Ravi sso

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:19 AM UTC
• Version: 2.1.1

Overview

This is a small Ravi SSO instruction skill whose sensitive token-sharing behavior matches its stated purpose, but users should only send tokens to trusted services over secure channels.

Install only if you intend to use Ravi SSO. Treat each token as a short-lived bearer credential: send it only to the trusted service you are logging into, prefer HTTPS POST body or Authorization header over URL query parameters, and do not log, cache, or share the token elsewhere.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Unsafe Bearer Token Transmission Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 24
Vulnerability Type: Sensitive token exposure through insecure transmission guidance
Risk Level: Medium

Vulnerable snippet:

markdown

Pass the token to the third-party service however it requires (request body, header, query param — it varies per service).

Technical Analysis

The skill explicitly permits transmitting a short-lived Ravi SSO bearer token through a URL query parameter. Query strings can be retained in browser history, application and reverse-proxy access logs, monitoring platforms, analytics systems, screenshots, and other diagnostic records. Depending on client and referrer-policy behavior, URLs may also be disclosed through referral metadata.

The token is security-sensitive because successful verification returns identity information, including the user's name, email address, telephone number, account creation time, and owner information. Although the documented five-minute lifetime limits the exploitation window, it does not prevent a party that captures the token from attempting verification while it remains valid.

The guidance also does not require validation of the destination service or explicit user confirmation before disclosure. This increases the risk that an agent could send the bearer token to an untrusted, impersonated, or incorrectly selected endpoint.

Attack Path

1. An agent obtains a fresh token by executing ravi sso token.
2. Following the documented guidance, the token is placed in a third party's URL query parameter.
3. The complete URL is captured by access logs, proxy infrastructure, browser history, monitoring software, or another observer.
4. An observer extracts the bearer token during its five-minute validity window.
5. The observer submits the token to the Ravi SSO verification endpoint.
6. If verification succeeds, the identity information associated with the token is disclosed.

Imp

...[truncated 511 chars]

Remediation

View remediation

Remediation Suggestions

• Prohibit transmission of SSO tokens in URL query parameters.
• Require HTTPS for every token destination.
• Prefer a protected POST request body or an Authorization: Bearer header, according to the receiving service's secure integration specification.
• Require validation of the destination origin before releasing a token, using an allowlist of trusted service origins where practical.
• Request explicit user confirmation before transmitting identity-bearing credentials to a third party.
• Instruct agents never to log, cache, display, persist, or include the token in diagnostic output.
• Redact token values from application, proxy, and observability logs.
• Document whether tokens are audience-bound and single-use. If they are not, implement audience restriction and one-time redemption to reduce the consequences of interception.
• Preserve the short expiration period and obtain tokens only immediately before secure transmission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to pass an SSO token to third-party services and documents that verification reveals sensitive personal data such as full name, email, phone number, and account metadata, but it does not warn users about that disclosure or require trust validation of the recipient. This creates a privacy and consent risk: users may share tokens with services without understanding that redemption exposes personally identifiable information to the third party.

Content

No source excerpt is available for this finding.