config.activeProvider; const key = args[2] || process.env.MOONSHOT_API_KEY; ``` ```text # SKILL.md:80-81 node scripts/manager.js report [balance] [provider] [model] [apiKey] node scripts/manager.js balance [provider] [apiKey] ``` ### Technical Analysis The CLI explicitly accepts API keys as positional arguments. Command-line arguments are generally not a secure secret-transport mechanism because they may be observable through: - Process-listing and monitoring utilities while the process is running. - Shell history files. - Cron and automation configuration. - Job execution logs. - Terminal session recording. - Audit and endpoint monitoring systems. - Error reports that capture the invoked command. This behavior also conflicts with the Skill's security statement that API keys are read only from environment variables. Users relying on that statement may not recognize the exposure created by the documented positional arguments. ### Attack Pat ...[truncated 1124 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code substantially matches parts of the description: it does cross-session tracking, usage analytics, and cost-saving recommendations, all stored locally. However, it does not implement several prominent declared capabilities. There is no scheduler, background monitoring, or alerting mechanism. It also does not actually monitor Kimi/OpenAI/Anthropic/Gemini/local models directly; instead, it accepts manually supplied session data and records it generically. So the description overstates the implementation and implies integrations and automation that are not present.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.
md
node scripts/manager.js report 11000 146 42000 200000 off 9.26 moonshot kimi-k2.5

Context Leakage

High

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill explicitly supports cross-session recording and local persistence of session-level metadata in a .data directory. Even if the example only shows provider, model, token counts, and cost, session tracking across runs materially increases the risk of context leakage, correlation of user activity, retention of sensitive metadata, and accidental inclusion of richer context in future implementations or operator usage.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
Session Tracker (P2 - Analytics)

bash
# Record session for tracking node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency] # Generate reports

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
node scripts/session-tracker.js record <provider> <model> <tokensIn> <tokensOut> <cost> [currency]

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Context Leakage

Session Tracker (P2 - Analytics)

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Static analysis