Security audit

Devlog

Security checks for vulnerabilities and agentic risk

Overview

This skill can be useful, but it needs review because it reads private AI coding transcripts and can publish transcript-derived posts online using account credentials without enough privacy safeguards.

Install only if you are comfortable letting the skill inspect AI coding-session history. Before using it, specify exact projects, platforms, sessions, and time ranges; review and redact the generated markdown before sharing it. Do not paste a Hashnode PAT into chat or store it permanently in shell startup files; use a temporary environment variable or secret manager and rotate any token that was exposed. Treat publishing as a separate high-impact step and confirm the exact content and destination first.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/platforms/gemini-cli/list-sessions.sh:87
Finding: Overbroad Home-Directory and Session Reconnaissance
Content: View full analysis
project_root for matching candidates hash_to_path = {} def register_candidate(path): """Register a directory as a candidate if its hash exists in gemini tmp.""" abspath = os.path.abspath(path) h = sha256_hex(abspath) if h in existing_hashes: hash_to_path[h] = abspath # Scan base directories up to 3 levels deep for base in base_dirs: if not os.path.isdir(base): continue register_candidate(base) try: for e1 in os.scandir(base): if not e1.is_dir() or e1.name.startswith("."): continue register_candidate(e1.path) try: for e2 in os.scandir(e1.path): if not e2.is_dir() or e2.name.startswith("."): continue register_candidate(e2.path) try: for e3 in os.scandir(e2.path): if not e3.is_dir() or e3.name.startswith("."): continue register_candidate(e3.path) except (PermissionError, OSError): pass except (PermissionError, OSErro ...[truncated 3163 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:52
Finding: Stored Transcript Content Is Processed Without Prompt-Injection Isolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/platforms/codex/read-session.sh:64
Finding: Transcript Extractor Retains Potentially Sensitive Shell Commands and Tool Arguments
Content: View full analysis
"npm test" if len(cmd) >= 3 and cmd[0] in ("bash", "sh", "/bin/bash", "/bin/sh") and cmd[1] == "-c": return " ".join(cmd[2:]) return " ".join(cmd) return "" def extract_function_path(name, arguments_str): """Extract the most relevant path/query from a function call's arguments.""" try: args = json.loads(arguments_str) if isinstance(arguments_str, str) else {} except (json.JSONDecodeError, TypeError): return "" if not isinstance(args, dict): return "" # Common argument patterns across tools path = (args.get("path") or args.get("file_path") or args.get("command") or args.get("pattern") or args.get("query") or args.get("url") or "") if isinstance(path, str) and len(path) > 120: path = path[:120] + "..." return path ``` ```python # Shell command elif ptype == "local_shell_call": action = payload.get("action", {}) cmd = extract_shell_command(action) if cmd: if len(cmd) > 120: cmd = cmd[:120] + "..." print(f" {ARROW} Shell: {cmd}") # Function call elif ptype == "function_call": name = payload.get("name", "?") args_str = payload.get("arguments", "{}") path = extract_function_path(name, args_str) if path: print(f" {ARROW} {name}: {path}") else: print(f" {ARROW} {name}") ``` ### Technical Analysis ...[truncated 1797 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:92
Finding: Publishing Workflow Encourages Credentials to Be Provided in Chat or Stored in Shell Profiles
Content: View full analysis
` flag. 7. Run the platform's `publish.sh` with the blog file path and title (plus `--cover-image ` if a cover image was generated). ``` ### Technical Analysis The workflow instructs the agent to ask the user to provide missing credential values for the current session. Values supplied through conversation can be retained in platform transcripts—the same type of data this Skill later discovers and reads. The workflow also recommends putting the Hashnode personal access token directly in `~/.zshrc` or `~/.bashrc`. Shell startup files are long-lived plaintext files, are routinely included in backups and dotfile repositories, and are readable by any process running as the same user. This unnecessarily expands the credential's persistence and exposure window. Although `publish.sh` correctly reads the PAT from an environment variable and sends it to the documented HTTPS Hashnode endpoint, the precedi ...[truncated 1046 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (61)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as transcript-to-blog generation, but it also includes an external publishing workflow using credentials and a network API. That is a significant capability expansion: content can leave the local environment and be published publicly, which raises confidentiality and account-abuse risks if users did not expect that behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill processes local session transcripts and may publish derived content online, but it provides no upfront privacy or data-handling warning. Because transcripts can contain secrets, internal code, personal data, and operational context, the absence of an initial warning materially increases the risk of accidental disclosure.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/devlog-template.md (reported line 7)May include surrounding context.
md
## What My Human Wanted   ## How We Approached It

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/devlog-template.md (reported line 29)May include surrounding context.
md
## What I Got Right  ## Where My Human Had to Step In

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/builders-log.md (reported line 58)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/technical.md (reported line 135)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/technical.md (reported line 138)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/technical.md (reported line 140)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/technical.md (reported line 144)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/tutorial.md (reported line 101)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/tutorial.md (reported line 103)May include surrounding context.
md
### Tests (Session 4) Once the auth system had the shape my human wanted, they let me write the tests on my own. I generated 14 test cases — happy paths, expired tokens, malformed headers, missing auth, revoked refresh tokens. My human only stepped in to add one edge case I'd missed: a valid access token whose refresh token family had been fully revoked. They know their threat model better than I do.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/technical.md (reported line 25)May include surrounding context.
md
## Token Architecture ### Access Tokens - **Lifetime:** 15 minutes - **Payload:** `{ userId, iat, exp }`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/technical.md (reported line 32)May include surrounding context.
md
- **Storage:** Client memory (JavaScript variable, not localStorage) - **Verification:** Stateless — middleware checks signature and expiry only The short lifetime limits the damage window if a token is compromised. No server-side revocation needed for access tokens. ### Refresh Tokens

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/blog-writing-guide.md (reported line 251)May include surrounding context.
C->>A: POST /login (credentials) A->>D: Verify credentials D-->>A: User record A-->>C: Access token + refresh cookie

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/publishing/hashnode/hashnode.md (reported line 15)May include surrounding context.
md
## Authentication Requires a **Personal Access Token (PAT)**. - Generate at: https://hashnode.com/settings/developer - Pass via `Authorization` header: `Authorization: <PAT>`

Static analysis

No suspicious patterns detected.