GoLive

• Outcome: Pass
• Latest audit: Oct 11, 2026 · 7:46 PM UTC
• Version: 0.1.0-alpha.9

Overview

This is a powerful but coherent deployment skill that clearly discloses its cloud-account access, credential handling, approval gates, and local state use.

Install only if you want an agent to help deploy to real provider accounts. Review each plan carefully, use scoped/short-lived provider credentials where possible, do not paste secrets into chat, and pay special attention before approving live, DNS, or destroy confirmations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (62)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md

For Supabase, distinguish token **capabilities** from **resource scope**: "Full access" to one
project cannot create another project or manage its organization. A `/profile` 403 can mean a
project-scoped token, not an invalid key. Explain the required scope; don't blindly ask for another
Full access token. A passing account check doesn't prove every later endpoint permission.

### 4. Plan: `plan --json`
Explain the steps by provider, in plain language, and call out:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8214)May include surrounding context.

js

For Supabase, distinguish token **capabilities** from **resource scope**: "Full access" to one
project cannot create another project or manage its organization. A `/profile` 403 can mean a
project-scoped token, not an invalid key. Explain the required scope; don't blindly ask for another
Full access token. A passing account check doesn't prove every later endpoint permission.

### 4. Plan: `plan --json`
Explain the steps by provider, in plain language, and call out:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 13900)May include surrounding context.

js

For Supabase, distinguish token **capabilities** from **resource scope**: "Full access" to one
project cannot create another project or manage its organization. A `/profile` 403 can mean a
project-scoped token, not an invalid key. Explain the required scope; don't blindly ask for another
Full access token. A passing account check doesn't prove every later endpoint permission.

### 4. Plan: `plan --json`
Explain the steps by provider, in plain language, and call out:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 17720)May include surrounding context.

js

For Supabase, distinguish token **capabilities** from **resource scope**: "Full access" to one
project cannot create another project or manage its organization. A `/profile` 403 can mean a
project-scoped token, not an invalid key. Explain the required scope; don't blindly ask for another
Full access token. A passing account check doesn't prove every later endpoint permission.

### 4. Plan: `plan --json`
Explain the steps by provider, in plain language, and call out:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 21219)May include surrounding context.

js

For Supabase, distinguish token **capabilities** from **resource scope**: "Full access" to one
project cannot create another project or manage its organization. A `/profile` 403 can mean a
project-scoped token, not an invalid key. Explain the required scope; don't blindly ask for another
Full access token. A passing account check doesn't prove every later endpoint permission.

### 4. Plan: `plan --json`
Explain the steps by provider, in plain language, and call out:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/godaddy.md (reported line 5)May include surrounding context.

md

Automated DNS-record adapter with two transports — same endpoints and safety rules either way: the
official GoDaddy CLI (`gddy`, the default when installed and logged in) and a scoped REST Personal
Access Token (the fallback). The Vercel-attached custom-domain journey passed disposable live runs
on both transports: the CLI path created both records through `gddy api call` with the user's OAuth
session, and the v3 update-by-ID (PUT) endpoint was separately validated through that same session.
golive's owned-record update flows (SPF merge, singleton replace, TTL drift) and the REST

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/godaddy.md (reported line 25)May include surrounding context.

md

Automated DNS-record adapter with two transports — same endpoints and safety rules either way: the
official GoDaddy CLI (`gddy`, the default when installed and logged in) and a scoped REST Personal
Access Token (the fallback). The Vercel-attached custom-domain journey passed disposable live runs
on both transports: the CLI path created both records through `gddy api call` with the user's OAuth
session, and the v3 update-by-ID (PUT) endpoint was separately validated through that same session.
golive's owned-record update flows (SPF merge, singleton replace, TTL drift) and the REST

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/sentry.md (reported line 12)May include surrounding context.

md

/api/0/organizations/{org}/teams/` (`team:read`), `GET /api/0/organizations/{org}/projects/` and
`GET /api/0/projects/{org}/{project}/` (`project:read`), `GET
/api/0/projects/{org}/{project}/keys/` for the DSN (`project:read`), `POST
/api/0/teams/{org}/{team}/projects/` to create (`project:write`), `DELETE
/api/0/projects/{org}/{project}/` to delete (`project:admin`, asynchronous), `GET
/api/0/projects/{org}/{project}/events/{event_id}/` to read one event back (`event:read`), and the
DSN Store endpoint `POST https://<dsn host>/api/<project id>/store/` with the `X-Sentry-Auth` header

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/updates.md (reported line 61)May include surrounding context.

md

Compatible state keeps resource IDs, fingerprints and evidence. Identical completed operations
remain completed. Changed, failed or ambiguous historical writes may require reconciliation;
do not delete state or force replays to get past that guard. Two exemptions resume by themselves,
because the step declares it: teardown's destruction steps (a deletion re-checks ownership and is
idempotent) and any step whose risk declares `risk.replayable` (an idempotent write that re-observes
the provider and golive's own recorded resource before acting, e.g. the auth test account's password

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/golive.mjs (reported line 13647)May include surrounding context.

js

Compatible state keeps resource IDs, fingerprints and evidence. Identical completed operations
remain completed. Changed, failed or ambiguous historical writes may require reconciliation;
do not delete state or force replays to get past that guard. Two exemptions resume by themselves,
because the step declares it: teardown's destruction steps (a deletion re-checks ownership and is
idempotent) and any step whose risk declares `risk.replayable` (an idempotent write that re-observes
the provider and golive's own recorded resource before acting, e.g. the auth test account's password

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/vercel.md (reported line 52)May include surrounding context.

md

golive deployed instead of "no platform" (issue #66). Keep `.vercel/` out of git; `.golive/state.json`
  remains golive's own record.
- **Keeps its own files out of the upload.** `vercel deploy` uploads this folder and serves what it
  uploaded, and its ignore filter reads **only** `.vercelignore`/`.nowignore` — never `.gitignore`.
  Before a deploy on an unframed app golive therefore plans `upload:excludes`: it appends a marked
  block to `.vercelignore` (created when absent, your rules above untouched) for `.golive/`,
  `golive.yaml`, `GOLIVE_REPORT.md`, `GOLIVE_HANDOVER.md`, `SHIP_REPORT.md` and `docs/GOLIVE-*`, and

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill is designed to reuse Supabase CLI credentials by reading stored tokens from local files and macOS Keychain entries, then converting them into reusable API bearer tokens. In a deployment skill with broad cloud-provider write capabilities, credential harvesting from other tools increases the blast radius: a compromised or misused agent can perform management-plane actions without requiring the human to re-enter or explicitly scope fresh credentials for this run.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8036)May include surrounding context.

js

if (fd !== void 0) closeSync5(fd);
  }
}
function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8039)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8076)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8079)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8089)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8039)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8040)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8074)May include surrounding context.

js

function credential(value, keychain = false) {
  const captured = new Secret("supabase-cli-stored", value || "(empty)");
  let raw2 = captured.reveal().trim();
  if (keychain && raw2.startsWith("go-keyring-base64:")) {
    const encoded = raw2.slice("go-keyring-base64:".length);
    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw failure("Supabase CLI stored credential is malformed.");
    raw2 = Buffer.from(encoded, "base64").toString("utf8");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This code directly accesses macOS Keychain and other local credential stores to retrieve Supabase CLI secrets for later management API use. In the context of a tool that can create projects, alter auth settings, wire secrets, and modify production infrastructure, silently broadening trust from 'logged into another CLI' to 'authorized for this automation' is dangerous because it bypasses a fresh consent boundary and may surprise users about what identities the agent can wield.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8065)May include surrounding context.

js

if (!isAbsolute3(root)) throw failure("SUPABASE_HOME must be an absolute path for safe credential reuse.");
  const profile = ctx.env("SUPABASE_PROFILE") || storedFile(join8(root, "profile"), false)?.trim() || "supabase";
  if (profile.toLowerCase() !== "supabase") throw failure("The selected Supabase CLI profile is not the supported production supabase profile; golive will not use another profile or API.");
  const noKeyring = ctx.env("SUPABASE_NO_KEYRING") === "1";
  const wsl = options.wsl ?? (platform2 === "linux" && (() => {
    try {
      return /WSL|Microsoft/.test(readFileSync7("/proc/sys/kernel/osrelease", "utf8"));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This code directly accesses macOS Keychain and other local credential stores to retrieve Supabase CLI secrets for later management API use. In the context of a tool that can create projects, alter auth settings, wire secrets, and modify production infrastructure, silently broadening trust from 'logged into another CLI' to 'authorized for this automation' is dangerous because it bypasses a fresh consent boundary and may surprise users about what identities the agent can wield.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8065)May include surrounding context.

js

if (!isAbsolute3(root)) throw failure("SUPABASE_HOME must be an absolute path for safe credential reuse.");
  const profile = ctx.env("SUPABASE_PROFILE") || storedFile(join8(root, "profile"), false)?.trim() || "supabase";
  if (profile.toLowerCase() !== "supabase") throw failure("The selected Supabase CLI profile is not the supported production supabase profile; golive will not use another profile or API.");
  const noKeyring = ctx.env("SUPABASE_NO_KEYRING") === "1";
  const wsl = options.wsl ?? (platform2 === "linux" && (() => {
    try {
      return /WSL|Microsoft/.test(readFileSync7("/proc/sys/kernel/osrelease", "utf8"));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8073)May include surrounding context.

js

return false;
    }
  })());
  if (!noKeyring && !wsl) {
    if (platform2 !== "darwin") throw failure("This OS keyring cannot be safely reused by golive. On Linux, run `SUPABASE_NO_KEYRING=1 supabase login --profile supabase` and run golive with SUPABASE_NO_KEYRING=1 to use the CLI private file.");
    for (const account2 of ["supabase", "access-token"]) {
      let answer = await keychainRead(ctx, account2, KEYCHAIN_TIMEOUT_MS);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8074)May include surrounding context.

js

}
  })());
  if (!noKeyring && !wsl) {
    if (platform2 !== "darwin") throw failure("This OS keyring cannot be safely reused by golive. On Linux, run `SUPABASE_NO_KEYRING=1 supabase login --profile supabase` and run golive with SUPABASE_NO_KEYRING=1 to use the CLI private file.");
    for (const account2 of ["supabase", "access-token"]) {
      let answer = await keychainRead(ctx, account2, KEYCHAIN_TIMEOUT_MS);
      if (answer.kind === "timeout") {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8076)May include surrounding context.

js

if (!noKeyring && !wsl) {
    if (platform2 !== "darwin") throw failure("This OS keyring cannot be safely reused by golive. On Linux, run `SUPABASE_NO_KEYRING=1 supabase login --profile supabase` and run golive with SUPABASE_NO_KEYRING=1 to use the CLI private file.");
    for (const account2 of ["supabase", "access-token"]) {
      let answer = await keychainRead(ctx, account2, KEYCHAIN_TIMEOUT_MS);
      if (answer.kind === "timeout") {
        ctx.log.warn(`macOS is asking whether golive may read the Supabase CLI Keychain item (read-only; golive never changes the Keychain). Click "Allow" in that dialog, or "Always Allow" to record the permission permanently for this item. Waiting ${KEYCHAIN_ATTENDED_TIMEOUT_MS / 1e3}s for the answer.`);
        answer = await keychainRead(ctx, account2, KEYCHAIN_ATTENDED_TIMEOUT_MS);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/golive.mjs (reported line 8078)May include surrounding context.

js

if (!noKeyring && !wsl) {
    if (platform2 !== "darwin") throw failure("This OS keyring cannot be safely reused by golive. On Linux, run `SUPABASE_NO_KEYRING=1 supabase login --profile supabase` and run golive with SUPABASE_NO_KEYRING=1 to use the CLI private file.");
    for (const account2 of ["supabase", "access-token"]) {
      let answer = await keychainRead(ctx, account2, KEYCHAIN_TIMEOUT_MS);
      if (answer.kind === "timeout") {
        ctx.log.warn(`macOS is asking whether golive may read the Supabase CLI Keychain item (read-only; golive never changes the Keychain). Click "Allow" in that dialog, or "Always Allow" to record the permission permanently for this item. Waiting ${KEYCHAIN_ATTENDED_TIMEOUT_MS / 1e3}s for the answer.`);
        answer = await keychainRead(ctx, account2, KEYCHAIN_ATTENDED_TIMEOUT_MS);