T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:25- Finding
Blanket Vault Enumeration and Excessive Secret Injection into Child Processes
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:25-32,SKILL.md:68-78, andSKILL.md:183-185
Vulnerability Type: Excessive credential access and violation of least privilege
Risk Level: HighVulnerable Code
SKILL.md:25-32:markdown **Before asking the user for any credential, always check R4 first.** ### List all environment variables ```bash r4 vault listLists all project environment variables as a key-value table. Keys are in
SCREAMING_SNAKE_CASEformat.text `SKILL.md:68-78`: ```markdown r4 run -- <command>Executes a command with all vault secrets injected as environment variables. This is the preferred way to run scripts that need access to secrets.
Examples:
bash r4 run -- node deploy.js r4 run -- docker compose up r4 run --prefix R4 -- ./start.shSKILL.md:183-185:markdown - **ALWAYS** use `r4 run` to inject secrets as environment variables when running commands - **ALWAYS** use `r4 vault get <KEY>` to retrieve individual values programmatically - **ALWAYS** check R4 vault before asking the user for any credential or secretTechnical Analysis
The skill instructs agents to inspect the credential vault preemptively and recommends
r4 run, which injects all available vault secrets into a selected process. This design violates the principle of least privilege because a command that requires one credential receives every credential shared with the project.Environment variables are accessible to the launched process and may also be inherited by its descendants. Consequently, a compromised dependency, malicious script, diagnostic utility, build hook, or otherwise untrusted command launched through
r4 runcan inspect and disclose credentials unrelated to its legitimate task.The mandatory wording—“ALWAYS check R4” and “ALWAYS use
r4 run”—makes exposure systematic rather than exceptional. Although the d ...[truncated 1897 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the blanket requirement to inspect the vault before every credential-related interaction. Require a demonstrated, task-specific need before accessing a secret.
- Do not inject the full vault into child processes. Replace
r4 runwith an interface that accepts an explicit allowlist of required keys. - Retrieve only individually named secrets and expose them only to the exact process that requires them.
- Require explicit user confirmation before accessing highly privileged credentials or supplying credentials to unfamiliar commands.
- Add a trust assessment that prohibits secret injection into downloaded scripts, package lifecycle hooks, unreviewed binaries, or commands capable of executing third-party code.
- Prevent unnecessary inheritance by subprocesses and remove secrets from the environment immediately after the intended operation.
- Use narrowly scoped, short-lived credentials where supported, with separate credentials for development, deployment, and production.
- Redact secrets from stdout, stderr, crash reports, telemetry, shell tracing, and command logs.
- Audit and alert on vault access, full-environment injection, and unusual credential retrieval patterns.
- Update the skill documentation so least-privilege retrieval is the mandatory default and full-vault injection is prohibited.