pandora

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:46 PM UTC
• Version: 0.1.0

Overview

Pandora presents itself as a secure secrets vault, but the artifacts show only a placeholder command script that can make users believe secrets were stored or rotated when no vault action occurred.

Review carefully before installing. Do not use this skill for real secrets: it does not store, encrypt, list, or rotate credentials, and following its documented command-line example could expose a secret in shell history or process logs. The publisher should either implement a real vault backend with safe secret input and clear failures, or remove the security claims and exec permission until those controls exist.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Plaintext Secrets Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-26
Vulnerability Type: Plaintext sensitive data exposure
Risk Level: Medium

Vulnerable Code

bash

# Store a new secret
./scripts/vault-ops.sh --store --key "db_password" --value "secret"

Technical Analysis

The documented storage command supplies the secret through the --value command-line argument. Command-line arguments are not an appropriate channel for sensitive values because they can be retained in shell history and may be exposed through process inspection, diagnostic utilities, audit systems, terminal logging, or process-monitoring software.

This usage directly conflicts with the stated purpose of protecting secrets. Although the current script ignores --value, users following the documented interface still expose the plaintext value before the script processes it.

Attack Path

1. A user follows the documented example and invokes vault-ops.sh with a production secret in --value.
2. The shell may retain the complete command in its history file.
3. While the process is running, an authorized local observer or monitoring tool may capture its argument list.
4. Diagnostic, audit, or terminal logs may retain the command after execution.
5. An attacker who later obtains access to one of these records can recover and reuse the plaintext credential.

Impact Assessment

Exploitation can disclose any password, API token, database credential, or configuration secret supplied using the documented interface. The flaw does not itself provide privilege escalation; the attacker's resulting privileges are those granted by the exposed credential. Consequently, scope ranges from access to a single application account to broader database, API, or production-system access, depending on the secret involved.

Remediation

View remediation

Remediation Suggestions

• Remove the --value command-line option and all examples that place secrets in process arguments.
• Read interactive secrets with terminal echo disabled, such as through read -r -s.
• For automation, accept the secret through a protected file descriptor or standard input, with clear warnings concerning pipelines and logging.
• Avoid storing submitted plaintext in shell variables longer than necessary, and unset sensitive variables after use.
• Ensure logs and error messages never include secret values.
• Document secure, history-safe examples and explain the security properties of each supported input mechanism.
• Add automated tests confirming that secret values do not appear in process arguments or program output.

other

Warning

• Location: scripts/vault-ops.sh:6

Finding

Vault Operations Falsely Report Modes Without Performing Security Actions

Content

View full analysis

Vulnerability Details

File Location: scripts/vault-ops.sh, lines 6-23; related claims in SKILL.md, lines 13-20 and 43-51, and README.md, lines 5-18
Vulnerability Type: Misleading or unimplemented security functionality
Risk Level: Medium

Vulnerable Code

bash

# Parse arguments: --store, --rotate, --list-secrets
while [[ $# -gt 0 ]]; do
  case $1 in
    --store)
      echo "[pandora] Store mode"
      shift
      ;;
    --rotate)
      echo "[pandora] Rotate mode"
      shift
      ;;
    --list-secrets)
      echo "[pandora] List secrets mode"
      shift
      ;;
    *)
      shift
      ;;
  esac
done

Technical Analysis

The executable only prints a mode message and silently discards all other arguments. It does not:

• Read or validate a key or secret value.
• Encrypt or persist secret data.
• Connect to a local, KMS, or remote vault backend.
• Enforce authentication or access-control policies.
• Generate or install rotated credentials.
• Enumerate stored keys.
• Report that the requested operation is unimplemented.

Because the script reaches a successful exit after printing messages such as Store mode or Rotate mode, callers can reasonably interpret execution as successful. This conflicts with the documentation's claims of encrypted storage, access control, versioning, and secret rotation. Unknown options are also silently accepted through the wildcard branch rather than causing a nonzero exit.

Attack Path

1. An operator invokes --store and assumes a credential has been securely persisted.
2. The script prints [pandora] Store mode, ignores the key and value arguments, and exits successfully.
3. The operator may remove the original credential source or deploy an application under the false assumption that the vault contains the secret.
4. Alternatively, the operator invokes --rotate after suspected credential leakage.
5. T ...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

• Until the vault is implemented, make every unsupported operation emit an explicit error and exit with a nonzero status.
• Reject unknown options, missing values, conflicting modes, and malformed keys rather than silently ignoring them.
• Implement authenticated storage using a reviewed vault backend with encryption at rest and in transit.
• Define and enforce authorization policies for store, list, and rotate operations.
• Implement rotation transactionally: generate a cryptographically secure replacement, update the dependent service, verify the replacement, revoke the old credential, and report failures.
• Ensure listing returns only authorized key metadata and never secret values.
• Return machine-readable success and failure results so automation can verify completion.
• Add integration tests proving that storage persists, listing omits values, rotation invalidates old credentials, and failed operations return nonzero statuses.
• Remove unsupported claims from README.md, SKILL.md, and claw.json until the corresponding controls exist.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a secure storage vault but also declares executable permissions and a shell script, creating a mismatch between stated purpose and actual capabilities. In the context of a secrets-management skill, this mismatch is especially risky because any execution path can become a vehicle for exfiltrating credentials, altering configuration, or performing unauthorized system actions using sensitive data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest requests the broad "exec" permission even though the skill is presented as a secrets/configuration vault. For a vault-oriented skill, command execution materially expands the attack surface and could enable misuse of stored secrets through arbitrary shell commands or operational scripts if the skill is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.