Find Recruiting Firm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.0

Overview

The skill’s ServiceGraph recruiting-firm lookup purpose is coherent, but its REST authentication instructions tell the agent to source a local .env.local file as shell code, which is an avoidable high-impact risk.

Review before installing. Prefer the MCP/OAuth path described by the skill, or provide SERVICEGRAPH_API_KEY through a trusted secret manager or pre-set environment variable. Avoid running the documented .env.local sourcing snippet unless you fully trust the workspace file contents, and confirm credit costs before any unlock operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:72

Finding

Unsafe Shell Execution of .env.local

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72–77
Vulnerability Type: Unsafe execution of a configuration file as shell code
Risk Level: High

Vulnerable Code

bash

1. **Try the call first** through a shell wrapper that sources `.env.local`:

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

Technical Analysis

The documented authentication procedure dot-sources .env.local using . ./.env.local. Dot-sourcing does not treat the file as a passive dotenv configuration file; it interprets its entire contents as shell commands in the current shell process.

Consequently, an attacker who can create or modify .env.local can insert command substitutions, shell functions, redirections, pipelines, or arbitrary commands. Those instructions execute with the same operating-system identity and permissions as the agent or user following the Skill.

The use of set -a further causes all subsequently assigned shell variables to be exported to child processes. This exceeds the minimum privilege required to make the API request, which needs only SERVICEGRAPH_API_KEY.

Sending SERVICEGRAPH_API_KEY as an HTTPS bearer token to the declared api.servicegraph.co endpoint is consistent with the Skill's stated authenticated API functionality. The vulnerability is not the necessary API transmission itself, but the avoidable execution of an environment file before that request.

Attack Path

1. An attacker gains the ability to supply or modify .env.local in the working directory, such as through a compromised repository, archive, setup process, or another local process.
2. The attacker adds shell syntax to the file, for example a command substitution or a separate command that reads credentials, modifies files, or performs an outbound request.

...[truncated 1275 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to source .env.local as shell code.

2. Prefer supplying SERVICEGRAPH_API_KEY through the agent harness's secret manager or an already-populated process environment.

3. Verify that the required variable exists without evaluating a file:

   bash

   : "${SERVICEGRAPH_API_KEY:?SERVICEGRAPH_API_KEY is not set}"
   curl --fail-with-body --silent --show-error \
     -H "Authorization: Bearer ${SERVICEGRAPH_API_KEY}" \
     'https://api.servicegraph.co/v1/datasets/pro_services/fields'
   

4. If dotenv-file support is unavoidable, use a dedicated dotenv parser that:

   • Reads only the exact SERVICEGRAPH_API_KEY field.
   • Does not evaluate shell syntax, substitutions, or commands.
   • Rejects duplicate, malformed, or unexpected entries.
   • Does not export unrelated configuration values.

5. Run the API client in a restricted environment with minimal filesystem access, a minimal inherited environment, and network egress limited to https://api.servicegraph.co.

6. Keep the existing guidance not to paste or expose the API key in the model context, logs, command tracing, or error output.

7. Require explicit user confirmation before credit-consuming unlock operations, preserving the documented disclosure of the number of credits to be charged.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill explicitly tells the agent to source .env.local in a shell before making API calls. Reading local environment files is sensitive because it grants the skill access to secrets stored alongside the workspace, and a compromised or overly broad execution context could expose more than just the intended API key. The surrounding text says to keep the token out of LLM context, which lowers suspicion of malicious intent, but the mechanism still constitutes credential access and is dangerous in agent environments.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

1. Try the call first through a shell wrapper that sources .env.local:

   bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill instructs the agent to send authenticated requests to an external third-party API using a bearer token. Even though the destination is the intended ServiceGraph service, this is still external data transmission and could expose user queries, firm selections, and account-linked usage metadata outside the local environment. The skill context makes this somewhat expected, but the use of a live remote API with authorization still creates a real data-exfiltration surface if invoked on sensitive inputs.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

2. On 401 prompt the user:

Static analysis

No suspicious patterns detected.