Codai

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:00 AM UTC
• Version: 1.0.1

Overview

This skill appears to be a legitimate local development-environment orchestrator, but it needs review because broad triggers and a weak documented database root password could cause unsafe or unintended local infrastructure actions.

Review and narrow the triggers before installing, especially the bare `codai` trigger and generic `start` phrases. Do not use the documented MySQL root password default; require a unique secret and keep the database bound to trusted local or Docker networks. Treat worktree removal, Redis flush, and database dump commands as destructive or high-impact operations that should require explicit user intent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:127

Finding

Hardcoded Weak Default MySQL Root Password

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 127
Vulnerability Type: Hardcoded privileged database credential
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| `MYSQL_ROOT_PASS` | `secret`            | mysql-manager, worktree-manager    |

Technical Analysis

The skill documentation defines secret as the default value of MYSQL_ROOT_PASS. This is a predictable, publicly documented credential for the privileged MySQL root account. If the referenced manager scripts use this default without requiring an override, any party able to reach the MySQL service can attempt authentication with a known password.

The actual manager scripts are not included in the audited package, so use of this value at runtime and external service exposure cannot be independently verified. Nevertheless, publishing a fixed weak default for a privileged account creates an unsafe configuration that may be deployed unchanged.

Attack Path

1. A user starts MySQL through the documented manager workflow without overriding MYSQL_ROOT_PASS.
2. The manager configures the MySQL root account with the documented default value, secret.
3. An attacker obtains network access to the MySQL service, such as through an exposed port or access to the shared Docker network.
4. The attacker authenticates to MySQL using the root username and the known default password.
5. The attacker exercises database-administration capabilities over databases accessible to that account.

This path depends on the absent manager implementation honoring the documented default and on the attacker having network reachability to MySQL.

Impact Assessment

Successful exploitation could grant privileged MySQL access, potentially allowing the attacker to read, alter, create, or delete development databases and database accounts. The attacker could disclose sensitive development data, corrupt application state, or destroy the designated so ...[truncated 153 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the fixed default and require MYSQL_ROOT_PASS to be explicitly configured.
• Generate a cryptographically random, unique password during initial setup.
• Store the credential in a protected secret manager or a permissions-restricted environment file that is excluded from version control.
• Make startup fail securely when the variable is absent, empty, or equal to a known placeholder.
• Avoid passing the password through command-line arguments, where process listings may expose it.
• Restrict MySQL to the required internal Docker network and avoid publishing its port to untrusted interfaces.
• Prefer a dedicated, least-privileged application account instead of using the MySQL root account for routine operations.
• Rotate any environment still using the documented secret value and review database logs for unauthorized authentication.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill whenever the user asks to manage any part of the dev environment without specifying a plugin, which is an ambiguous routing condition that broadens activation well beyond precise intent. Because this skill orchestrates multiple operational plugins and documents destructive actions like dumps and worktree removal, ambiguous activation increases the chance of unintended command execution or unsafe delegation.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger "start mysql" begins with a generic built-in style verb and can conflict with broader command handling for "start", creating ambiguity about whether the user intended native command behavior or this skill. In this environment, accidental routing can start local database infrastructure and change system state, so the collision has meaningful operational impact.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger "start postgres" has the same shadowing problem as other generic "start" commands and may capture requests meant for built-in or other tooling flows. Since the skill can invoke local service-management scripts, a mistaken match can unnecessarily start infrastructure or alter environment state.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The trigger "start redis" is vulnerable to the same shadow-command ambiguity, where a generic verb-object phrase may be interpreted as this skill instead of another command path. Because successful activation performs real infrastructure actions, unintended matches could start services and mislead users about what component handled the request.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 91% confidence

Finding

The phrase "start environment" is especially broad and likely to overlap with other agent capabilities or ordinary user instructions, making accidental activation probable. In this skill, activation can cascade into multiple startup steps across proxy, database, and app instances, so ambiguity increases the blast radius of a misfire.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger "create worktree" shadows a generic built-in style "create" command and can match ordinary developer requests not intended for this specific skill. Here that matters because creating a worktree can trigger branch creation, filesystem changes, env file creation, and later database/proxy operations, making accidental activation materially risky.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using the single-word trigger "codai" is overly broad for an orchestration skill and can activate on ordinary discussion of the project name rather than an explicit request to manage infrastructure. In this skill, unintended activation is more dangerous than usual because the routed actions include starting services, manipulating databases, and removing worktrees through downstream plugins.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: Codai
slug: codai
version: 1.0.0
description: "Orchestration skill for the codai-dev local environment. Routes user commands to the right plugin (proxy-manager, mysql-manager, postgres-manager, redis-manager, worktree-manager). Use when the user asks to manage any part of the dev environment without specifying which plugin."
changelog: Initial release.
triggers:
  - "subir mysql"

Static analysis

No suspicious patterns detected.