Security audit

Opcode

Security checks for vulnerabilities and agentic risk

Overview

This skill describes a legitimate workflow runtime, but its documented defaults expose powerful shell, filesystem, network, secret, and persistent scheduling capabilities with weak default scoping.

Review before installing. Run this only as a low-privilege user, bind it to localhost or a protected network endpoint, avoid plaintext remote access, set strict filesystem and network allowlists, disable or tightly restrict shell.exec for untrusted workflows, protect and rotate OPCODE_VAULT_KEY, and avoid unattended self-updates or unpinned installs in production.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:56
Finding: Network-Exposed Workflow Service Grants Excessive Execution Capabilities
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/actions.md:119
Finding: Shell Steps Inherit the Vault Master-Key Environment
Content: View full analysis
**Security**: Never put `OPCODE_VAULT_KEY` in `settings.json`. Use env vars or your platform's secrets manager. The passphrase derives the AES-256 encryption key via PBKDF2. If the process stops, restart with: ```bash OPCODE_VAULT_KEY="my-passphrase" opcode ``` ``` `references/operations.md:145`: ```markdown - Treat `OPCODE_VAULT_KEY` as root-equivalent for stored secrets ``` ### Technical Analysis The daemon is instructed to receive the ...[truncated 2084 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:50
Finding: Installation and Update Instructions Execute Mutable, Unverified Remote Dependencies
Content: View full analysis
`go install` fallback) | | `opcode version` | Print embedded version (default `dev`) | ``` ### Technical Analysis The primary installation command uses the mutable `@latest` selector. The effective source installed by that command can change after this Skill has been reviewed. The setup process also downloads an executable helper into `~/.opcode/bin/`, while the self-update mechanism retrieves releases from GitHub or falls back to another `go install`. The reviewed project contains documentation only and does not document immutable version selection, checksum validation, signature verification, a trusted-key policy, or an approval gate for these executable downloads. This creates a supply-chain boundary in which compromise of an upstream repository, maintainer account, ...[truncated 1667 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
| `triggers` | object | no | Trigger config (see[workflow-schema.md](references/workflow-schema.md#triggers-template-level)) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
md
| `triggers` | object | no | Trigger config (see[workflow-schema.md](references/workflow-schema.md#triggers-template-level)) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.
md
See [expressions.md](references/expressions.md) for CEL, GoJQ, Expr engine details.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.
md
See [actions.md](references/actions.md) for full parameter specs of all 26 actions.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.
md
See [patterns.md](references/patterns.md#10-scripting-with-shellexec) for language-specific templates (Bash, Python, Node, Go).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.
md
See [patterns.md](references/patterns.md#10-scripting-with-shellexec) for language-specific templates (Bash, Python, Node, Go).

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Documenting a self-update capability that pulls from GitHub releases with a go install fallback highlights a supply-chain and integrity risk if updates are not authenticated and pinned. In an execution-layer service for agents, an unsafe update path can become remote code execution or persistence across restarts.
Content: Scanner excerpt · references/operations.md (reported line 44)May include surrounding context.
md
| `opcode` | Start SSE daemon (same as `opcode serve`) | | `opcode serve` | Start SSE daemon explicitly | | `opcode install` | Write settings.json, SIGHUP running server or start | | `opcode update` | Self-update (GitHub releases -> `go install` fallback) | | `opcode version` | Print embedded version (default `dev`) | ## Hot-Reload via SIGHUP

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/operations.md (reported line 141)May include surrounding context.
md
**Defaults are permissive** (no path deny-lists, no network restrictions). For production: - Set `DenyPaths` for sensitive directories (`/etc/shadow`, `~/.ssh`) - Set `WritablePaths` to constrain write scope - Run the opcode process under a restricted OS user - Use a network proxy/firewall for HTTP egress control

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
Registers a reusable workflow template. Version auto-increments (v1, v2, v3...). | Param | Type | Required | Description | | --------------- | ------ | -------- | ----------------------------------------------------------------------------------------------- | | `name` | string | yes | Template name | | `definition` | object | yes | Workflow definition (see below) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
| Param | Type | Required | Description | | --------------- | ------ | -------- | ----------------------------------------------------------------------------------------------- | | `name` | string | yes | Template name | | `definition` | object | yes | Workflow definition (see below) | | `agent_id` | string | yes | Defining agent ID | | `description` | string | no | Template description |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill exposes powerful capabilities including filesystem modification, shell execution, workflow triggering, and HTTP actions, but the documentation does not prominently warn users that these can execute destructive operations or exfiltrate data. In an agent skill context, lack of explicit safety guidance increases the likelihood that an agent or operator will invoke dangerous actions without appropriate confirmation, sandboxing, or scope restrictions.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.
md
## Built-in Actions | Category | Actions | | -------------- | ------------------------------------------------------------------------------------------------------- | | **HTTP** | `http.request`, `http.get`, `http.post` | | **Filesystem** | `fs.read`, `fs.write`, `fs.append`, `fs.delete`, `fs.list`, `fs.stat`, `fs.copy`, `fs.move` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.
md
| -------------- | ------------------------------------------------------------------------------------------------------- | | **HTTP** | `http.request`, `http.get`, `http.post` | | **Filesystem** | `fs.read`, `fs.write`, `fs.append`, `fs.delete`, `fs.list`, `fs.stat`, `fs.copy`, `fs.move` | | **Shell** | `shell.exec` | | **Crypto** | `crypto.hash`, `crypto.hmac`, `crypto.uuid` | | **Assert** | `assert.equals`, `assert.contains`, `assert.matches`, `assert.schema` | | **Expression** | `expr.eval` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.
md
| **Shell** | `shell.exec` | | **Crypto** | `crypto.hash`, `crypto.hmac`, `crypto.uuid` | | **Assert** | `assert.equals`, `assert.contains`, `assert.matches`, `assert.schema` | | **Expression** | `expr.eval` | | **Workflow** | `workflow.run`, `workflow.emit`, `workflow.context`, `workflow.fail`, `workflow.log`, `workflow.notify` | **Quick reference** (most-used actions):

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTTP action documentation describes arbitrary outbound requests, authentication headers, request bodies, redirects, and optional TLS verification bypass, but it does not warn that workflows may exfiltrate prompts, user data, secrets, or local file contents to external services. In an agent workflow product, missing this warning can cause operators to treat network actions as routine helpers rather than high-risk egress primitives, increasing the chance of unintended data disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The filesystem section documents write, append, delete, copy, and move capabilities without clearly warning that these actions can irreversibly modify or remove data. Although the file notes that isolator path validation exists, users may still underestimate the operational risk of destructive actions within allowed paths, leading to accidental corruption, overwrite, or deletion of important files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The shell.exec action enables direct command execution, inherited environment access, custom environment variables, working-directory control, stdin input, and optional /bin/sh -c execution, yet the documentation lacks a strong warning about host impact and command injection risk. In the context of an agent execution layer that supports templating and workflow automation, this is especially dangerous because user-controlled or interpolated values may be routed into commands, resulting in arbitrary code execution, data theft, or system tampering.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples instruct users to connect with --allow-http or --insecure to a non-TLS SSE endpoint, but do not clearly warn that traffic and authentication data can be intercepted or modified. In an agent-control plane, integrity and confidentiality of workflow commands matter, so normalizing plaintext transport materially increases risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/operations.md (reported line 133)May include surrounding context.
md
Built-in actions respect `ResourceLimits` configured at startup: | Control | Description | | -------------- | ---------------------------------------------------------------------------------------------------------- | | **Filesystem** | `DenyPaths` / `ReadOnlyPaths` / `WritablePaths` restrict file access. Symlink resolution prevents escapes. | | **Shell** | Linux: cgroups v2 (memory, CPU, PID namespace). macOS: timeout-only fallback. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/patterns.md (reported line 323)May include surrounding context.
md
{ "id": "fetch", "action": "http.get", "params": { "url": "https://api.example.com/data" } }, { "id": "notify-done",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/workflow-schema.md (reported line 308)May include surrounding context.
md
{ "id": "fetch", "action": "http.get", "params": { "url": "https://api.example.com/data" } }, { "id": "notify-done",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/workflow-schema.md (reported line 331)May include surrounding context.
md
{ "id": "fetch", "action": "http.get", "params": { "url": "https://api.example.com/data" } }, { "id": "notify-done",

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation uses a realistic vault passphrase example (my-passphrase) in copy-pasteable commands without an explicit warning to replace it. While likely illustrative, this can normalize weak/shared secrets and lead operators to deploy predictable credentials protecting the secret vault.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file documents workflow patterns that include http.get, http.post, fs.write, and shell.exec operations, but it does not include any user-facing warning that these examples may transmit data, modify files, or execute commands on the host. Under the markdown-file criteria, descriptions should warn when documented behaviors could affect user data, privacy, or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown section documents http.get calls and workflow.notify sending fetched step output to an agent, including ${{steps.fetch.output}}, but it does not include any warning that workflow data may be transmitted over the network or pushed to connected agents. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect privacy or data handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.