Find Service Providers

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its service-provider search purpose, but its documented shell wrapper can execute arbitrary code from a local .env.local file.

Install only if you are comfortable reviewing or changing the auth instructions. Prefer the ServiceGraph MCP/OAuth path or an already-exported SERVICEGRAPH_API_KEY, and avoid using the documented .env.local sourcing pattern in untrusted project directories.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:79

Finding

Arbitrary Command Execution Through Unsafe Dotenv Sourcing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79–81
Vulnerability Type: Unsafe shell execution of a dotenv file
Risk Level: High

Vulnerable Code:

bash

( set -a; [ -f .env.local ] && . ./.env.local; set +a;
  curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
       'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

Technical Analysis

The Skill instructs the agent to dot-source .env.local into a shell before making an authenticated API request. Dot-sourcing does not parse the file as a passive collection of environment-variable assignments; it executes the file as shell code.

Consequently, any command substitution, function invocation, redirection, or ordinary shell command in .env.local executes with the privileges of the user running the agent. This exceeds the minimum privileges required for the declared functionality, which only needs access to the SERVICEGRAPH_API_KEY value.

The use of a subshell limits persistence of exported environment variables, but it does not restrict filesystem access, network access, process execution, or other side effects produced by malicious commands. It also conflicts with the Skill's stated security objective of handling the token without reading or executing unrelated credential-file content.

Sending SERVICEGRAPH_API_KEY in the Authorization header to the declared https://api.servicegraph.co endpoint is necessary for the advertised functionality and is not, by itself, an unrelated exfiltration path. The vulnerability is the execution of arbitrary dotenv contents before that request.

Attack Path

1. An attacker, compromised project, or untrusted repository places shell syntax in .env.local.
2. The user asks the agent to invoke the ServiceGraph functionality.
3. Following the Skill's first-call instructions, the agent launches the documented shell wrapper.
4. The wrapper executes . ./.env.local.
5. The ...[truncated 1258 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use source, ., or shell evaluation to load dotenv files.
• Prefer requiring SERVICEGRAPH_API_KEY to be exported by the user's environment or supplied through the OAuth-backed ServiceGraph MCP integration.
• If .env.local support is necessary, use a dedicated dotenv parser that treats all file content as data and retrieves only the exact SERVICEGRAPH_API_KEY field.
• Reject duplicate keys, malformed lines, command substitutions, shell metacharacters, embedded newlines, and unexpected variable names.
• Validate the extracted credential against the expected token format, such as a strict vk_ prefix and an appropriately constrained character set and length.
• Pass the validated value directly to the HTTP client without invoking eval or constructing a shell command dynamically.
• Restrict credential-file permissions and avoid loading unrelated secrets from a shared dotenv file.
• Prefer an execution interface that passes arguments as an array rather than through a shell.
• Retain the existing instruction not to paste credentials into chat, and avoid logging request headers or token values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Sourcing .env.local is a credential-access behavior: it allows the skill-driven command to read local secret files and import their contents into the process environment. In a security review, this is high risk because .env files often contain multiple unrelated credentials, and a skill for searching service providers has no strong justification to gain file-based secret access.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

if present:

bash

( set -a; [ -f .env.local ] && . ./.env.local; set +a;
  curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
       'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill claims the token must never enter the LLM context, yet it instructs the user to place the key in .env.local and has the agent source that file during execution. This is a security-design contradiction: the model is being told to interact with a local secret source, which weakens separation between untrusted skill logic and credential handling and can lead to accidental exposure through shell errors, debugging, or future prompt/tool changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to source .env.local before making API calls, which grants the skill access to local credential material unrelated to its core firm-search function. Even if the stated goal is to keep the token out of the LLM context, this expands the skill's authority to read local secrets and creates risk if the execution environment or wrapper behavior changes, logs commands, or if the sourced file contains additional secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

2. On 401 unauthorized, prompt the user (don't accept the key

Static analysis

No suspicious patterns detected.