Ravi secrets

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:17 AM UTC
• Version: 2.1.1

Overview

The skill is a coherent secrets-management guide, but it encourages patterns that can expose API keys and tokens in plaintext.

Review this skill carefully before installing. Use it only where you are comfortable with the `ravi` secrets service receiving and returning plaintext secret values. Avoid pasting real tokens directly into shell commands, avoid sharing or logging command output, and prefer narrowly scoped retrieval over bulk listing whenever possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13
• Finding: Secret Values Are Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–16; additional examples at lines 53–55 and 62–65 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```bash # Store a secret ravi secrets set OPENAI_API_KEY "sk-abc123..." ``` Additional documented examples use the same insecure pattern: ```bash # Store a key ravi secrets set OPENAI_API_KEY "sk-abc123..." ``` ```bash ravi secrets set ANTHROPIC_API_KEY "sk-ant-..." ravi secrets set GITHUB_TOKEN "ghp_..." ``` ### Technical Analysis The documented interface passes secret values directly as command-line arguments. Although quoting prevents ordinary shell word splitting, it does not protect the value from exposure through mechanisms that record or inspect command invocations. Depending on the operating system, shell configuration, and surrounding infrastructure, plaintext arguments may be exposed through: - Shell history files. - Process-listing and process-inspection interfaces while the command runs. - Operating-system audit facilities. - Terminal session recording. - Endpoint monitoring and command telemetry. - CI/CD job logs or debugging output. The skill is specifically intended to handle API keys, environment variables, and access tokens. Exposure through command arguments can therefore compromise credentials even if the destination service encrypts their values at rest. Server-side encryption does not protect secrets before transmission or while they are present in local process arguments. ### Attack Path 1. A user follows the documented example and runs `ravi secrets set` with a real token as the second argument. 2. The plaintext token becomes part of the shell command and process argument vector. 3. The command is retained by shell history, process monitoring, audit telemetry, terminal recording, or CI/CD logging. 4. A local user, administrator, monitoring-system operator, or attacker with access to those records retriev ...[truncated 608 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Change the CLI to accept secret values through standard input rather than command-line arguments, for example: ```bash printf '%s' "$OPENAI_API_KEY" | ravi secrets set OPENAI_API_KEY --stdin ``` - Provide an interactive, no-echo prompt when standard input is attached to a terminal. - Support protected file descriptors or restricted-permission input files for automation. - Ensure the CLI never logs, echoes, or includes the submitted value in error messages. - Redact secret values from tracing, telemetry, and debug output. - Replace every documented command that embeds a secret directly in the argument list. - Warn users not to place literal credentials in shell commands, shell history, CI configuration, or terminal recordings. - Where practical, recommend short-lived, narrowly scoped credentials and credential rotation after suspected disclosure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Bulk Secret Listing Returns All Values in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–36 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```bash # List all secrets ravi secrets list ``` The documented response includes the decrypted value of every listed secret: ```json [ { "uuid": "...", "identity": 1, "key": "OPENAI_API_KEY", "value": "sk-abc123...", "notes": "", "created_dt": "2026-02-25T10:30:00Z", "updated_dt": "2026-02-25T10:30:00Z" } ] ``` ### Technical Analysis The list operation is documented as returning complete secret records, including each plaintext `value`. This combines metadata enumeration with bulk secret retrieval and violates the principle of least disclosure. A user who only needs to inspect available key names receives all decrypted credentials. The response can enter terminal scrollback, command transcripts, agent context, pipeline output, application logs, or redirected files. A single invocation consequently increases the disclosure scope from one explicitly requested credential to the entire secret collection associated with the identity. The documentation states that values are encrypted server-side but returned in plaintext. Encryption at rest does not mitigate exposure after the list endpoint decrypts and returns every value. The underlying external service implementation was not included in the audited project, so this finding is based on the behavior explicitly documented in `SKILL.md`. ### Attack Path 1. A user or automation process invokes `ravi secrets list`, potentially intending only to discover available key names. 2. The service returns all records with their decrypted `value` fields. 3. The complete response is displayed, piped, logged, recorded, or retained in an agent transcript. 4. An attacker obtains access to the terminal history, transcript, output file, CI log, observability platform, or downstream process. 5. The attacker extracts ...[truncated 909 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Change `ravi secrets list` to return metadata only, excluding or redacting the `value` and encrypted notes fields. - Require an explicit per-key operation such as `ravi secrets get KEY` before returning a decrypted value. - If bulk value retrieval is operationally necessary, place it behind a separate, explicitly named command with additional authorization and confirmation. - Apply least-privilege authorization separately to listing metadata and retrieving secret values. - Add audit logging for value retrieval while ensuring the audit records never contain secret material. - Prevent plaintext values from being emitted in debug logs, error responses, telemetry, or default terminal output. - Consider short-lived retrieval authorization, rate limits, and alerts for unusual bulk-access patterns. - Update the JSON examples and common patterns so key enumeration uses a response that contains key names and identifiers only. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

## Full API Reference

For complete endpoint details, request/response schemas, and parameters: [Secrets](https://ravi.id/docs/schema/secrets.json)

## Related Skills

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill demonstrates `ravi secrets list` and `ravi secrets get` returning full objects that include the plaintext `value` field, but the warning is not made prominent where users are most likely to copy commands and parsing patterns. Because this is a secrets-handling skill, underemphasizing that list/get expose plaintext secret material increases the risk of accidental disclosure into logs, terminals, chat transcripts, shell history, or downstream tooling.

Static analysis

No suspicious patterns detected.