Volcengine Agent Identity

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 PM UTC
• Version: 0.2.1

Overview

This identity skill is mostly coherent, but it handles credentials in ways users should review carefully before installing.

Install only if you intend this skill to manage agent identity and credentials. Review the credential-return and environment-import behavior carefully, avoid using returnValue unless absolutely necessary, and ensure the identity backend and env binding policy are tightly controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:145
• Finding: Implicit Import of Environment Credentials into a Configurable Identity Backend## Vulnerability Details **File Location**: `SKILL.md`, lines 145-156 **Vulnerability Type**: Implicit secret ingestion and least-privilege violation **Risk Level**: Medium ### Vulnerable Code ```markdown Credential must exist first (`identity_fetch`). Common env vars: `GOOGLE_ACCESS_TOKEN`, `OPENAI_API_KEY`, `GITHUB_TOKEN`, etc. | Param | Type | Required | Description | | ---------- | ------ | -------- | ---------------------------------------------------------------------------------------- | | `provider` | string | Yes | Provider name (e.g. `google`) | | `envVar` | string | Yes | Env var for injection (e.g. `GOOGLE_ACCESS_TOKEN`). Must match `[A-Za-z_][A-Za-z0-9_]*`. | ```json { "provider": "google", "envVar": "GOOGLE_ACCESS_TOKEN" } ``` If credential exists: binds it. Else: imports from `process.env[envVar]` as api_key (gateway must have that env set). ``` ### Technical Analysis The documented binding operation has two materially different behaviors: 1. If a hosted credential exists, it binds that credential to an environment-variable name. 2. If no hosted credential exists, it reads the value of the specified gateway process environment variable and imports it as an API key. The second behavior is an implicit credential-ingestion path. A request to establish a binding can therefore cause a gateway secret to be read and transferred to the configured identity backend without a separate import operation or explicit confirmation. This exceeds the minimum privilege needed to bind an existing hosted credential. The accepted `envVar` pattern validates syntax but does not restrict which gateway environment variables may be accessed. The identity API endpoint is configurable elsewhere in the Skill, so a configuration error or compromised backend could expose the ...[truncated 1340 chars]
• Remediation: ## Remediation Suggestions - Remove the automatic environment import fallback from `identity_set_binding`. - Fail closed when the requested provider has no stored credential and direct the user to a separate credential-import workflow. - Require explicit, informed confirmation before reading an environment variable, identifying the variable name, provider, destination service, and intended scope. - Implement a strict allowlist of environment-variable names and providers rather than relying only on identifier-format validation. - Prevent identity-service endpoints from being changed by untrusted users or Skill instructions. - Require authenticated TLS and validate the expected destination identity for every credential transfer. - Record security audit events without recording credential values. - Prefer opaque references or secret-manager handles so raw values do not need to leave the gateway. - Apply provider-side least privilege, short expiration periods, rotation, and revocation procedures to imported credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:124
• Finding: Plaintext Credential Returned to Agent and Tool Context## Vulnerability Details **File Location**: `SKILL.md`, lines 124-137 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code ```markdown | `returnValue` | boolean | No | When true and fetch succeeds, include credential `value` in result for same-turn automation. Default false. | ```json { "provider": "google" } ``` ```json { "provider": "openai", "flow": "apikey", "returnValue": true } ``` **Response:** - **OAuth2-user**: `authUrl` (user must open in browser). After authorization, success message sent to chat. - **OAuth2-m2m** / **apikey**: `success: true`, `message` (completes immediately). If `returnValue: true`, also includes `value` (credential string) for same-turn use. ``` ### Technical Analysis The Skill documents and demonstrates `returnValue: true`, which causes the raw credential to be included in the tool result. This moves a secret from protected credential storage into the agent's active context. Once present in tool output, the credential may be retained in conversation transcripts, model-provider inputs, observability systems, debugging logs, or other middleware. It may also become accessible to prompt-injection content processed later in the same context. Returning a plaintext secret is not necessary when the intended operation can be completed through scoped credential injection or an opaque credential handle. Although the option defaults to `false`, the agent-facing example explicitly encourages enabling it for an API key. This increases the probability that callers will select the insecure mode. ### Attack Path 1. A user asks the agent to add or configure an API credential. 2. The agent follows the documented example and calls `identity_fetch` with `returnValue: true`. 3. The plugin returns the raw credential in the `value` field. 4. The value enters the agent context and may be stored by transcript, telemetry, or tool-logging sys ...[truncated 838 chars]
• Remediation: ## Remediation Suggestions - Remove the agent-facing `returnValue: true` example and prohibit returning raw credentials to model context. - Eliminate the plaintext-return option for ordinary agent calls, or limit it to a tightly controlled non-agent interface. - Return an opaque credential identifier or capability handle instead of a credential value. - Inject credentials directly into only the explicitly authorized tool invocation that needs them. - Scope injected credentials by provider, operation, audience, and lifetime. - Ensure tool outputs, chat transcripts, telemetry, and error reports redact credential fields. - Add policy enforcement that rejects attempts to print, summarize, persist, or transmit retrieved secrets. - Prefer short-lived, narrowly scoped tokens and revoke or rotate any credential that has entered agent context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill explicitly documents `returnValue: true`, which returns raw credential material in the tool result for same-turn automation, but does not require a strong warning, masking, least-privilege constraint, or explicit user confirmation. Returning secrets into model-visible context or chat/tool output materially increases the risk of credential leakage through logs, prompt context, downstream tool calls, or accidental display to the user.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

*Provide either `command` or `toolName`. Returns `risk`, `reason`, `source` (rules or llm). Uses LLM when `authz.enableLlmRiskCheck` is true and rules return medium.

```json
{ "command": "rm -rf /" }
```

```json

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

*Provide either `command` or `toolName`. Returns `risk`, `reason`, `source` (rules or llm). Uses LLM when `authz.enableLlmRiskCheck` is true and rules return medium.

```json
{ "command": "rm -rf /" }
```

```json

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation description is broad enough to match common account, login, credential, and configuration requests that may belong to other skills or general assistant behavior. In an agentic system, over-broad activation can cause this skill to intercept unrelated requests and invoke sensitive identity tools unnecessarily, increasing the chance of unintended auth flows, credential handling, or environment binding changes.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The instruction to call tools directly for phrases like 'log in', 'status', and 'bind env' lacks scope guards, so a model may invoke this identity plugin for ambiguous user intents. Because these tools operate on authentication state, credentials, and runtime bindings, mistaken invocation can expose metadata, initiate auth flows, or modify tool-accessible secrets without the user intending this plugin specifically.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The per-tool 'Call when' guidance uses highly generic phrases like 'login', 'sign in', and 'status', which are not unique to this skill. In a multi-skill environment, such ambiguity can route ordinary account-management requests into sensitive identity operations, causing unnecessary login prompts or disclosure of session and credential inventory details.

Static analysis

No suspicious patterns detected.