SatGate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:58 PM UTC
• Version: 0.1.2

Overview

This skill appears purpose-aligned, but its installer and credential setup carry review-worthy supply-chain and token-handling risks.

Install only if you trust the SatGate publisher and are comfortable with a downloaded CLI being placed on your PATH. Prefer a user-owned SATGATE_INSTALL_DIR, verify releases independently, avoid entering tokens while screen sharing or in logged terminals, and use least-privilege or short-lived tokens where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:48
• Finding: Downloaded Executable Is Installed and Run When Integrity Verification Is Unavailable<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh`, lines 48–80 and 94–107 **Vulnerability Type**: Fail-open integrity verification of a remotely downloaded executable **Risk Level**: High ### Vulnerable Code ```bash # Download binary and checksums echo " Downloading ${BINARY}-${PLATFORM}..." curl -fsSL "${BASE_URL}/${BINARY}-${PLATFORM}" -o "${TMPDIR}/${BINARY}" || { echo "❌ Download failed. No release binaries found." echo " Build from source: git clone https://github.com/${REPO} && cd satgate-cli && make build" exit 1 } echo " Downloading SHA256SUMS..." curl -fsSL "${BASE_URL}/SHA256SUMS" -o "${TMPDIR}/SHA256SUMS" || { echo "⚠️ Checksums not available — skipping verification." echo " Consider building from source for verified integrity." } # Verify checksum if [ -f "${TMPDIR}/SHA256SUMS" ]; then echo " Verifying checksum..." cd "$TMPDIR" EXPECTED=$(grep "${BINARY}-${PLATFORM}" SHA256SUMS | awk '{print $1}') if [ -n "$EXPECTED" ]; then if command -v sha256sum &>/dev/null; then ACTUAL=$(sha256sum "$BINARY" | awk '{print $1}') elif command -v shasum &>/dev/null; then ACTUAL=$(shasum -a 256 "$BINARY" | awk '{print $1}') else echo "⚠️ No sha256sum or shasum found — skipping verification." ACTUAL="$EXPECTED" fi if [ "$EXPECTED" != "$ACTUAL" ]; then echo "❌ Checksum verification FAILED!" echo " Expected: $EXPECTED" echo " Actual: $ACTUAL" echo " The binary may have been tampered with. Aborting." exit 1 fi echo " ✓ Checksum verified." else echo "⚠️ Binary not found in SHA256SUMS — skipping verification." fi cd - >/dev/null fi ``` ```bash # Install chmod +x "${TMPDIR}/${BINARY}" mkdir -p "$INSTALL_DIR" 2>/dev/null || true if [ -w "$INSTALL_DIR" ]; then mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}" else echo " Installing to ${INSTALL_DIR} (requires sudo)..." sudo mv "${TMPDIR}/${BINARY}" "${INSTAL ...[truncated 2793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Fail closed if the checksum file cannot be downloaded, the platform entry is missing, or no supported hashing tool is available. 2. Remove the fallback assignment `ACTUAL="$EXPECTED"` and terminate installation with a nonzero exit status instead. 3. Pin an explicit release version rather than defaulting to the mutable `latest` endpoint. 4. Authenticate releases using a cryptographic signature verified against a publisher key obtained through a separate trusted channel. 5. Prefer embedding or distributing an expected digest through a trusted, version-controlled release process rather than retrieving the binary and digest from the same mutable location. 6. Validate that the checksum entry exactly matches the expected filename and reject missing, duplicate, or malformed entries. 7. Download to a securely created temporary directory, verify before setting executable permissions, and install only after all checks pass. 8. Avoid immediately executing the newly installed binary. If post-installation execution is necessary, perform it only after successful independent authentication. 9. Document the exact upstream repository, release version, verification method, and expected signing identity for operators. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/configure.sh:40
• Finding: Credential Input Is Echoed and Configuration Permissions Are Applied After Secret Material Is Written<![CDATA[ ## Vulnerability Details **File Location**: `scripts/configure.sh`, lines 40–55 and 67–79 **Vulnerability Type**: Insecure handling of session and administrative tokens **Risk Level**: Medium ### Vulnerable Code ```bash read -p " Session token: " SESSION_TOKEN read -p " Tenant slug (press Enter for default): " TENANT TENANT="${TENANT:-default}" # Write config mkdir -p "$CONFIG_DIR" cat > "$CONFIG_FILE" <<EOF # SatGate CLI Configuration # Generated by configure.sh surface: cloud gateway: ${GATEWAY} session_token: ${SESSION_TOKEN} tenant: ${TENANT} format: table EOF ``` ```bash read -p " Admin token: " ADMIN_TOKEN # Write config mkdir -p "$CONFIG_DIR" cat > "$CONFIG_FILE" <<EOF # SatGate CLI Configuration # Generated by configure.sh surface: gateway gateway: ${GATEWAY} admin_token: ${ADMIN_TOKEN} format: table EOF fi chmod 600 "$CONFIG_FILE" ``` ### Technical Analysis Both the cloud session token and self-hosted administrative token are collected with ordinary `read -p`. Because silent input is not enabled, the secrets are visibly echoed to the terminal while entered. They may therefore be exposed to nearby observers, terminal recording software, remote-session logging, or screen-sharing systems. The script writes the credential-bearing configuration file before applying `chmod 600`. The initial permissions are determined by the current process umask. Under a permissive umask, a newly created file may initially be readable by other local users until the later `chmod` completes. If an existing configuration file has broader permissions, those permissions remain in effect during truncation and rewriting until the final permission change. The script also writes directly to the final path rather than constructing a restricted temporary file and atomically renaming it. Interruption between the write and `chmod` can leave the credential file with unintended permissions. ### Attack Path 1. A user runs `scripts/configure. ...[truncated 1443 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Read credentials without terminal echo and preserve input literally: ```bash read -r -s -p " Session token: " SESSION_TOKEN printf '\n' ``` Apply the same pattern to `ADMIN_TOKEN`. 2. Set a restrictive umask before creating the configuration directory or any credential-bearing file: ```bash umask 077 mkdir -p -- "$CONFIG_DIR" ``` 3. Create a temporary file inside the configuration directory, explicitly set mode `600`, write the complete configuration, and atomically rename it to the final path only after a successful write. 4. Ensure the configuration directory itself is accessible only by its owner, normally mode `700`. 5. Validate and safely serialize user-provided values as YAML rather than interpolating unrestricted input into a here-document. 6. Add cleanup traps that remove temporary files and unset credential variables on errors or interruption. 7. Consider using an operating-system credential store or keychain instead of retaining long-lived administrative credentials in a plaintext configuration file. 8. Warn users that any existing exposed token should be rotated after correcting file permissions or suspected terminal disclosure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a management tool for administering an API's economic firewall, including operational actions like minting tokens, tracking spend, revoking agents, and enforcing budgets. The supplied code chunk does none of those things. It is a health-check shell script whose purpose is to validate that the satgate binary exists, print its version, inspect a local config file, and test connectivity to the gateway with `satgate ping` and `satgate status`. While such a script could be a supporting utility within the same project, this specific chunk's primary purpose is materially different from the declared functionality, so the description does not accurately represent the actual behavior shown.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes the functional purpose of a CLI for managing an API gateway/economic firewall. However, the supplied code chunk does not implement token minting, spend tracking, revocation, budgeting, or any firewall-management operations. Its primary purpose is installation/bootstrap: fetching a platform-specific binary from GitHub, downloading checksum metadata, verifying integrity when possible, moving the binary into an install directory, and invoking its version command. While this installer may support obtaining the described CLI, the code itself materially differs from the declared purpose and introduces undeclared capabilities related to network download and system installation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell-driven operational actions but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, undeclared shell capability increases the chance of overbroad command execution and makes it harder for operators to enforce least privilege for token minting, revocation, and gateway administration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script interactively collects a session token or admin token and writes it in plaintext to ~/.satgate/config.yaml without any explicit warning to the user that credentials will be stored locally. Although file permissions are tightened afterward, local plaintext storage still increases exposure through backups, accidental disclosure, terminal/user profile access, or other local compromise, especially because these appear to be high-privilege gateway credentials.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi

chmod 600 "$CONFIG_FILE"

echo ""
echo "✓ Config written to ${CONFIG_FILE}"

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
else
  echo "  Installing to ${INSTALL_DIR} (requires sudo)..."
  sudo mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
fi

echo ""

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.