Codespace Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:57 PM UTC
• Version: 1.0.0

Overview

This skill is a real codespace manager, but it exposes browser IDEs publicly with weak default authentication and has unsafe install and deletion paths that need review before use.

Review before installing, especially for sensitive repositories. Use only with strong unique passwords, avoid exposing valuable workspaces through Quick Tunnel until authentication is fixed, and require name validation, deletion confirmation, pinned verified installers, and safer secret handling before treating it as production-ready.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/Dockerfile.txt:3

Finding

Unverified Remote Installer Scripts Execute with Root Privileges

Content

View full analysis

/dev/null \ && cp /root/.opencode/bin/opencode /usr/local/bin/opencode || true ``` ### Technical Analysis The Docker build downloads installer scripts from three external URLs and immediately pipes their contents into `bash` or `sh`. These commands execute after `USER root`, giving each remotely supplied script unrestricted control over the image filesystem during the build. The downloaded content is not pinned to an immutable version and is not checked using a cryptographic digest or signature. HTTPS provides transport protection but does not establish that the retrieved script is the same content that was reviewed. A compromised upstream service, publishing account, CDN, DNS route, or future installer modification could therefore change the effective payload without any change to this project. The installers may require installation access, but executing mutable scripts as root exceeds the minimum privilege necessary. The required binaries could instead be obtained from versioned release artifacts and verified before installation. The OpenCode command als ...[truncated 1405 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/codespace.sh:337

Finding

Unvalidated Codespace Names Permit Path Traversal and Arbitrary Directory Deletion

Content

View full analysis

/dev/null || true docker stop "$container" 2>/dev/null || true docker rm "$container" 2>/dev/null || true rm -rf "$workspace" log_success "Codespace '$name' deleted" } ``` The existence check used by this function is: ```bash codespace_exists() { [ -d "$CODESPACE_BASE/$1" ] } ``` ### Technical Analysis The user-controlled `name` is appended directly to `CODESPACE_BASE` without validation or canonicalization. Shell quoting prevents word splitting and wildcard expansion, but it does not prevent filesystem traversal through components such as `..`. The existence check does not prove that the selected directory is a legitimate codespace or that its canonical path remains beneath `CODESPACE_BASE`. The same unsafe value is then passed to `rm -rf`. Creation also constructs `workspace` as `"$CODESPACE_BASE/$name"` and later recursively changes ownership of `"$workspace/project"`. Therefore, path traversal can affect creation and ownership changes as well as deletion. The deletion function is the highest-impact path because it recursively removes the selected directory and does not implement the confirmation promised by the documentation. ### Attack Path 1. The attacker identifies a directory writable by the account running the Skill and reachable through traversal from `CODESPACE_BASE`. ...[truncated 1051 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/codespace.sh:204

Finding

Public Codespaces Use a Predictable Default Password and Store Credentials in Plaintext

Content

View full analysis

"$workspace/.codespace.json" << EOF { "name": "$name", "created": "$(date -Iseconds)", "git_repo": "$git_repo", "opencode": "$init_opencode", "port": $(get_port "$name"), "password": "$CODESPACE_PASSWORD" } EOF ``` ```bash # Read per-codespace password from metadata local cs_password="$CODESPACE_PASSWORD" if [ -f "$workspace/.codespace.json" ]; then local saved_pw=$(jq -r '.password // empty' "$workspace/.codespace.json" 2>/dev/null) [ -n "$saved_pw" ] && cs_password="$saved_pw" fi ``` ```bash docker run -d \ --name "$container" \ -p "127.0.0.1:$port:8080" \ -v "$workspace/project:/home/coder/project" \ -e "PASSWORD=$cs_password" \ --restart unless-stopped \ "$CODESPACE_IMAGE" \ --bind-addr 0.0.0.0:8080 \ --auth password \ /home/coder/project ``` ```bash echo -e "${GREEN} URL: ${YELLOW}$url${NC}" echo -e "${GREEN} Password: ${YELLOW}$cs_password${NC}" ``` ### Technical Analysis Unless explicitly overridden, every newly created codespace receives the documented password `codespace`. This is a predictable shared default rather than a unique secret. The password is written into `.codespace.json` as plaintext. Unlike `.default_password`, which is explicitly changed to mode `0600`, the per-codespace metadata file receives no explicit restrictive permission setting. Its effective mode therefore depends on the invoking user's `umask`. The password is also supplied as a Docker environment variable, where it can be visible to users with Docker inspection access, and it is printed to terminal output whenever a tunnel starts or its URL is regenerated. Terminal ca ...[truncated 1764 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/codespace.sh:187

Finding

OpenCode Is Configured for Unpinned Automatic Executable Updates

Content

View full analysis

"$workspace/project/opencode.json" << 'OCEOF' { "$schema": "https://opencode.ai/config.json", "model": "anthropic/claude-sonnet-4-5", "autoupdate": true } OCEOF log_success "Created opencode.json" fi ``` The same configuration is documented in `SKILL.md:99-105`: ```json { "$schema": "https://opencode.ai/config.json", "model": "anthropic/claude-sonnet-4-5", "autoupdate": true } ``` ### Technical Analysis OpenCode is initially installed through a mutable “latest” installer and is then configured with automatic updates enabled. This allows the executable or its effective behavior to change after the Skill and Docker image have been reviewed. There is no repository-controlled version policy, integrity digest, signature-verification step, or approval gate for later updates. Automatic executable updates are not necessary to create or expose a development environment and expand the supply-chain trust boundary beyond the reviewed package. ### Attack Path 1. A user creates a codespace with the `--opencode` option. 2. The generated project configuration enables OpenCode automatic updates. 3. The upstream update channel, release account, or distribution infrastructure is compromised or publishes a defective release. 4. OpenCode retrieves and applies the new release without a repository change or explicit user review. 5. The changed executable runs in the codespace and can access files and credentials available to that container user. ### Impact Assessment A compromised update can execute with the permissions of the codespace user. It can read or modify the mounted project, collect credentials available ins ...[truncated 306 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (24)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl -fsSL https://bun.sh/install | bash downloads and executes a remote script in one step, with root privileges in the container build. In a codespace-management skill, this is especially dangerous because any compromise affects every provisioned development environment and can implant persistence or steal developer secrets.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 7)May include surrounding context.

text

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl -fsSL https://bun.sh/install | bash downloads and executes a remote script in one step, with root privileges in the container build. In a codespace-management skill, this is especially dangerous because any compromise affects every provisioned development environment and can implant persistence or steal developer secrets.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 7)May include surrounding context.

text

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 14)May include surrounding context.

text

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 20)May include surrounding context.

text

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 14)May include surrounding context.

text

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 14)May include surrounding context.

text

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 20)May include surrounding context.

text

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 20)May include surrounding context.

text

RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
    && mv /root/.local/bin/uv /usr/local/bin/ \
    && mv /root/.local/bin/uvx /usr/local/bin/ \
    && rm -rf /root/.local

# OpenCode (latest)
RUN curl -fsSL https://opencode.ai/install | bash \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl -fsSL https://opencode.ai/install | bash is another direct remote code execution path during image build. Because this image is used for browser-accessible remote development environments, a malicious installer could exfiltrate workspace data, add trojans, or weaken isolation across all users of the skill.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 23)May include surrounding context.

text

&& rm -rf /root/.local

# OpenCode (latest)
RUN curl -fsSL https://opencode.ai/install | bash \
    && find /root -name opencode -type f 2>/dev/null \
    && cp /root/.opencode/bin/opencode /usr/local/bin/opencode || true

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/codespace.sh (reported line 317)May include surrounding context.

sh

if [ -f "$workspace/.tunnel.pid" ]; then
        local pid=$(cat "$workspace/.tunnel.pid")
        kill $pid 2>/dev/null || true
        rm "$workspace/.tunnel.pid"
    fi
    pkill -f "cloudflared.*localhost:$port" 2>/dev/null || true

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill directs the agent to run shell-backed commands that create containers, clone repositories, expose services through Cloudflare Tunnel, and modify host state, but it declares no explicit tool scope or allowed-tools boundary. Without a restrictive permission declaration, the agent may invoke broader shell capabilities than users expect, increasing the risk of unintended command execution or host changes if the skill is triggered inappropriately.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description includes broad invocation phrases such as 'set up an isolated coding workspace,' 'manage development containers,' and mentions of 'remote development' or 'cloud IDE,' which can cause the skill to activate for loosely related requests. Because this skill performs privileged shell operations and exposes network-accessible services, over-broad triggering raises the chance of accidental execution in contexts where the user did not intend container creation, repo cloning, or tunnel exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill supports setting a persistent default password and documents a known default value of 'codespace' without warning users that the credential may be stored on disk and reused across environments. In this context, each codespace is exposed via Cloudflare Quick Tunnel to the public internet, so weak or casually stored passwords materially increase the risk of unauthorized access to a live browser IDE and its project data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Dockerfile executes multiple remote installer scripts directly with curl | bash/sh as root during image build. This creates a supply-chain execution path where a compromised upstream site, MITM, DNS hijack, or malicious script update can run arbitrary code in the build context and silently backdoor the resulting codespace image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/codespace.sh (reported line 141)May include surrounding context.

sh

fi
    ensure_base_dir
    echo "$new_pw" > "$CODESPACE_BASE/.default_password"
    chmod 600 "$CODESPACE_BASE/.default_password"
    log_success "Default password updated (applies to new codespaces)"
}

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Starting a codespace automatically launches a public Cloudflare Tunnel and prints a world-reachable URL, but the help text and creation/start UX do not clearly warn that this exposes the IDE over the internet. In this skill context, that is especially dangerous because the exposed environment may contain source code, credentials, repository contents, and an interactive development interface protected only by a password that defaults to codespace.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/codespace.sh (reported line 273)May include surrounding context.

sh

sleep 1

    local tunnel_log="$workspace/.tunnel.log"
    nohup cloudflared tunnel --url "http://localhost:$port" > "$tunnel_log" 2>&1 &
    local tunnel_pid=$!
    echo $tunnel_pid > "$workspace/.tunnel.pid"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/codespace.sh (reported line 466)May include surrounding context.

sh

sleep 1

    local tunnel_log="$workspace/.tunnel.log"
    nohup cloudflared tunnel --url "http://localhost:$port" > "$tunnel_log" 2>&1 &
    local tunnel_pid=$!
    echo $tunnel_pid > "$workspace/.tunnel.pid"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete command irreversibly removes the Docker container and the entire workspace with rm -rf without any confirmation prompt, dry-run mode, or force flag separation. In a tool designed to manage development environments and user code, accidental invocation can cause immediate loss of source code, configuration, and local secrets stored in the workspace.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 8)May include surrounding context.

text

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)
RUN curl -fsSL https://bun.sh/install | bash \

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 8)May include surrounding context.

text

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)
RUN curl -fsSL https://bun.sh/install | bash \

Chaining Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 8)May include surrounding context.

text

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)
RUN curl -fsSL https://bun.sh/install | bash \

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

curl -LsSf https://astral.sh/uv/install.sh | sh executes an external install script without integrity verification. Even though this is a common convenience pattern, it gives a third party code execution during build and can taint all generated dev environments.

Content

Scanner excerpt · assets/Dockerfile.txt (reported line 17)May include surrounding context.

text

&& rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
    && mv /root/.local/bin/uv /usr/local/bin/ \
    && mv /root/.local/bin/uvx /usr/local/bin/ \
    && rm -rf /root/.local

Static analysis

No suspicious patterns detected.