Security audit

a2a-context

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Prismer Cloud integration, but it asks users to expose live credentials in chat and command arguments and installs a mutable global npm package.

Review before installing. Use the skill only if you are comfortable sending selected files, documents, web requests, and messages to Prismer Cloud. Do not paste API keys, JWTs, webhook secrets, or bot tokens into chat; prefer a secure local login, environment variable, secret manager, or interactive prompt. Avoid global unpinned installs where possible, and protect or rotate any credentials stored under `~/.prismer`.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: Skill.md:23
Finding: Credentials Are Exposed Through Chat and Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `Skill.md:23-32` **Additional Locations**: `Skill.md:193`, `Skill.md:356-364` **Vulnerability Type**: Sensitive credential exposure through chat, process arguments, shell history, and plaintext configuration **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 2: Get API Key (ask the user) An API key is required for meaningful usage (1,100 credits vs 100 anonymous). API keys are bound to a human account — **you cannot create one yourself**. Ask the user: > I need a Prismer Cloud API key to use context/parse/IM services. Please visit https://prismer.cloud, sign up (GitHub/Google one-click), then go to **Dashboard → API Keys → Create** and share the key with me. It looks like `sk-prismer-...`. If the user provides a key, bind it: ```bash prismer init <the-api-key-from-user> ``` ``` The same unsafe command-line pattern is used for a Telegram bot token: ```bash prismer im bindings create telegram --bot-token xxx --chat-id yyy ``` The Skill also documents persistent plaintext credential storage: ```toml [default] api_key = "sk-prismer-xxx" # optional, for bound registration [auth] im_token = "eyJ..." # IM JWT im_user_id = "pxoi9cas5rz" # IM User ID im_username = "my-agent" # Username ``` ### Technical Analysis The Skill explicitly asks the user to share a Prismer Cloud API key with the Agent. This places the secret in the conversation context and potentially in conversation history, execution traces, observability systems, debugging logs, or third-party model-provider records. It then directs the Agent to insert the key into a command-line argument. Command-line secrets can be exposed through: - Shell history files. - Process inspection utilities and `/proc` interfaces. - Agent tool-call and command-execution logs. - Terminal session recording. - Error reports or debugging telemetry. The Telegram binding command has the same issue because `--bot-tok ...[truncated 2212 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys, JWTs, webhook secrets, or bot tokens into chat. 2. Accept secrets through a protected interactive prompt that disables terminal echo, standard input, an OS credential manager, or a documented environment variable. 3. Avoid placing secrets in command-line arguments. For example, support an interactive `prismer init` flow or a `--token-stdin` option. 4. Ensure the CLI redacts credentials from command output, exceptions, telemetry, and debug logs. 5. Store persistent credentials in the operating system's credential store where possible. 6. If file-based storage is unavoidable, create `~/.prismer/config.toml` with owner-only permissions such as mode `0600`, reject insecure ownership or permissions, and avoid storing unnecessary long-lived tokens. 7. Use short-lived, narrowly scoped tokens instead of account-wide reusable credentials. 8. Document credential rotation, expiration, and revocation procedures. 9. Require explicit user approval before transmitting files, messages, or other sensitive content to Prismer Cloud. 10. Provide equivalent secure handling for Telegram bot tokens and webhook secrets. ]]>

T08 · Insecure Dependencies

Warning

Location: Skill.md:15
Finding: Unpinned npm Package Is Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `Skill.md:15-20` **Vulnerability Type**: Unpinned global third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 1: Install CLI Check if the CLI is already installed: ```bash prismer --version ``` If the command is not found, install it now: ```bash npm install -g @prismer/sdk ``` ``` ### Technical Analysis The Skill instructs the Agent to install the latest available version of `@prismer/sdk` globally. No exact version, lockfile, package integrity hash, verified artifact, or isolated execution environment is specified. Because the package version is not pinned, the code installed during a future Skill execution can differ from the code available when the Skill was audited. npm packages and their transitive dependencies may also execute lifecycle scripts during installation. A compromised package release, maintainer account, registry entry, or transitive dependency could therefore execute attacker-controlled code with the privileges of the user running npm. The `-g` option increases the scope of the installation by modifying the user's global npm environment rather than creating a project-local, isolated dependency. Although installing the SDK is relevant to the declared functionality, global mutable installation is broader than the minimum privilege necessary. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a transitive dependency of `@prismer/sdk`. 2. The attacker publishes a malicious version or introduces a malicious installation lifecycle script. 3. A user or Agent follows the Skill after the compromised version becomes the registry's default release. 4. `npm install -g @prismer/sdk` resolves and downloads the mutable release. 5. npm executes applicable installation scripts with the invoking user's privileges. 6. The malicious package reads accessible files or credentials, alters global executables, ...[truncated 790 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, for example `@prismer/sdk@<audited-version>`. 2. Publish and verify package integrity hashes or signed release artifacts. 3. Provide a lockfile for any project-local installation and review transitive dependency changes. 4. Prefer a local installation, isolated virtual environment, container, or other sandbox instead of `npm install -g`. 5. Avoid administrator or root privileges during installation. 6. Disable npm lifecycle scripts where compatible, or separately audit every required lifecycle script. 7. Document the expected package publisher, registry, package signature, and checksum verification process. 8. Run vulnerability and provenance checks before updating the pinned version. 9. Require explicit user approval before installing or upgrading system-level tools. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to ask the user to paste a live API key into chat, which is insecure because chat transcripts, logs, memory, or downstream tooling may retain the secret. In this context, the key grants access to external services and credits, so exposure could enable unauthorized API use or account abuse.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The skill operationalizes insecure secret handling by directing the agent to collect a live API key from the user in chat and immediately bind it for service use. That creates a direct pathway for credential disclosure through model context, logs, prompt history, telemetry, or accidental reuse in later outputs.

External Transmission

Medium

Category: Data Exfiltration
Content: prismer files presign report.pdf --mime application/pdf # 2. Upload to returned URL curl -X PUT "$PRESIGNED_URL" -H "Content-Type: application/pdf" --data-binary @report.pdf # 3. Confirm prismer files confirm <upload-id>
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The configuration example shows long-lived authentication material stored in a local plaintext-style config file, including an API key and IM JWT, without any warning about filesystem exposure. This can lead to credential theft from shared machines, backups, dotfile sync, logs, or malware if users assume this storage pattern is safe by default.

Static analysis

No suspicious patterns detected.