Security audit

Forgejo

Security checks for vulnerabilities and agentic risk

Overview

This Forgejo helper is coherent and purpose-aligned, but users should treat its token, secrets, and install examples carefully.

Install only if you intend to manage Forgejo resources through Tea CLI. Use a narrowly scoped token, avoid pasting real tokens into commands that may be logged, review what secret and variable commands will reveal, and prefer a pinned or otherwise trusted Tea CLI installation source when possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Tea CLI Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:89
Finding: Forgejo Access Token Passed Through Command-Line Arguments
Content: View full analysis
``` ### Technical Analysis The documentation instructs users to supply a Forgejo access token directly as a command-line argument. When the placeholder is replaced with a real credential, the token may be retained in shell history, terminal session recordings, automation logs, audit telemetry, or process-command-line data. On systems where process arguments are visible to other users or monitoring services, the token may also be exposed while the command is running. The issue depends on a user following the example with a real token and on the host's history, process visibility, and logging configuration. ### Attack Path 1. A user replaces `` with a valid Forgejo access token and executes the documented command. 2. The shell, terminal recorder, automation platform, process monitor, or logging system captures the complete command line. 3. A local user, administrator, log reader, or attacker with access to the captured data retrieves the token. 4. The attacker submits the token to the configured Forgejo instance. 5. The attacker performs operations permitted by the token until it expires or is revoked. ### Impact Assessment The exposed token grants the attacker the same Forgejo API and repository permissions assigned to that credential. Depending on its scope, this may include reading private repositories, accessing issues and pull requests, modifying repository content, interacting with CI/CD configuration, or viewing and changing repository variables and secret metadata. The maximum impact is bounded by the token's scopes, the associated account's privileges, and server-side authorization rules. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs users to list repository secrets via tea actions secrets list --repo owner/repo without any warning that this touches sensitive security configuration. Even if the command may only reveal secret names rather than values, exposing the existence and naming of secrets can aid reconnaissance, and the lack of caution normalizes handling sensitive resources without user confirmation or least-privilege considerations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.