Ravi vault

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:16 AM UTC
• Version: 1.6.0

Overview

The skill is coherent as a secrets vault helper, but its examples handle API keys in command lines and process arguments in ways that can leak credentials.

Review before installing or using with real credentials. Prefer a safe input method such as stdin or a no-echo prompt if the ravi CLI supports it, avoid putting real secrets directly in shell commands, disable shell tracing around secret handling, and keep agent/tool logs from recording decrypted values.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15

Finding

Plaintext Secrets Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-18, SKILL.md:58-61, and SKILL.md:65-66
Vulnerability Type: Plaintext sensitive-data exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash

# Store a secret (creates or updates)
ravi secrets set OPENAI_API_KEY "sk-abc123..." --json

# With optional notes
ravi secrets set STRIPE_SECRET_KEY "sk_live_..." --json

The integration example repeats the unsafe pattern and also expands a retrieved secret into the curl command line:

bash

# Store a key for the agent to use later
ravi secrets set OPENAI_API_KEY "sk-abc123..." --json

# At runtime, retrieve the key
API_KEY=$(ravi secrets get OPENAI_API_KEY --json | jq -r '.value')
curl -H "Authorization: Bearer $API_KEY" https://api.openai.com/v1/...

# Store multiple service keys
ravi secrets set ANTHROPIC_API_KEY "sk-ant-..." --json
ravi secrets set GITHUB_TOKEN "ghp_..." --json

Technical Analysis

The documentation instructs users and agents to pass API keys, tokens, and other secrets directly as command-line arguments. Shells commonly retain entered commands in history files, meaning a real secret supplied in place of the examples can remain available after the vault operation completes.

Command-line arguments may also be visible temporarily through process-inspection facilities, monitoring agents, diagnostic collectors, audit systems, or process-listing tools, subject to the operating system's access controls. The curl example similarly expands the retrieved API key into the Authorization header argument, placing the plaintext token in the process argument vector.

Encrypting a value inside the vault does not protect the value before it reaches the vault CLI or while it is exposed through another command's arguments. The repository contains only SKILL.md, so the claimed end-to-end encryption and any secret-safe input mechanism in t ...[truncated 1316 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace command-line secret arguments with a protected standard-input interface, for example:

   bash

   printf '%s' "$OPENAI_API_KEY" | ravi secrets set OPENAI_API_KEY --value-stdin --json
   

   The CLI should clearly document that it reads only the secret value from standard input and should avoid echoing or logging it.

2. Provide an interactive no-echo prompt when standard input is attached to a terminal:

   bash

   ravi secrets set OPENAI_API_KEY --prompt --json
   

3. If the CLI does not currently support standard input or protected prompts, add those capabilities before recommending it for real credentials. Avoid suggesting temporary files unless they are created atomically with restrictive permissions and securely removed.

4. Add an explicit warning that users must not place real secrets directly in command arguments because they may be retained in shell history, process metadata, audit logs, or telemetry.

5. Avoid expanding bearer tokens into curl arguments. Prefer a client integration that injects credentials without exposing them in the process argument vector. If a temporary configuration or header file is unavoidable, create it with owner-only permissions, prevent logging and backups, and delete it immediately after use.

6. Recommend credential scoping, short expiration periods, rotation, and revocation procedures to reduce the impact of accidental exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill shows how to retrieve a decrypted secret into a shell variable and use it, but it does not warn users against exposing the value through shell history, debug tracing, logs, subprocess output, or accidental echoing. In a secret-management skill, omission of handling guidance is materially risky because agents may copy this pattern into verbose or instrumented environments where plaintext secrets can leak.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

# At runtime, retrieve the key
API_KEY=$(ravi secrets get OPENAI_API_KEY --json | jq -r '.value')
curl -H "Authorization: Bearer $API_KEY" https://api.openai.com/v1/...

# Store multiple service keys
ravi secrets set ANTHROPIC_API_KEY "sk-ant-..." --json