Asana Git Retex

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

The skill is a plain documentation-only workflow note, but it instructs users to expose and persist live GitHub and Asana tokens in unsafe ways.

Review this skill before installing. It is not a hidden executable payload, but do not follow its token-handling commands as written. Use Git credential helpers, GitHub CLI or a keychain-backed credential manager, retrieve Asana secrets at runtime from 1Password, avoid plaintext token files, rotate any tokens already stored this way, and review any cron or repository changes before applying them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16

Finding

GitHub personal access token exposed through persistent remote configuration and process arguments

Content

View full analysis

@github.com/rez0/kiloclaw-workspace.git" curl -s -H "Authorization: token $TOKEN" https://api.github.com/user ``` ### Technical Analysis The instructions place a GitHub personal access token directly in the repository's remote URL. Git stores that URL in `.git/config`, causing the credential to remain in plaintext after the operation completes. It may subsequently appear in configuration output, diagnostic logs, workspace archives, backups, screenshots, or support records. The health-check command also expands the token into a command-line argument. On systems where process arguments are visible to other users or monitoring software, the expanded authorization header may be captured while `curl` is running. Although the request is sent to the legitimate GitHub API over HTTPS, passing the secret this way unnecessarily expands its local exposure. The workflow requires GitHub authentication, but persistent storage in the remote URL and exposure through command arguments exceed the minimum credential access necessary for authenticated Git operations. ### Attack Path 1. The operator retrieves a GitHub PAT from 1Password. 2. The operator embeds that PAT in the Git remote URL. 3. Git persists the complete credential-bearing URL in `.git/config`. 4. An attacker with access to the workspace, a backup, diagnostic output, or another local process reads the token from `.git/config` or captures it from process arguments. 5. The attacker authenticates to GitHub using the recovered PAT. 6. The attacker reads or modifies repositories and other resources permitted by the PAT's scopes. ### Impact ...[truncated 395 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Asana API token persisted in an insufficiently protected plaintext file

Content

View full analysis

~/.config/tokens/asana-kiloclaw.txt ``` ### Technical Analysis The command retrieves a secret from 1Password and writes it to a persistent plaintext file. It does not establish restrictive permissions before writing, validate the permissions of an existing file, prevent symbolic-link redirection, or remove the credential after use. The resulting protection depends on the existing directory permissions, file permissions, process umask, and backup policy. If the file already exists with permissive permissions, shell redirection truncates and rewrites it without correcting those permissions. Persistent storage also increases the period during which malware, another local account, a backup process, or an accidental repository inclusion can disclose the token. The Skill later recommends dynamic retrieval from 1Password, which is preferable only if the token remains transient and is not copied back to a persistent plaintext file. ### Attack Path 1. The operator runs the documented synchronization command. 2. The Asana token is written to `~/.config/tokens/asana-kiloclaw.txt`. 3. The file has inherited, existing, or otherwise insufficient access controls, or it is collected by a backup or workspace-copying process. 4. An attacker or unauthorized process reads the plaintext token from the file or a copied artifact. 5. The attacker sends authenticated requests to the Asana API using the stolen token. 6. The attacker accesses or modifies Asana data available to the token owner. A local attacker may also attempt to replace the destination with a symbolic link before execution, potentially redirecting the disclosed secret to another attacker-readable location where filesystem permissions permit that operation. ### I ...[truncated 432 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

### 1. Token GitHub Expiré ou Invalide
- **Symptôme** : Échec silencieux du `git push` lors de la sauvegarde hebdomadaire, erreur HTTP 401.
- **Cause** : Le Personal Access Token (PAT) GitHub stocké dans l'URL du remote était périmé.
- **Solution** : 
  1. Récupérer le nouveau PAT depuis 1Password (`op item get "GitHub Personal Access Token" --vault "KiloClaw" --fields identifiant --reveal`).
  2. Mettre à jour l'URL du remote : `git remote set-url origin "https://x-access-token:<TOKEN>@github.com/rez0/kiloclaw-workspace.git"`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

### 1. Token GitHub Expiré ou Invalide
- **Symptôme** : Échec silencieux du `git push` lors de la sauvegarde hebdomadaire, erreur HTTP 401.
- **Cause** : Le Personal Access Token (PAT) GitHub stocké dans l'URL du remote était périmé.
- **Solution** : 
  1. Récupérer le nouveau PAT depuis 1Password (`op item get "GitHub Personal Access Token" --vault "KiloClaw" --fields identifiant --reveal`).
  2. Mettre à jour l'URL du remote : `git remote set-url origin "https://x-access-token:<TOKEN>@github.com/rez0/kiloclaw-workspace.git"`.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs operators to reveal a GitHub PAT from 1Password and place it directly into a Git remote URL. Embedding secrets in command lines and repository configuration can leak them via shell history, process inspection, Git config, logs, screenshots, or accidental sharing, enabling repository compromise.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs copying a live Asana token into a persistent plaintext file under the user's home directory. Plaintext token storage materially increases the risk of theft through local compromise, backups, sync tools, permissive file permissions, or later accidental inclusion in archives and repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives operational instructions for retrieving and using live GitHub and Asana tokens but does not warn about credential exposure, shell history leakage, or secure handling requirements. In this context, the absence of safety guidance increases the chance that operators will expose secrets in remotes, logs, process arguments, or persistent files.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- **Solution** : 
  1. Récupérer le nouveau PAT depuis 1Password (`op item get "GitHub Personal Access Token" --vault "KiloClaw" --fields identifiant --reveal`).
  2. Mettre à jour l'URL du remote : `git remote set-url origin "https://x-access-token:<TOKEN>@github.com/rez0/kiloclaw-workspace.git"`.
  3. **Prévention** : Ajouter une vérification de santé du token (`curl -s -H "Authorization: token $TOKEN" https://api.github.com/user`) dans le script de backup avant toute opération Git.

### 2. Token Asana Désynchronisé
- **Symptôme** : Les tâches Asana assignées à KiloClaw ne sont pas traitées, erreur `401 Not Authorized` lors de l'appel API.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and most operational guidance are written in French, which can amount to an implicit language constraint for users who do not understand that locale. Under the policy, language-specific behavior should either provide user choice or clearly document and justify the locale limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document describes automated backup behavior, JSON state edits, .gitignore changes, and cron reconfiguration without clearly warning that these actions modify repositories and local system state. This can lead to unintended commits, state corruption, or scheduling changes by users who treat the skill as informational rather than operational.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.