Fizzy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This Fizzy skill appears to be a legitimate board-management helper, but it needs review because it installs an unpinned third-party CLI and can change or delete project data using broad API credentials without clear confirmation safeguards.

Install only if you trust the Fizzy CLI source and can verify the package you are installing. Use the narrowest token permissions available, avoid storing tokens in world-readable files or logs, and require explicit confirmation before delete, close, bulk read-all, upload, or update actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:14
• Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `skill.md`, line 14 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code**: ```bash brew install robzolkos/fizzy-cli/fizzy-cli ``` ### Technical Analysis The Skill instructs users to install and execute the Fizzy CLI from a third-party Homebrew tap without pinning an immutable version or commit and without requiring checksum or provenance verification. Consequently, the executable and installation formula may change after the Skill has been audited. Network communication with a configured Fizzy service and explicit file uploads are necessary for the declared remote board-management functionality. No direct credential-exfiltration instruction was identified. Nevertheless, the installed CLI will be positioned to access the configured `FIZZY_TOKEN`, communicate with the Fizzy API, process returned account data, and upload files selected by the user. This makes the integrity of the dependency security-sensitive. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its publishing account, formula, or referenced release artifact. 2. The attacker replaces the formula or package with a malicious version. 3. A user follows the Skill's installation instruction without an immutable version or integrity check. 4. Homebrew downloads and executes the compromised installation logic or binary with the user's local privileges. 5. When the CLI is configured or invoked, the malicious code reads accessible Fizzy credentials or data, intercepts API operations, accesses explicitly supplied files, and sends the information to an attacker-controlled destination. ### Impact Assessment Successful exploitation permits arbitrary code execution under the account running Homebrew or the installed CLI. The attacker could access environment-based Fizzy credentials, the user's Fizzy account data, files explicitly provided to CLI commands, and othe ...[truncated 527 chars]
• Remediation: ## Remediation Suggestions 1. Prefer an official, verified Fizzy CLI distribution rather than an unverified third-party tap. 2. Pin the dependency to an immutable release version or source commit. 3. Verify downloaded artifacts against a publisher-provided cryptographic checksum or signature before execution. 4. Document the expected publisher, repository, release URL, checksum, and verification procedure. 5. Require explicit user approval before installing or upgrading executable dependencies. 6. Use a narrowly scoped Fizzy token instead of broadly granting read and write access where the requested operation does not require both. 7. Avoid exposing the token through verbose logs, shell history, command-line arguments, or generated files. 8. Restrict `FIZZY_API_URL` to trusted HTTPS endpoints and clearly warn users that credentials will be sent to the configured server. 9. Run the CLI with ordinary user privileges and limit filesystem access where sandboxing is available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

### Get Your Token

1. Go to your Fizzy profile → Personal Access Tokens
2. Generate a new token with Read + Write permissions

## ID Formats

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description is broad enough to trigger on generic terms like boards, cards, tasks, or backlog, which can cause the agent to invoke this skill in ordinary conversation without clear user intent. Because the skill includes write and delete capabilities, over-triggering increases the chance of unintended side effects or unsafe command execution in the wrong context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The credential setup instructions encourage storing long-lived API tokens in environment variables or a local config file but do not warn about shell history, process inspection, file permissions, or accidental exposure in logs and agent output. In a CLI skill used by an automated agent, missing secret-handling guidance materially raises the risk of credential leakage and account compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents destructive and state-changing operations such as delete, close, update, assign, and tag actions without any confirmation, dry-run, or user-warning guidance. In an agentic environment, this makes accidental or prompt-induced modification of project data much more likely, especially because the commands are presented as routine workflows.

Static analysis

No suspicious patterns detected.