Security audit

Skillboss

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real AI and deployment gateway, but it needs review because it can update and replace itself from a remote download, persist API keys, upload project files, and open server-provided URLs through unsafe shell commands.

Install only if you trust the SkillBoss service and publisher with local agent behavior, API credits, deployment source, and commerce workflows. Prefer manual updates, inspect any files before deployment, keep secrets out of project build folders and .env files that could be uploaded, and use least-privilege or disposable API keys where possible.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:119
Finding: Mandatory Remote-Triggered Instruction and Task Hijacking
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/api-hub.js:764
Finding: Automatic Retrieval and Installation of Unverified Remote Skill Packages
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/serve-build.js:438
Finding: Worker Deployment Collects and Uploads Plaintext .env Secrets
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/stripe-connect.js:108
Finding: Shell Command Injection Through Server-Provided Stripe Onboarding URL
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (145)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The file documents reading/writing credentials, auto-provisioning trial API keys, performing update checks, and persisting secrets in multiple local locations, none of which are clearly foregrounded in the high-level description. This expands the skill's trust boundary to local secrets and environment metadata, making misuse or unexpected exfiltration more dangerous than a pure API gateway skill.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The skill documents storing API keys in plaintext-accessible locations such as ~/.config, shell profiles, and local config.json. In an agent environment, these locations are commonly readable by tools and scripts, so broad secret discovery guidance materially increases the risk of credential exposure or misuse.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
| Location | Path | |----------|------| | Global credentials | `~/.config/skillboss/credentials.json` | | Shell profile | `SKILLBOSS_API_KEY` in `~/.zshrc` or `~/.bashrc` | | Skill config | `config.json` in the skill directory |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The credential resolution order explicitly instructs the agent where to search for API keys, which facilitates secret harvesting by any over-privileged workflow or compromised companion script. Combining this with broad invocation rules and update behavior increases the blast radius if the skill or its scripts are abused.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
| Shell profile | `SKILLBOSS_API_KEY` in `~/.zshrc` or `~/.bashrc` | | Skill config | `config.json` in the skill directory | **Resolution order:** `SKILLBOSS_API_KEY` env var > `~/.config/skillboss/credentials.json` > `config.json` ### When balance is low

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
node ./scripts/api-hub.js version

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
node ./scripts/api-hub.js version

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The documentation instructs readers to source an API key from local credential storage and copy it into an application environment, which can encourage unsafe secret handling and propagation of privileged credentials into broader build/runtime contexts. In this skill context, the same key authorizes billable external API use, so exposure could enable unauthorized usage, credit theft, or abuse of integrated services.
Content: Scanner excerpt · api-integration.md (reported line 369)May include surrounding context.
md
## Setup Steps 1. Run `./scripts/skillboss auth trial` or `./scripts/skillboss auth login` to get an API key 2. The key is auto-saved to `~/.config/skillboss/credentials.json` and exported as `SKILLBOSS_API_KEY` 3. For app code, add `SKILLBOSS_API_KEY` to your project's `.env` file 4. Use the code patterns above, adjusting for your specific model

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · extensions/remotion/rules/maps.md (reported line 41)May include surrounding context.
pnpm i mapbox-gl @turf/turf @types/mapbox-gl

text
The user needs to create a free Mapbox account and create an access token by visiting https://console.mapbox.com/account/access-tokens/. The mapbox token needs to be added to the `.env` file:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · extensions/remotion/rules/maps.md (reported line 45)May include surrounding context.
The mapbox token needs to be added to the .env file:

txt
REMOTION_MAPBOX_TOKEN==pk.your-mapbox-access-token

Hidden Instructions

High

Category: Prompt Injection
Confidence: 78% confidence
Finding: The style string contains an unusual invisible character before mapbox://styles/..., which can mislead readers and cause copy/paste discrepancies or hard-to-diagnose runtime errors. Hidden or non-printing characters in code examples are risky because they obscure the actual content and can be abused to conceal altered values or instructions.
Content: Scanner excerpt · extensions/remotion/rules/maps.md (reported line 85)May include surrounding context.
md
center: [6.5615, 46.0598], pitch: 65, bearing: 0, style: '⁠mapbox://styles/mapbox/standard', interactive: false, fadeDuration: 0, });

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install/install.sh (reported line 39)May include surrounding context.
sh
if [ -d "$dest/skillboss" ]; then if [ "$AUTO_OVERWRITE" = true ]; then rm -rf "$dest/skillboss" else echo -e "${YELLOW}! $name: skillboss already exists${NC}" read -p " Overwrite? [y/N]: " confirm

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/api-hub.js:804

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/stripe-connect.js:112

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/client.js:70