Help Scout

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:22 AM UTC
• Version: 0.0.2

Overview

The skill is a coherent HelpScout CLI wrapper, but it exposes broad write/delete access to support data and sensitive credential/debug paths without enough guardrails.

Install only if you trust the hs CLI source and can constrain the HelpScout credentials it uses. Before agent use, set a restrictive permissions allowlist, prefer read-only scopes where possible, avoid passing secrets directly on the command line, keep PII redaction enabled, do not share raw debug logs, and require explicit human approval for write, delete, webhook, workflow, unredacted, and self-update commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19

Finding

OAuth Client Secret Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Command-line credential exposure
Risk Level: Medium

Vulnerable Code Snippet

markdown

For non-interactive auth, use `hs inbox config set --inbox-app-id <id> --inbox-app-secret <secret>`.

Technical Analysis

The documented non-interactive authentication procedure supplies the HelpScout OAuth client secret as a command-line argument. Depending on the operating system and execution environment, command arguments may be exposed through:

• Shell history files
• Process inspection tools and process metadata
• Terminal session recording
• CI/CD job output or debug logs
• Automation and endpoint-monitoring telemetry

Although the documentation uses the placeholder <secret> rather than embedding a real credential, users following this procedure would replace it with a live secret. This creates an avoidable credential-disclosure path.

Attack Path

1. An administrator follows the documented command and passes a valid HelpScout App Secret through --inbox-app-secret.
2. The command is retained in shell history, captured by process monitoring, or recorded in automation logs.
3. A local user, log reader, monitoring-system operator, or attacker with access to one of these records obtains the App ID and App Secret.
4. The attacker uses the credentials to request HelpScout OAuth access.
5. The attacker accesses HelpScout resources permitted to the associated application.

Successful exploitation requires access to command history, process information, terminal records, or relevant logs.

Impact Assessment

Exposure of the OAuth client credentials may allow unauthorized API authentication with the privileges granted to the HelpScout application. Depending on those privileges and configured CLI permissions, the resulting scope could include access to conversations, customer PII, mailboxes, reports, knowledge-base content, webhooks, and write or delete operatio ...[truncated 141 chars]

Remediation

View remediation

Remediation Suggestions

• Replace command-line secret input with a hidden interactive prompt or protected standard-input mechanism.
• Prefer direct storage in the operating system keyring without first exposing the secret in process arguments.
• For automation, support a restricted-permission secret file, secret-manager integration, or file-descriptor-based input.
• If environment-variable input is supported, document its platform-specific exposure risks and avoid printing environment values in logs.
• Explicitly warn users not to place credentials directly in shell commands, scripts, or CI/CD configuration committed to source control.
• Ensure the CLI suppresses secrets from debug output, errors, telemetry, and configuration-display commands.
• Recommend rotating the App Secret if it has already been entered using the documented command and may have been retained in history or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Advertising a self-update command in an agent skill introduces a self-modification path that can change the tool's code and behavior outside the normal review process. If an agent is allowed to run it, this can bypass pinning, invalidate prior trust assumptions, and potentially pull compromised or unreviewed updates from upstream sources.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

## Notes

- Self-update: `hs update`
- Shell completions: `hs completion bash|zsh|fish|powershell`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents destructive operations such as deleting conversations, customers, organizations, webhooks, and articles without any cautionary guidance, confirmation expectations, or rollback notes. In an agent-executed CLI context, this increases the chance of accidental irreversible actions against production HelpScout data, especially because the skill exposes broad CRUD capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented --debug flag says it shows HTTP request/response details but does not warn that those details may contain OAuth credentials, API keys, authorization headers, customer PII, message bodies, or other sensitive HelpScout data. In a support-data CLI, debug output is particularly risky because logs may be captured by terminals, agents, CI systems, or telemetry.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.