Exponential

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:32 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent Exponential task-management integration, but it asks users to install a mutable global CLI and authenticate with a JWT in a way that could expose credentials or cause unintended remote task changes.

Install only if you trust the `exponential-cli` npm package and the Exponential service. Prefer a pinned or verified CLI version, avoid pasting real JWTs into shell commands or shared agent logs, rotate any token already used this way, and confirm before letting the agent create or update tasks in a workspace.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code:

bash

npm install -g exponential-cli

Technical Analysis

The prerequisite installs the latest available version of exponential-cli globally without an exact version pin, lockfile, integrity hash, or documented publisher verification. npm installations may execute package lifecycle scripts with the privileges of the invoking user. Because the resolved package version is mutable, the code ultimately installed may differ from the version originally reviewed.

Global installation also increases scope by modifying the user's global Node.js environment and exposing the installed executable system-wide for that user. The project does not contain the package source or other controls that would make the installed artifact reproducible.

No evidence establishes that the current package is malicious. The vulnerability is the unsafe dependency acquisition practice and resulting exposure to a future package compromise, malicious release, dependency confusion event, or account takeover.

Attack Path

1. An attacker compromises the npm publisher account, package, or one of its transitive dependencies and publishes a malicious release.
2. A user or agent follows the documented prerequisite after that release becomes the version selected by npm.
3. npm downloads the mutable latest package version and its dependencies.
4. Malicious package code or lifecycle scripts execute with the invoking user's privileges during installation.
5. The globally installed executable can subsequently run attacker-controlled logic whenever the documented CLI is invoked.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. This may permit access to that user's files, environme ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

• Pin an audited exact package version instead of resolving the latest release, for example exponential-cli@X.Y.Z.
• Verify and document the official package name, publisher, repository, and expected artifact integrity before installation.
• Prefer a project-local dependency with a committed lockfile rather than a global installation.
• Use npm integrity and provenance verification where available.
• Review transitive dependencies and package lifecycle scripts before approving upgrades.
• Consider disabling lifecycle scripts with --ignore-scripts when compatible with the package.
• Execute installation as an unprivileged user and approve version upgrades only after security review.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

JWT Exposed Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Sensitive authentication token exposed through process arguments and command history
Risk Level: Medium

Vulnerable Code:

bash

exponential auth login --token <JWT> --api-url https://www.exponential.im

Technical Analysis

The authentication procedure instructs the user to place a JWT directly in a command-line argument. After replacing the placeholder with a real token, that secret may be retained in shell history, terminal transcripts, agent execution logs, audit telemetry, or process-monitoring output. Depending on the operating system and process visibility controls, other local users or monitoring software may also observe command arguments while the process is running.

The configured API endpoint is consistent with the Skill's declared Exponential service, and there is no evidence that the token is intentionally sent to an unrelated destination. The issue is the insecure transport of the token into the CLI rather than demonstrated malicious exfiltration.

Attack Path

1. A user replaces the <JWT> placeholder with a valid Exponential authentication token.
2. The user executes the documented command.
3. The complete command is retained in shell history, an agent transcript, terminal logging, process telemetry, or operating-system process metadata.
4. A local user, support operator, log reader, compromised process, or other actor with access to that record obtains the JWT.
5. The actor replays the token against the Exponential API before it expires or is revoked.
6. The actor performs actions allowed by the token, such as reading or modifying accessible tasks, projects, and workspaces.

Impact Assessment

Exploitation could grant the attacker the same Exponential API privileges associated with the exposed JWT. Based on the documented Skill capabilities, this may include listing workspaces and pr ...[truncated 271 chars]

Remediation

View remediation

Remediation Suggestions

• Replace command-line token input with an interactive, no-echo prompt or protected standard-input mechanism.
• If supported, use a restricted credential file with owner-only permissions or an operating-system credential store.
• Do not print, log, or retain the token in agent transcripts or diagnostic output.
• Document that users must not paste real tokens directly into shell commands.
• Apply least privilege and short expiration periods to issued JWTs.
• Provide clear token rotation and revocation procedures.
• If the documented command has already been used with a real token, remove it from shell history and logs where feasible, revoke the exposed token, and issue a replacement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough that ordinary project-management requests like 'create a task' or 'daily plan' may invoke this skill unexpectedly. Because the skill can create and update remote tasks through an authenticated CLI, accidental invocation could cause unintended state changes in the user's Exponential workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to authenticate with a JWT token and interact with a remote API, but it provides no warning about secret handling, token scope, or the consequences of sending data to an external service. This increases the risk of credential exposure, unsafe token usage, and users invoking API-backed actions without understanding that task and workspace data will be transmitted remotely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.