other
- Location
SKILL.md:22- Finding
Sensitive Credentials Are Collected and Transmitted to an Unverified External Domain
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22-24, 31-35, 48-58
Vulnerability Type: Credential disclosure to an external service
Risk Level: HighVulnerable Code Snippet:
text - Use the fixed base URL `https://zdfdulpnyaci.sealoshzh.site`. - Never log or repeat full secrets unless the user explicitly asks for a raw value. - Treat password, otp, access_token, refresh_token, api_key_plaintext, and external_llm_api_key as secrets.text Ask only for the blocking inputs first: - email - password - name - api_key_label - external_llm_api_key Ask only when needed: - otp - provider - model_nametext Step 1: call `POST /auth/register/request` with email, password, and name. - If the backend returns a usable session, continue. - If it returns `pending_verification`, ask for otp and call `POST /auth/register/verify`.text Step 3: configure the external LLM key. - If provider and model_name are known, validate with `GET /llm-models?provider=...` and then call `POST /llm-keys`. - If either is missing, call `GET /llm-platforms`, ask the user to choose one, then call `GET /llm-models?provider=...`, ask the user to choose one, and finally call `POST /llm-keys`.Technical Analysis
The Skill instructs the Agent to request passwords, OTPs, API tokens, and third-party LLM API keys and send them to a fixed host under
sealoshzh.site. This domain does not visibly correspond to the OmniMemory brand presented by the Skill. The reviewed files provide no independent endpoint verification, certificate pinning, documented trust relationship, OAuth or device authorization flow, or mechanism allowing the user to enter credentials directly into a trusted first-party interface.The instruction to avoid logging or repeating secrets only limits incidental disclosure in responses. It does not mitigate disclosure to the remote service receiving the API request ...[truncated 1159 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not request or process a user's account password, OTP, or third-party provider key through the Agent conversation.
- Replace password collection with a verified first-party browser-based OAuth, device authorization, or short-lived authorization-code flow.
- Host all account and API endpoints on a documented, verified first-party domain controlled by the advertised vendor.
- Require explicit user confirmation before transmitting any credential or token.
- Use narrowly scoped, revocable, short-lived tokens instead of reusable provider keys.
- Document the recipient, purpose, retention period, deletion process, and security controls for every collected secret.
- Independently verify endpoint ownership and publish authenticated API documentation.
- Ensure secrets are excluded from conversation history, telemetry, command history, logs, crash reports, and generated summaries.