Codespace Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:57 PM UTC
• Version: 1.0.0

Overview

This skill is a real codespace manager, but it exposes browser IDEs publicly with weak default authentication and has unsafe install and deletion paths that need review before use.

Review before installing, especially for sensitive repositories. Use only with strong unique passwords, avoid exposing valuable workspaces through Quick Tunnel until authentication is fixed, and require name validation, deletion confirmation, pinned verified installers, and safer secret handling before treating it as production-ready.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/Dockerfile.txt:3
• Finding: Unverified Remote Installer Scripts Execute with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `assets/Dockerfile.txt:3-24` **Vulnerability Type**: Unverified remote payload retrieval and privileged execution **Risk Level**: Critical ### Vulnerable Code ```dockerfile USER root # System essentials RUN apt-get update && apt-get install -y --no-install-recommends \ curl git wget unzip ca-certificates build-essential \ && rm -rf /var/lib/apt/lists/* # Bun (latest) RUN curl -fsSL https://bun.sh/install | bash \ && mv /root/.bun/bin/bun /usr/local/bin/ \ && mv /root/.bun/bin/bunx /usr/local/bin/ \ && rm -rf /root/.bun # uv (latest) RUN curl -LsSf https://astral.sh/uv/install.sh | sh \ && mv /root/.local/bin/uv /usr/local/bin/ \ && mv /root/.local/bin/uvx /usr/local/bin/ \ && rm -rf /root/.local # OpenCode (latest) RUN curl -fsSL https://opencode.ai/install | bash \ && find /root -name opencode -type f 2>/dev/null \ && cp /root/.opencode/bin/opencode /usr/local/bin/opencode || true ``` ### Technical Analysis The Docker build downloads installer scripts from three external URLs and immediately pipes their contents into `bash` or `sh`. These commands execute after `USER root`, giving each remotely supplied script unrestricted control over the image filesystem during the build. The downloaded content is not pinned to an immutable version and is not checked using a cryptographic digest or signature. HTTPS provides transport protection but does not establish that the retrieved script is the same content that was reviewed. A compromised upstream service, publishing account, CDN, DNS route, or future installer modification could therefore change the effective payload without any change to this project. The installers may require installation access, but executing mutable scripts as root exceeds the minimum privilege necessary. The required binaries could instead be obtained from versioned release artifacts and verified before installation. The OpenCode command als ...[truncated 1405 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `curl | sh` pipelines. 2. Pin Bun, uv, and OpenCode to explicit audited versions. 3. Download versioned release artifacts into files before installation. 4. Verify each artifact using a hardcoded SHA-256 digest or a validated upstream signature. 5. Abort the build when verification or installation fails; remove the OpenCode `|| true` failure suppression. 6. Perform downloads and extraction under an unprivileged build user where possible, elevating only for the final copy into a system directory. 7. Pin the `codercom/code-server` base image by immutable digest in addition to its version tag. 8. Use a multi-stage build so network-facing installation steps and unnecessary build tools are not retained in the final image. 9. Record approved versions and hashes in the repository so future upgrades require an explicit, reviewable change. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/codespace.sh:337
• Finding: Unvalidated Codespace Names Permit Path Traversal and Arbitrary Directory Deletion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/codespace.sh:337-361` **Vulnerability Type**: Path traversal leading to unsafe recursive deletion **Risk Level**: Critical ### Vulnerable Code ```bash # Delete codespace cmd_delete() { local name="$1" if [ -z "$name" ]; then log_error "Please provide a codespace name" exit 1 fi if ! codespace_exists "$name"; then log_error "Codespace '$name' does not exist" exit 1 fi local container=$(get_container_name "$name") local workspace="$CODESPACE_BASE/$name" local port=$(get_port "$name") pkill -f "cloudflared.*localhost:$port" 2>/dev/null || true docker stop "$container" 2>/dev/null || true docker rm "$container" 2>/dev/null || true rm -rf "$workspace" log_success "Codespace '$name' deleted" } ``` The existence check used by this function is: ```bash codespace_exists() { [ -d "$CODESPACE_BASE/$1" ] } ``` ### Technical Analysis The user-controlled `name` is appended directly to `CODESPACE_BASE` without validation or canonicalization. Shell quoting prevents word splitting and wildcard expansion, but it does not prevent filesystem traversal through components such as `..`. The existence check does not prove that the selected directory is a legitimate codespace or that its canonical path remains beneath `CODESPACE_BASE`. The same unsafe value is then passed to `rm -rf`. Creation also constructs `workspace` as `"$CODESPACE_BASE/$name"` and later recursively changes ownership of `"$workspace/project"`. Therefore, path traversal can affect creation and ownership changes as well as deletion. The deletion function is the highest-impact path because it recursively removes the selected directory and does not implement the confirmation promised by the documentation. ### Attack Path 1. The attacker identifies a directory writable by the account running the Skill and reachable through traversal from `CODESPACE_BASE`. ...[truncated 1051 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate names before using them in any filesystem, Docker, or process operation. For example, require: ```bash [[ "$name" =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$ ]] || exit 1 ``` 2. Explicitly reject names containing `/`, `\`, `.` path components, control characters, or leading hyphens. 3. Canonicalize both the base and candidate path with `realpath`. 4. Verify that the canonical candidate is a direct child of the canonical base directory, not merely a path sharing its string prefix. 5. Refuse symlinked workspace directories and check the target with `lstat`-equivalent behavior before deletion. 6. Require a valid metadata marker inside the directory before treating it as a managed codespace. 7. Add an explicit deletion confirmation, with a separate non-interactive override for automation. 8. Prefer deleting only known managed subpaths rather than applying `rm -rf` to a path derived directly from user input. 9. Apply the same validation to `create`, `start`, `stop`, `restart`, `status`, `logs`, and `url`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/codespace.sh:204
• Finding: Public Codespaces Use a Predictable Default Password and Store Credentials in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `scripts/codespace.sh:9-9, 204-211, 238-258, 284-287` **Vulnerability Type**: Weak default authentication and plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```bash CODESPACE_PASSWORD="${CODESPACE_PASSWORD:-codespace}" ``` ```bash # Save metadata cat > "$workspace/.codespace.json" << EOF { "name": "$name", "created": "$(date -Iseconds)", "git_repo": "$git_repo", "opencode": "$init_opencode", "port": $(get_port "$name"), "password": "$CODESPACE_PASSWORD" } EOF ``` ```bash # Read per-codespace password from metadata local cs_password="$CODESPACE_PASSWORD" if [ -f "$workspace/.codespace.json" ]; then local saved_pw=$(jq -r '.password // empty' "$workspace/.codespace.json" 2>/dev/null) [ -n "$saved_pw" ] && cs_password="$saved_pw" fi ``` ```bash docker run -d \ --name "$container" \ -p "127.0.0.1:$port:8080" \ -v "$workspace/project:/home/coder/project" \ -e "PASSWORD=$cs_password" \ --restart unless-stopped \ "$CODESPACE_IMAGE" \ --bind-addr 0.0.0.0:8080 \ --auth password \ /home/coder/project ``` ```bash echo -e "${GREEN} URL: ${YELLOW}$url${NC}" echo -e "${GREEN} Password: ${YELLOW}$cs_password${NC}" ``` ### Technical Analysis Unless explicitly overridden, every newly created codespace receives the documented password `codespace`. This is a predictable shared default rather than a unique secret. The password is written into `.codespace.json` as plaintext. Unlike `.default_password`, which is explicitly changed to mode `0600`, the per-codespace metadata file receives no explicit restrictive permission setting. Its effective mode therefore depends on the invoking user's `umask`. The password is also supplied as a Docker environment variable, where it can be visible to users with Docker inspection access, and it is printed to terminal output whenever a tunnel starts or its URL is regenerated. Terminal ca ...[truncated 1764 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate a unique, cryptographically random password for every codespace when the user does not provide one. 2. Reject known defaults and enforce adequate password length and entropy. 3. Create metadata using a restrictive `umask`, such as `umask 077`, and explicitly set mode `0600`. 4. Do not place passwords in general-purpose metadata. Store them in a dedicated protected credential file or secret manager. 5. Avoid passing secrets through ordinary Docker environment variables where possible; use a protected file or Docker secret mechanism. 6. Do not print passwords by default. Provide a separate, explicit credential-retrieval command that warns about output sensitivity. 7. Do not include passwords in logs or persistent command output. 8. Prefer a named Cloudflare Tunnel protected by Cloudflare Access, identity-aware authentication, and access policy over an unauthenticated Quick Tunnel protected only by a code-server password. 9. Rotate existing default credentials and treat previously logged passwords as compromised. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/codespace.sh:187
• Finding: OpenCode Is Configured for Unpinned Automatic Executable Updates<![CDATA[ ## Vulnerability Details **File Location**: `scripts/codespace.sh:187-195` **Vulnerability Type**: Uncontrolled dependency updates after review **Risk Level**: Medium ### Vulnerable Code ```bash # Initialize OpenCode project config if [ "$init_opencode" = "yes" ]; then log_info "Initializing OpenCode project config..." cat > "$workspace/project/opencode.json" << 'OCEOF' { "$schema": "https://opencode.ai/config.json", "model": "anthropic/claude-sonnet-4-5", "autoupdate": true } OCEOF log_success "Created opencode.json" fi ``` The same configuration is documented in `SKILL.md:99-105`: ```json { "$schema": "https://opencode.ai/config.json", "model": "anthropic/claude-sonnet-4-5", "autoupdate": true } ``` ### Technical Analysis OpenCode is initially installed through a mutable “latest” installer and is then configured with automatic updates enabled. This allows the executable or its effective behavior to change after the Skill and Docker image have been reviewed. There is no repository-controlled version policy, integrity digest, signature-verification step, or approval gate for later updates. Automatic executable updates are not necessary to create or expose a development environment and expand the supply-chain trust boundary beyond the reviewed package. ### Attack Path 1. A user creates a codespace with the `--opencode` option. 2. The generated project configuration enables OpenCode automatic updates. 3. The upstream update channel, release account, or distribution infrastructure is compromised or publishes a defective release. 4. OpenCode retrieves and applies the new release without a repository change or explicit user review. 5. The changed executable runs in the codespace and can access files and credentials available to that container user. ### Impact Assessment A compromised update can execute with the permissions of the codespace user. It can read or modify the mounted project, collect credentials available ins ...[truncated 306 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `"autoupdate": false` by default. 2. Pin OpenCode to an explicit audited version during image construction. 3. Verify release artifacts using an immutable checksum or trusted signature. 4. Make upgrades an explicit administrative operation that produces a reviewable repository or image change. 5. Rebuild and test the image after approved upgrades instead of changing executables inside running environments. 6. Document the installed version and expose a command that reports version drift without automatically correcting it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (24)

External Script Fetching

High

• Category: Supply Chain

Content

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)

• Confidence: 97% confidence
• Finding: `curl -fsSL https://bun.sh/install | bash` downloads and executes a remote script in one step, with root privileges in the container build. In a codespace-management skill, this is especially dangerous because any compromise affects every provisioned development environment and can implant persistence or steal developer secrets.

External Script Fetching

High

• Category: Supply Chain

Content

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)

• Confidence: 97% confidence
• Finding: `curl -fsSL https://bun.sh/install | bash` downloads and executes a remote script in one step, with root privileges in the container build. In a codespace-management skill, this is especially dangerous because any compromise affects every provisioned development environment and can implant persistence or steal developer secrets.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

RUN curl -fsSL https://bun.sh/install | bash \
    && mv /root/.bun/bin/bun /usr/local/bin/ \
    && mv /root/.bun/bin/bunx /usr/local/bin/ \
    && rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
    && mv /root/.local/bin/uv /usr/local/bin/ \
    && mv /root/.local/bin/uvx /usr/local/bin/ \
    && rm -rf /root/.local

# OpenCode (latest)
RUN curl -fsSL https://opencode.ai/install | bash \

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

&& rm -rf /root/.local

# OpenCode (latest)
RUN curl -fsSL https://opencode.ai/install | bash \
    && find /root -name opencode -type f 2>/dev/null \
    && cp /root/.opencode/bin/opencode /usr/local/bin/opencode || true

• Confidence: 98% confidence
• Finding: `curl -fsSL https://opencode.ai/install | bash` is another direct remote code execution path during image build. Because this image is used for browser-accessible remote development environments, a malicious installer could exfiltrate workspace data, add trojans, or weaken isolation across all users of the skill.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ -f "$workspace/.tunnel.pid" ]; then
        local pid=$(cat "$workspace/.tunnel.pid")
        kill $pid 2>/dev/null || true
        rm "$workspace/.tunnel.pid"
    fi
    pkill -f "cloudflared.*localhost:$port" 2>/dev/null || true

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to run shell-backed commands that create containers, clone repositories, expose services through Cloudflare Tunnel, and modify host state, but it declares no explicit tool scope or allowed-tools boundary. Without a restrictive permission declaration, the agent may invoke broader shell capabilities than users expect, increasing the risk of unintended command execution or host changes if the skill is triggered inappropriately.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description includes broad invocation phrases such as 'set up an isolated coding workspace,' 'manage development containers,' and mentions of 'remote development' or 'cloud IDE,' which can cause the skill to activate for loosely related requests. Because this skill performs privileged shell operations and exposes network-accessible services, over-broad triggering raises the chance of accidental execution in contexts where the user did not intend container creation, repo cloning, or tunnel exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill supports setting a persistent default password and documents a known default value of 'codespace' without warning users that the credential may be stored on disk and reused across environments. In this context, each codespace is exposed via Cloudflare Quick Tunnel to the public internet, so weak or casually stored passwords materially increase the risk of unauthorized access to a live browser IDE and its project data.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The Dockerfile executes multiple remote installer scripts directly with `curl | bash/sh` as root during image build. This creates a supply-chain execution path where a compromised upstream site, MITM, DNS hijack, or malicious script update can run arbitrary code in the build context and silently backdoor the resulting codespace image.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
    ensure_base_dir
    echo "$new_pw" > "$CODESPACE_BASE/.default_password"
    chmod 600 "$CODESPACE_BASE/.default_password"
    log_success "Default password updated (applies to new codespaces)"
}

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Starting a codespace automatically launches a public Cloudflare Tunnel and prints a world-reachable URL, but the help text and creation/start UX do not clearly warn that this exposes the IDE over the internet. In this skill context, that is especially dangerous because the exposed environment may contain source code, credentials, repository contents, and an interactive development interface protected only by a password that defaults to `codespace`.

Session Persistence

Medium

• Category: Rogue Agent

Content

sleep 1

    local tunnel_log="$workspace/.tunnel.log"
    nohup cloudflared tunnel --url "http://localhost:$port" > "$tunnel_log" 2>&1 &
    local tunnel_pid=$!
    echo $tunnel_pid > "$workspace/.tunnel.pid"

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

sleep 1

    local tunnel_log="$workspace/.tunnel.log"
    nohup cloudflared tunnel --url "http://localhost:$port" > "$tunnel_log" 2>&1 &
    local tunnel_pid=$!
    echo $tunnel_pid > "$workspace/.tunnel.pid"

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The `delete` command irreversibly removes the Docker container and the entire workspace with `rm -rf` without any confirmation prompt, dry-run mode, or force flag separation. In a tool designed to manage development environments and user code, accidental invocation can cause immediate loss of source code, configuration, and local secrets stored in the workspace.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)
RUN curl -fsSL https://bun.sh/install | bash \

• Confidence: 15% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)
RUN curl -fsSL https://bun.sh/install | bash \

• Confidence: 15% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

Low

• Category: Tool Misuse

Content

# System essentials
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git wget unzip ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

# Bun (latest)
RUN curl -fsSL https://bun.sh/install | bash \

• Confidence: 15% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

Low

• Category: Supply Chain

Content

&& rm -rf /root/.bun

# uv (latest)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
    && mv /root/.local/bin/uv /usr/local/bin/ \
    && mv /root/.local/bin/uvx /usr/local/bin/ \
    && rm -rf /root/.local

• Confidence: 95% confidence
• Finding: `curl -LsSf https://astral.sh/uv/install.sh | sh` executes an external install script without integrity verification. Even though this is a common convenience pattern, it gives a third party code execution during build and can taint all generated dev environments.

Static analysis

No suspicious patterns detected.