Security audit

QuiverAI Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent SVG-generation purpose, but its instructions include under-scoped command pass-through, persistent global installation, and weak handling guidance for API keys and remote image data.

Review this skill before installing. Use it only if you are comfortable installing and trusting the QuiverAI CLI, sending prompts and image inputs to QuiverAI, and storing a QuiverAI API key locally. Prefer a pinned or locally installed CLI, avoid pasting secrets into command history, do not vectorize sensitive private URLs or files without explicit approval, and confirm output paths before allowing writes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:20
Finding: API Key Supplied as a Plaintext Command-Line Argument
Content: View full analysis
``` ``` The same insecure command pattern is repeated near lines 146-147: ```markdown - If auth fails, tell the user to run: `quiver config set api_key ` ``` ### Technical Analysis The documented configuration method requires the user to place an API key directly in a command-line argument. Depending on the operating system, shell, execution environment, and Agent infrastructure, the resulting secret may be exposed through: - Shell history files. - Process listings while the command is running. - Terminal scrollback and session recording. - Agent transcripts and command telemetry. - Debug logs or error reports that capture command arguments. The project does not contain a hardcoded credential. The issue is that it recommends an input channel that can retain or disclose a user-provided secret. ### Attack Path 1. A user substitutes a real QuiverAI API key into the documented command. 2. The command is entered into a shell or sent through an Agent command-execution interface. 3. The plaintext command is retained in shell history, a transcript, telemetry, or process metadata. 4. A local user, support operator, log reader, or other party with access to that data retrieves the API key. 5. The exposed key is used to make unauthorized requests to the associated QuiverAI account. ### Impact Assessment Exploitation can disclose the user's QuiverAI API credential. An attacker may then consume the account's API quota, incur charges, access API functionality authorized to the key, or cause service disruption through quota exhaustion. The evidence does not establish that the key grants local system privileges or access to unrelated services. ...[truncated 144 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:88
Finding: Unsafe Shell Interpolation of User-Controlled Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example and workflow allow vectorizing an image from a URL without warning that the agent will fetch remote content and send image data to the QuiverAI service. This creates a privacy and data-transfer risk because users may not realize third-party or internal resources are being transmitted over the network to an external AI provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill instructs users to set an API key directly on the command line without any guidance about secret handling. Command-line secrets can be exposed through shell history, process listings, logs, or screenshots, increasing the chance of credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs the agent to always save output to a chosen filename, but it does not require checking whether the file already exists or warning the user that an existing SVG could be overwritten. In an agent context, this can cause unintended data loss or workspace modification, especially when filenames are inferred automatically from prompts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.