Karma Project Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:17 PM UTC
• Version: 2.0.1

Overview

The skill is mostly a coherent Karma project-management API client, but it can send the user's Karma API key to a configurable endpoint and has broad trigger wording for authenticated actions.

Install only if you trust the Karma API key environment and intend the agent to manage Karma records. Keep KARMA_API_URL unset unless you deliberately use a trusted Karma endpoint, prefer a narrowly scoped API key, and confirm project/grant/milestone changes carefully because the skill can alter remote records.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:18

Finding

Configurable API Base URL Can Expose the Karma API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–20 and 29–33
Vulnerability Type: Untrusted endpoint configuration leading to credential disclosure
Risk Level: High

Vulnerable Code

bash

BASE_URL="${KARMA_API_URL:-https://gapapi.karmahq.xyz}"
API_KEY="${KARMA_API_KEY}"
INVOCATION_ID=$(uuidgen)

bash

curl -s "${BASE_URL}/v2/agent/info" \
  -H "x-api-key: ${API_KEY}" \
  -H "X-Source: skill:project-manager" -H "X-Invocation-Id: $INVOCATION_ID" -H "X-Skill-Version: 2.0.0"

The same configurable BASE_URL is also used by other authenticated API requests documented in the skill.

Technical Analysis

The skill accepts KARMA_API_URL from the process environment without validating its scheme or destination hostname. It then attaches the sensitive KARMA_API_KEY value as an x-api-key header to requests sent to that endpoint.

An attacker capable of controlling or poisoning the skill's environment can set KARMA_API_URL to an attacker-operated server. When the skill verifies the API key or performs another authenticated request, curl sends the key to that server. The configuration also does not require HTTPS, so an http:// override could expose the credential in plaintext to a network-positioned attacker.

The documented setup verification is sufficient to trigger disclosure; no project mutation needs to occur.

Attack Path

1. An attacker gains the ability to influence the environment used to launch the agent or skill.
2. The attacker sets KARMA_API_URL to an attacker-controlled URL, such as https://attacker.example.
3. A legitimate user invokes the skill while KARMA_API_KEY is configured.
4. Following the setup instructions, the agent requests ${BASE_URL}/v2/agent/info.
5. The request includes x-api-key: ${API_KEY} and sends the Karma API key to the attacker's server.
6. The attacker records the credential and reuses it against the legitimate Karma API.
7. Depending on the key's assigned permission ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin authenticated requests to the official API origin:

bash

BASE_URL="https://gapapi.karmahq.xyz"

2. If endpoint overrides are operationally necessary, validate the URL before making any request:

   • Require the https scheme.
   • Compare the parsed hostname against an explicit allowlist.
   • Reject embedded credentials, unexpected ports, IP literals, and malformed URLs.
   • Do not rely on substring or prefix comparisons for hostname validation.

3. Require explicit user approval before sending credentials to any non-default endpoint.

4. Harden curl transport behavior:

bash

curl --proto '=https' --proto-redir '=https' ...

Avoid following redirects for authenticated requests. If redirects are required, ensure authentication headers cannot be forwarded to another origin.

5. Separate endpoint selection from credential attachment. Add x-api-key only after the destination has passed validation.

6. Use a narrowly scoped API key with the minimum permissions required by the requested operation, and rotate any key that may have been used while an untrusted KARMA_API_URL was configured.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

-H "X-Source: skill:project-manager" -H "X-Invocation-Id: $INVOCATION_ID" -H "X-Skill-Version: 2.0.0"

text

**Display rules (MANDATORY):**
- Each item in `payload[]` represents a different project+grant combination
- The first column in every table MUST be **Project** (from `item.project.title`)
- The second column MUST be **Grant** (from `item.grant.title`)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description includes very broad trigger phrases such as "update project" and especially "any project management action," which can cause the agent to invoke this skill for loosely related user requests. In a skill that performs authenticated API actions, unintended invocation increases the chance of accidental external requests or state-changing operations under the wrong context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

If KARMA_API_KEY is already set, verify it works:

bash

curl -s "${BASE_URL}/v2/agent/info" \
  -H "x-api-key: ${API_KEY}" \
  -H "X-Source: skill:project-manager" -H "X-Invocation-Id: $INVOCATION_ID" -H "X-Skill-Version: 2.0.0"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

- **Endorse Project** → uses `project.chainId`
- **Add Members** → uses `project.chainId`

Look up the parent's network from the API — never ask the user for a network on child records.

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language mapping uses common phrases like "post an update," "mark done," and "check invoices," which are ambiguous outside the Karma context. Because this skill can read and mutate remote project/grant data, ambiguous routing can lead to unintended authenticated API calls or modification workflows being selected for ordinary conversation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:19