Find Design Agency

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent ServiceGraph agency-search helper, but its fallback auth example unsafely executes `.env.local` as shell code while handling an API key.

Install only if you are comfortable using ServiceGraph and handling a local API key. Prefer the MCP/OAuth path or export only `SERVICEGRAPH_API_KEY` through a trusted secret mechanism; do not let the agent source arbitrary `.env.local` files from untrusted projects.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:77

Finding

Arbitrary Shell Command Execution Through Unsafe .env.local Sourcing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:77-81
Vulnerability Type: Unsafe shell execution of a configuration file
Risk Level: High

bash

1. **Try the call first** through a shell wrapper that sources `.env.local`:

   ```bash
   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   ```

Technical Analysis

The documented authentication procedure uses the POSIX . command to source .env.local. This treats the file as executable shell code rather than as a passive key-value configuration file. Consequently, shell commands, command substitutions, functions, expansions, redirections, and other shell syntax in .env.local execute with the privileges of the user running the Skill.

This behavior exceeds the minimum privilege required for the declared functionality. The Skill only needs to retrieve SERVICEGRAPH_API_KEY and pass it to the declared ServiceGraph HTTPS endpoint. Executing all contents of a workspace-controlled configuration file is unnecessary.

The surrounding set -a also causes every subsequently assigned shell variable to be exported. This unnecessarily broadens the environment inherited by curl, rather than limiting it to the one credential required for authentication.

The static pre-scan's sensitive network transmission is otherwise consistent with the Skill's declared purpose: the bearer token is sent in an Authorization header to https://api.servicegraph.co, its declared API provider. The reviewed instructions do not direct the token or the contents of .env.local to any unrelated endpoint.

Attack Path

1. An attacker gains the ability to create or modify .env.local in the workspace, such as through a malicious repository, compromised project archive, or prior workspace modification.
2. The attacker inserts shell syn ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not execute .env.local with source or the POSIX . command.
2. Prefer requiring SERVICEGRAPH_API_KEY to be injected by the execution harness or exported by the user before the Skill runs.
3. If dotenv-file support is necessary, use a strict parser that:
   • Reads only the SERVICEGRAPH_API_KEY entry.
   • Treats the file as data rather than shell code.
   • Rejects duplicate keys, command substitutions, expansions, redirections, and unsupported syntax.
   • Validates the expected vk_ credential format.
4. Pass only the required credential to the HTTP client instead of using set -a.
5. Preserve the existing guidance not to paste the key into chat, model context, command output, or logs.
6. Use a hardened wrapper outside the model-generated shell command where possible, with a fixed destination host and TLS verification enabled.
7. Replace the vulnerable example with a pattern equivalent to:

   bash

   test -n "$SERVICEGRAPH_API_KEY" || {
     printf '%s\n' 'SERVICEGRAPH_API_KEY is not set' >&2
     exit 1
   }
   
   curl --fail-with-body --silent --show-error \
     -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
     'https://api.servicegraph.co/v1/datasets/pro_services/fields'
   

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill directs the agent to source .env.local in a shell before making the API call. Even though it says not to read secrets into LLM context, instructing an agent to source a local env file creates a credential-access pathway and broadens secret exposure to shell execution, child processes, command history, debugging output, or prompt/tool leakage if the harness is misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

1. Try the call first through a shell wrapper that sources .env.local:

   bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

2. On 401 prompt the user:

Static analysis

No suspicious patterns detected.