ClawHub
Back to skill

Security audit

sentio-platform

Security checks for vulnerabilities and agentic risk

Overview

This Sentio skill appears purpose-aligned, but it needs review because it uses a mutable CLI package, handles API keys, and documents destructive platform actions without clear safeguards.

Install only if you trust Sentio's CLI supply chain and will use narrowly scoped, revocable credentials. Avoid pasting long-lived API keys into command lines or chat transcripts, prefer safer login/secret handling where available, and require explicit confirmation before deletes, dashboard imports with overrides, public sharing changes, processor lifecycle changes, simulations, or fork operations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Runtime Execution of Sentio CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8, with affected invocations at SKILL.md:12-13
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

markdown
Use `npx @sentio/cli@latest` for SQL, data queries, alerts, endpoints, and project management.

## Setup

1. Check login status: `npx @sentio/cli@latest login --status`
2. If not logged in, ask the user for api key and run: `npx @sentio/cli@latest login --api-key <key>`

Technical Analysis

The Skill directs the Agent to execute @sentio/cli through npx using the mutable latest distribution tag. When the package is not already available locally, npx can retrieve and execute package content from the configured package registry at runtime.

Because latest can resolve to a different release after the Skill has been reviewed, the effective code executed by the Agent is not fixed by the audited project. A malicious future release, compromised publisher account, registry compromise, or dependency compromise could therefore introduce arbitrary package or lifecycle code without requiring any modification to this Skill.

Runtime package retrieval is relevant to the declared functionality because a Sentio client is needed to communicate with the platform. However, executing an unpinned release exceeds the minimum supply-chain privilege necessary: the functionality can be provided by a specific reviewed version.

Attack Path

  1. An attacker compromises the package publisher, release process, registry account, or a transitive dependency used by a future @sentio/cli release.
  2. The compromised version is assigned to the latest tag.
  3. An Agent follows the Skill and invokes npx @sentio/cli@latest.
  4. npx downloads the newly resolved package and executes its CLI or installation lifecycle logic.
  5. The malicious code runs with the same local privileges as the Agent process.

...[truncated 795 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @sentio/cli@latest with an exact, reviewed version, such as @sentio/cli@x.y.z.
  2. Manage the CLI through a lockfile-controlled installation rather than downloading it independently on every invocation.
  3. Enforce package integrity using lockfile integrity hashes and a trusted registry.
  4. Review package updates before changing the pinned version.
  5. Disable or restrict lifecycle scripts where operationally possible.
  6. Run the CLI in a sandbox with only the filesystem, environment, and network access required for the requested Sentio operation.
  7. Use a credential with narrowly scoped permissions so a compromised dependency cannot administer unrelated projects or resources.
  8. Document the expected package source and reject resolution from unapproved registries.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:13
Finding

API Credentials May Be Exposed Through Command-Line Arguments and URL Query Parameters

Content
View full analysis

Vulnerability Details

File Locations: SKILL.md:13, SKILL.md:153-154, and references/openapi.swagger.json:10435-10445
Vulnerability Type: Insecure transmission and handling of authentication secrets
Risk Level: Medium

Complete Code Snippets:

SKILL.md:13:

markdown
2. If not logged in, ask the user for api key and run: `npx @sentio/cli@latest login --api-key <key>`

SKILL.md:153-154:

markdown
- All commands accept `--api-key <key>` or use saved credentials from `sentio login`.
- All commands accept `--token <token>` for bearer token auth.

references/openapi.swagger.json:10435-10445:

json
"securityDefinitions": {
  "ApiKeyHeaderAuth": {
    "in": "header",
    "name": "api-key",
    "type": "apiKey"
  },
  "ApiKeyQueryAuth": {
    "in": "query",
    "name": "api-key",
    "type": "apiKey"
  }
}

The API specification also identifies the destination as api.sentio.xyz and restricts transport to HTTPS:

json
"host": "api.sentio.xyz"
json
"schemes": [
  "https"
]

Technical Analysis

The Skill explicitly instructs the Agent to ask the user for an API key and place it in the command line. It also documents command-line bearer-token authentication. Depending on the execution environment, secrets supplied as command arguments may be recorded in:

  • Shell history
  • Process listings or process-monitoring tools
  • CI/CD command logs
  • Agent transcripts and tool-call records
  • Terminal session recordings
  • Error reports or diagnostic telemetry

The Swagger specification additionally permits api-key as a URL query parameter. Although HTTPS protects the request in transit from passive network observers, query strings can still be retained in reverse-proxy access logs, load-balancer logs, application telemetry, browser or client histories, monitoring platforms, and error reports.

Sending au ...[truncated 2357 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not instruct users to place API keys or bearer tokens directly in command-line arguments.
  2. Prefer a secure interactive prompt that disables terminal echo, protected standard input, an operating-system credential store, or a secret-manager integration.
  3. If environment variables are supported, ensure they are injected by a secret manager and are excluded from debug output, crash reports, and subprocess environments that do not need them.
  4. Remove or deprecate ApiKeyQueryAuth; require the api-key request header instead.
  5. Ensure CLI and API logging redact authentication headers, command arguments, URLs, and query parameters.
  6. Avoid asking users to paste credentials into conversational context. Direct them to a secure local authentication flow.
  7. Store saved credentials with restrictive filesystem permissions or in the operating system's secure credential store.
  8. Use short-lived, revocable tokens with the smallest project and operation scopes required.
  9. Require explicit user confirmation before destructive operations such as project deletion, endpoint deletion, processor stopping, or dashboard replacement.
  10. Rotate any credential suspected of having appeared in shell history, process telemetry, transcripts, or URL logs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
When constructing or editing `dashboard.json` for import, refer to `references/openapi.swagger.json` for the full schema. Key structure:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
When constructing or editing `dashboard.json` for import, refer to `references/openapi.swagger.json` for the full schema. Key structure:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
When constructing or editing `dashboard.json` for import, refer to `references/openapi.swagger.json` for the full schema. Key structure:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/openapi.swagger.json (reported line 28)May include surrounding context.

json
"ai_service.AutoConfig": {
      "properties": {
        "executeQuery": {
          "title": "Whether to automatically execute generated queries (SQL or Insight)",
          "type": "boolean"
        }
      },
      "title": "AutoConfig contains configuration specific to Auto scenarios",
      "type": "object"
    },
    "ai_service.ChartType": {
      "default": "CHART_TYPE_UNSPECIFIED",
      "description": "- CHART_TYPE_UNSPECIFIED: Default unspecified type\n - CHART_TYPE_TABLE: Tabular data visualization\n - CHART_TYPE_LINE: Line chart\n - CHART_TYPE_BAR: Bar chart\n - CHART_TYPE_PIE: Pie chart",
      "enum": [
        "CHART_TYPE_UNSPECIFIED",
        "CHART_TYPE_TABLE",
        "CHART_TYPE_LINE",
        "CHART_TYPE_BAR",
        "CHART_TYPE_PIE"
      ],
      "title": "ChartType defines the supported visualization types",
      "type": "string"
    },
    "ai_service.ChatSession": {
      "description": "ChatSession represents an interactive conversation session with the AI.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Fork creation, simulation, transaction tracing, and related Solidity debug operations provide powerful blockchain-analysis and environment-manipulation capabilities that are not justified by the manifest’s project-management framing. In an agent setting, this mismatch is dangerous because hidden high-power tools can be invoked without the user understanding they are authorizing simulation, trace inspection, or fork management operations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the operator to ask for an API key and use it on the command line without any guidance on secure handling, redaction, or avoiding exposure in shell history and logs. Because this skill manages projects, alerts, dashboards, and processors, stolen credentials could enable broad unauthorized access and destructive changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented commands include deletion of alerts, endpoints, and projects, as well as pausing, stopping, and activating processors, yet the skill provides no warnings or confirmation requirements around these destructive operations. In a high-privilege platform-management context, this omission materially increases the risk of accidental service disruption, data loss, or unauthorized administrative changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Dashboard import commands can replace or materially alter existing dashboard configuration, especially with --override-layouts, but the skill does not warn users about overwrite risk or recommend exporting backups first. In this context that can lead to accidental loss of existing dashboards, broken layouts, or unauthorized content changes in shared observability surfaces.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description understates the skill's ability to create/delete projects and control processor lifecycle, while the body documents pause, stop, delete, and activation actions. This capability mismatch can mislead users or calling systems about the skill's authority, increasing the chance of unexpected destructive operations being invoked under a broader trust assumption.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description omits simulation capabilities even though the file documents running simulations, bundles, and fetching traces. Hidden execution/simulation features broaden the operational scope beyond what users may expect, which can create unsafe overtrust and unintended use of privileged project functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The SQL sharing API allows marking queries as public via isPublic but the schema and endpoint description do not warn about data exposure consequences. In agent-mediated workflows, missing warnings make accidental public disclosure more likely because the model may optimize for task completion without surfacing confidentiality risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Dashboard visibility and sharing fields include PUBLIC/isPublic semantics without embedded warnings about exposing dashboard contents, queries, and linked data views. In an agent context this is more dangerous because a user asking to 'share' or 'publish' may not realize the full visibility consequences, and the tool schema does not help the agent communicate that risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Move/Aptos/Sui call-trace retrieval is unrelated to the declared project-management purpose and exposes advanced blockchain inspection capabilities under a misleadingly narrow skill description. This broadens the agent’s effective authority and could reveal sensitive operational or transactional analysis data that users did not intend to expose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The OpenAPI surface substantially exceeds the skill’s stated purpose of building and managing Sentio projects, dashboards, alerts, and SQL workflows. Exposing unrelated price, Move, and Solidity debugging/simulation APIs increases capability scope and attack surface, enabling an agent or downstream caller to perform actions users would not reasonably expect from this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Standalone asset/pricing management and lookup APIs are broader than the stated Sentio project/build-alert-dashboard use case, creating unnecessary data-access capability and a confused-deputy risk. Even if not directly destructive, these endpoints expand what the agent can do beyond user expectations and make prompt or tool abuse more damaging.

Content

No source excerpt is available for this finding.