Codeberg

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:25 PM UTC
• Version: 0.1.0

Overview

The skill is mostly a straightforward Codeberg helper, but it under-explains sensitive token and repository-secret handling.

Review this skill before installing if you will use authenticated Codeberg operations. Use a narrowly scoped token, avoid pasting tokens directly into logged shell commands, check where Tea stores credentials, and run repository secret commands only for repositories you administer and only when you need that sensitive metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Tea CLI Dependency Uses a Mutable Latest Version

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-24
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

yaml

{
  "id": "go",
  "kind": "go",
  "module": "code.gitea.io/tea@latest",
  "bins": ["tea"],
  "label": "Install Tea CLI (go)",
},

Technical Analysis

The Go installation configuration resolves code.gitea.io/tea@latest at installation time. Because latest is a mutable version selector, the installed executable can change without any modification to or review of this Skill. This prevents reproducible installation and makes the Skill dependent on the continuing integrity of the upstream project, module distribution infrastructure, and future releases.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Exploitation would require an attacker to compromise the upstream project, its release process, or a relevant package-distribution account or channel. A malicious release selected as latest could execute with the privileges of the user installing or invoking tea.

Attack Path

1. An attacker compromises the upstream dependency project, release credentials, or associated distribution channel.
2. The attacker publishes a malicious version that is resolved by code.gitea.io/tea@latest.
3. A user or agent installs the dependency through the Skill's Go installation configuration.
4. The mutable selector retrieves and builds the attacker-controlled release.
5. The malicious executable runs when tea is invoked and operates with the installing user's permissions.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account that installs or runs tea. Depending on that account's privileges and environment, the malicious dependency could access local files, configured Codeberg credentials, repository data, environment variables, or other res ...[truncated 127 chars]

Remediation

View remediation

Remediation Suggestions

• Replace code.gitea.io/tea@latest with a specifically reviewed release, such as code.gitea.io/tea@vX.Y.Z.
• Test and review dependency upgrades before changing the pinned version.
• Where supported, validate the downloaded artifact or release using an expected checksum or trusted signature.
• Document the approved version and establish a controlled update process for security patches.
• Prefer reproducible installation mechanisms that fail closed when artifact integrity cannot be verified.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:89

Finding

Codeberg Access Token Supplied Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89-93
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code:

bash

tea login add --name codeberg --url https://codeberg.org --token <your-token>

Technical Analysis

The documented login procedure instructs the user to place a Codeberg access token directly in a command-line argument. When the placeholder is replaced with a real token, the credential may be retained in shell history, terminal transcripts, automation logs, command auditing systems, or diagnostic output. On systems where process arguments are visible to other users or monitoring tools, the token may also be observable while the command is running.

The example does not contain an actual hardcoded credential. The risk arises when a user follows the instruction and substitutes a real secret into the command.

Attack Path

1. A user replaces <your-token> with a valid Codeberg access token.
2. The user executes the command in an interactive shell, terminal-recording environment, CI job, or other logged execution context.
3. The complete command is stored in shell history or logs, or is observed through process-argument inspection.
4. An attacker with access to that history, log, recording, or process metadata extracts the token.
5. The attacker authenticates to Codeberg using the exposed credential and performs operations permitted by its assigned scopes.

Impact Assessment

The privileges obtained are those granted to the exposed token. Depending on its scopes and repository access, an attacker could read private repository information, manipulate issues or pull requests, access CI/CD metadata, modify repository content, or perform other authenticated actions. The impact may extend across every repository and organization accessible to the associated Codeberg account. Account-level pr ...[truncated 84 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the command-line token example with a supported interactive login flow that reads the credential from a hidden prompt.
• If tea supports reading a token from standard input or a protected credential store, document that mechanism instead of passing the token as an argument.
• Warn users not to place access tokens in shell history, scripts, CI command output, or terminal transcripts.
• Issue narrowly scoped, short-lived tokens whenever Codeberg supports them, following the principle of least privilege.
• Restrict permissions on any credential storage created by tea.
• Rotate and revoke any token that may previously have been entered into a logged command line.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to list repository secrets via tea actions secrets list --repo owner/repo without any caution about least-privilege use, authorization, or safe handling of sensitive output. In an agent context, exposing or enumerating secrets is dangerous because it normalizes access to sensitive configuration and may lead to accidental disclosure, logging, or misuse of credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.