Find Cybersecurity Firm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stated purpose, but its fallback authentication instructions tell the agent to execute a local .env file as shell code, which is an avoidable local execution risk.

Review this skill before installing. Its ServiceGraph API behavior is disclosed and aligned with finding cybersecurity firms, but the fallback REST instructions should be changed to use a pre-exported SERVICEGRAPH_API_KEY or a strict dotenv parser instead of sourcing .env.local. Only approve paid unlocks after checking the listed credit cost and selected firms.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:74

Finding

Executable Credential File Is Sourced as Shell Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74–80
Vulnerability Type: Unsafe execution of local configuration
Risk Level: High

Vulnerable Code

bash

1. **Try the call first** through a shell wrapper that sources `.env.local`:

   ```bash
   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   ```

Technical Analysis

The documented authentication flow uses the POSIX shell . command to source .env.local. Sourcing does not treat the file as inert key-value configuration; it parses and executes its contents as shell code.

As a result, any command substitution, redirection, function invocation, or ordinary shell command contained in .env.local runs with the privileges of the account executing the Skill. This behavior is not required to obtain SERVICEGRAPH_API_KEY and violates least-privilege principles.

The subshell limits changes to shell state, but it does not prevent filesystem access, network access, credential theft, process execution, or other side effects. The API request itself sends the bearer key only to the declared HTTPS service and is consistent with the Skill's functionality; the vulnerability is the execution of the entire local credential file.

Attack Path

1. An attacker, compromised setup process, or untrusted project places executable shell syntax in .env.local.
2. A user invokes the Skill for a cybersecurity-firm search.
3. The Agent follows the documented REST authentication procedure.
4. The shell evaluates . ./.env.local.
5. The attacker's commands execute before curl sends the legitimate API request.
6. Those commands can access resources available to the Agent's operating-system account and may conceal themselves by allowing the expected API call to continue.

For example, a malicious `.env. ...[truncated 894 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to source .env.local.
2. Prefer an API credential pre-exported by the execution harness or supplied through its secret-management facility:

   bash

   : "${SERVICEGRAPH_API_KEY:?SERVICEGRAPH_API_KEY is not configured}"
   curl -sS \
     -H "Authorization: Bearer ${SERVICEGRAPH_API_KEY}" \
     'https://api.servicegraph.co/v1/datasets/pro_services/fields'
   

3. If dotenv-file support is mandatory, use a strict dotenv parser that reads only the exact SERVICEGRAPH_API_KEY entry without shell evaluation. Reject duplicate keys, malformed assignments, command substitutions, and unexpected fields.
4. Ensure the credential file is excluded from version control and readable only by the owning user, such as with mode 0600.
5. Continue preventing the token from entering model context, command tracing, logs, process diagnostics, and error output.
6. Run network tooling in a constrained environment with only the filesystem and network permissions needed for the declared API operation.
7. Add a security test containing shell metacharacters in a mock dotenv file and verify that no command or substitution is executed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill tells the agent to source .env.local in a shell subshell, which is a credential-access pattern because it encourages reading local secret material during skill execution. Although it cautions not to paste the token into chat, the act of sourcing a local env file broadens the trust boundary: a compromised or overly capable skill/harness could access unrelated environment variables, and shell-based execution increases the risk of secret leakage through command inspection, debugging, or accidental output.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

1. Try the call first through a shell wrapper that sources .env.local:

   bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The skill explicitly instructs the agent to send authenticated requests to an external third-party API using a bearer token. Even though the business purpose requires outbound API access, this still creates a real data-exposure boundary: user queries, selected firm domains, and potentially account-linked usage metadata are transmitted off-platform to api.servicegraph.co. In skill context this is expected behavior, but it remains security-relevant because it enables exfiltration of user-supplied inputs and authenticated access to an external service.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

2. On 401 prompt the user:

Static analysis

No suspicious patterns detected.