skill-state-manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 0.0.1

Overview

This skill is not overtly malicious, but it normalizes asking for API tokens in chat and saving them as plaintext files for later reuse.

Review carefully before installing. This skill may make authentication more convenient, but it encourages pasting live API keys into chat and storing them in plaintext local files. Prefer tools that use an OS keychain, secret manager, OAuth flow, masked prompt, or environment variables, and avoid storing broad-scope or long-lived tokens this way.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Plaintext Collection and Persistence of Authentication Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–51
Vulnerability Type: Plaintext sensitive-data handling
Risk Level: High

Complete Vulnerable Snippet:

markdown

2. **Check Storage**: Look for the credentials in the designated local directory based on the detected platform:
   - If Claude Code: check `~/.claude/skills-state/<tool-name>.json`
   - If Codex / Other: check `~/.ai-skills-state/<tool-name>.json`
3. **Prompt User (If Missing)**: 
   - If the required credentials (e.g., API keys, tokens) are not found in the storage, **STOP** the tool execution. 
   - Ask the user politely for the required information via a chat message. 
   - *Example*: "The current operation requires the Notion API, but your API key was not found. Could you please provide it? I will save it locally in `~/.claude/skills-state/notion-skill.json` (or the appropriate path) for future use."
4. **Save State**: 
   - Once the user provides the information in the chat, use the `Write` tool to save it into the JSON file resolved in Step 1.
   - For Claude Code, write to `~/.claude/skills-state/<tool-name>.json`.
   - For Codex / Other CLI, write to `~/.ai-skills-state/<tool-name>.json`.
   - Ensure the content is stored as valid JSON.
   - Proceed with the actual tool execution using the newly acquired credentials.

Technical Analysis

The skill directs an AI agent to solicit API keys and tokens through chat and persist them in ordinary JSON files under the user's home directory. It does not require encryption, integration with an operating-system credential vault, restrictive file permissions, atomic file creation, log redaction, retention limits, or credential deletion and rotation procedures.

Consequently, sensitive values may remain exposed in both conversation history and plaintext filesystem state. Depending on the host configuration, chat transcripts, backups, synchronization software, diagnostic bundl ...[truncated 1532 chars]

Remediation

View remediation

Remediation Suggestions

• Store credentials in an operating-system keychain or dedicated secret manager rather than plaintext JSON.
• Avoid requesting secrets through persistent chat. Use a masked terminal prompt, secure credential-entry interface, or provider authorization flow where available.
• Require explicit user consent before storing any credential and disclose its destination, retention period, and deletion procedure.
• If file-based storage is unavoidable, create the directory and files with owner-only permissions, such as 0700 for directories and 0600 for files.
• Create and replace credential files atomically to avoid insecure intermediate files and race conditions.
• Encrypt secrets at rest using keys that are not stored beside the encrypted data.
• Prevent secret values from appearing in tool output, logs, error messages, telemetry, and diagnostic bundles.
• Define credential expiration, deletion, revocation, and rotation workflows.
• Restrict each token to the minimum scopes required by the target tool.
• Validate and normalize the tool-derived filename to prevent traversal or unintended file writes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the assistant to solicit credentials directly in the chat and then persist them locally for future use. This is dangerous because chat channels are often logged, synced, or retained, and converting conversational secrets into reusable local artifacts broadens the attack surface beyond the immediate tool invocation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage example operationalizes the insecure pattern by showing the user posting a live token in chat and the assistant saving it for later reuse. Examples in skills are especially influential because they normalize the behavior and make downstream assistants more likely to repeat it exactly, turning insecure secret handling into standard practice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages users to provide API keys in chat and implies they will be stored locally for reuse, but it does not present a clear security/privacy warning about chat retention, local file exposure, or host compromise. In a meta-skill whose purpose is credential handling across other tools, normalizing secret collection through the conversation increases the chance of unnecessary disclosure and insecure storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These instructions require the assistant to take secrets supplied in conversation and write them to persistent files under the user's home directory, without mandating encryption, permission hardening, or an explicit informed consent flow. This creates a durable secret-at-rest exposure path and may leak credentials to other local users, backups, logs, or malware on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill establishes persistent state in predictable per-tool files under the home directory, which creates ongoing credential retention and reuse across sessions. In this context the persisted state is specifically authentication material, making session persistence more dangerous because compromise of those files can enable unauthorized third-party API access long after the original interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

- *Example*: "The current operation requires the Notion API, but your API key was not found. Could you please provide it? I will save it locally in `~/.claude/skills-state/notion-skill.json` (or the appropriate path) for future use."
4. **Save State**: 
   - Once the user provides the information in the chat, use the `Write` tool to save it into the JSON file resolved in Step 1.
   - For Claude Code, write to `~/.claude/skills-state/<tool-name>.json`.
   - For Codex / Other CLI, write to `~/.ai-skills-state/<tool-name>.json`.
   - Ensure the content is stored as valid JSON.
   - Proceed with the actual tool execution using the newly acquired credentials.

Static analysis

No suspicious patterns detected.