Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local secret-management guide that handles sensitive credentials but keeps that behavior purpose-aligned and user-controlled.
Install only if you want this agent to manage local encrypted secrets. Review the hal-vault binary source/provenance before installing it, keep vault files out of version control, protect the SSH key, and expect secrets to be revealed only when feeding a command you asked to run.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
hal-vault get github-pat --reveal
| sed 's/^/Authorization: Bearer /'
| curl -H @- https://api.github.com/user
The safety contract's rule 2 said to use `--reveal` "inside command
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
hal-vault get github-pat --reveal
| sed 's/^/Authorization: Bearer /'
| curl -H @- https://api.github.com/user
`ps -A -o args=` while both were in flight:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
hal-vault get github-pat --reveal
| sed 's/^/Authorization: Bearer /'
| curl -H @- https://api.github.com/user
`ps -A -o args=` while both were in flight:
Referenced artifact was not completely inspected
[references/cli-reference.md](references/cli-reference.md).
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# before (1.1.0), still works, now discouraged
curl -H "Authorization: Bearer $(hal-vault get github-pat --reveal)" https://api.github.com/user
# after (1.2.0)
hal-vault get github-pat --reveal \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# before (1.1.0), still works, now discouraged
curl -H "Authorization: Bearer $(hal-vault get github-pat --reveal)" https://api.github.com/user
# after (1.2.0)
hal-vault get github-pat --reveal \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# before (1.1.0), still works, now discouraged
curl -H "Authorization: Bearer $(hal-vault get github-pat --reveal)" https://api.github.com/user
# after (1.2.0)
hal-vault get github-pat --reveal \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# before (1.1.0), still works, now discouraged
curl -H "Authorization: Bearer $(hal-vault get github-pat --reveal)" https://api.github.com/user
# after (1.2.0)
hal-vault get github-pat --reveal \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# before (1.1.0), still works, now discouraged
curl -H "Authorization: Bearer $(hal-vault get github-pat --reveal)" https://api.github.com/user
# after (1.2.0)
hal-vault get github-pat --reveal \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# before (1.1.0), still works, now discouraged
curl -H "Authorization: Bearer $(hal-vault get github-pat --reveal)" https://api.github.com/user
# after (1.2.0)
hal-vault get github-pat --reveal \
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
name: hal-vault
description: Securely store, search, and use secrets (API keys, tokens, passwords, SSH keys) with hal-vault, an SSH-key encrypted local secret store. Use when the user shares a credential that should be saved, asks what secrets are stored or where a key is, or when a command/workflow needs a secret injected. Core discipline - never print raw secret values into chat, logs, or files; reference secrets only by their masked form, and use --reveal only to feed another process, never into a command argument (where it lands in the machine's process table) or into text you write down.
license: MIT
version: "1.2.0"
homepage: https://github.com/ofoxai/skills/tree/main/skills/hal-vault
Detected: suspicious.exposed_secret_literal