Willow System Health

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:07 AM UTC
• Version: 1.0.0

Overview

This skill is a local Willow health checker whose service checks and reports are coherent with its stated purpose, though it exposes a default local Postgres DSN that users should review.

Use this only on a Willow local AI stack you control. Review the default Postgres credential handling before installing in shared or production-like environments, and require confirmation before following any suggested cleanup such as deleting worktrees, removing models, or running VACUUM.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/system_health.py:46

Finding

Hard-Coded PostgreSQL Credentials Exposed in Source Code and Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/system_health.py, lines 46, 99–102, 270–272, and 376–378
Vulnerability Type: Hard-coded credentials and plaintext credential exposure
Risk Level: Medium

Vulnerable Code

python

# Postgres connection (Willow defaults)
PG_DSN = "postgresql://willow:willow@localhost:5432/willow"

python

result = subprocess.run(
    ["python3", "-c",
     f"import psycopg2; c=psycopg2.connect('{PG_DSN}'); c.close(); print('ok')"],
    capture_output=True, text=True, timeout=6,
)

python

result = subprocess.run(
    ["psql", PG_DSN, "-t", "-c",
     "SELECT COUNT(*) FROM knowledge_atoms WHERE domain != 'archived';"],
    capture_output=True, text=True, timeout=10,
)

python

result = subprocess.run(
    ["psql", PG_DSN, "-t", "-A", "-F", "\t", "-c", query.strip()],
    capture_output=True, text=True, timeout=15,
)

Technical Analysis

The script embeds a PostgreSQL username and password directly in its source code through the PG_DSN constant. Anyone able to read the distributed Skill files can recover the credentials without needing to compromise a secret store or privileged configuration.

The complete DSN is also interpolated into a child Python process and passed directly as an argument to psql. Depending on the operating system and process-monitoring configuration, command-line arguments may be visible to other local users, monitoring agents, crash diagnostics, audit logs, or process inspection utilities. This expands exposure beyond users who can read the source file.

Although the database is configured on localhost, local-only accessibility does not eliminate the vulnerability. Any untrusted process, compromised local account, or code execution primitive on the same host could attempt to reuse the credentials. Risk increases if the default credentials are retained in production, the PostgreSQL service listens o ...[truncated 1619 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the password-bearing DSN from source code and repository history.
2. Prefer PostgreSQL peer authentication for local diagnostics where deployment constraints permit it.
3. Alternatively, use a protected .pgpass file with permissions restricted to the owning user, or obtain the DSN from an approved runtime secret manager.
4. Do not place passwords in command-line arguments. Configure psql through a service definition, protected connection file, or another mechanism that does not expose secrets in process listings.
5. Replace known default credentials and require installation-specific, randomly generated credentials.
6. Create a dedicated diagnostic database role with only the minimum read permissions required for the health queries. Do not grant schema modification, role management, database creation, or superuser privileges.
7. Restrict PostgreSQL to the necessary local interface and enforce appropriate host-based authentication rules in pg_hba.conf.
8. Rotate the exposed credential after deploying the fix, because removing it from current source does not invalidate previously distributed copies.
9. Review repository history, logs, monitoring data, and deployment artifacts for additional copies of the DSN.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

| Store collections WARN (>150) | Run `python3 scripts/system_health.py --check daily --json` for detail |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to run local shell commands and interact with network-reachable services such as Postgres, Ollama, and an MCP server, but it declares no explicit tool scope or permissions boundary. Without a restrictive allowlist, an agent framework may grant broader-than-necessary shell or network access, increasing the chance of unintended command execution or abuse if the skill is triggered in the wrong context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 99)May include surrounding context.

python

def check_postgres() -> Check:
    try:
        result = subprocess.run(
            ["python3", "-c",
             f"import psycopg2; c=psycopg2.connect('{PG_DSN}'); c.close(); print('ok')"],
            capture_output=True, text=True, timeout=6,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 107)May include surrounding context.

python

if result.returncode == 0 and "ok" in result.stdout:
            return Check("Postgres", HEALTHY, "connection ok")
        # Try pg_isready as fallback
        r2 = subprocess.run(
            ["pg_isready", "-d", "willow", "-U", "willow"],
            capture_output=True, text=True, timeout=6,
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 157)May include surrounding context.

python

if not repo_path.exists():
        return Check("Orphaned forks", SKIP, f"repo path not found: {repo_path}")
    try:
        result = subprocess.run(
            ["git", "worktree", "list", "--porcelain"],
            capture_output=True, text=True, timeout=10, cwd=str(repo_path),
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 414)May include surrounding context.

python

if not repo_path.exists():
        return Check("Orphaned forks", SKIP, f"repo path not found: {repo_path}")
    try:
        result = subprocess.run(
            ["git", "worktree", "list", "--porcelain"],
            capture_output=True, text=True, timeout=10, cwd=str(repo_path),
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 231)May include surrounding context.

python

# Fallback: willow CLI
    try:
        result = subprocess.run(
            ["python3", "-m", "willow.cli", "task", "list", "--json"],
            capture_output=True, text=True, timeout=10,
            cwd=str(Path("~/github/willow-1.9").expanduser()),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 270)May include surrounding context.

python

# Fallback: direct psql count
    try:
        result = subprocess.run(
            ["psql", PG_DSN, "-t", "-c",
             "SELECT COUNT(*) FROM knowledge_atoms WHERE domain != 'archived';"],
            capture_output=True, text=True, timeout=10,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/system_health.py (reported line 376)May include surrounding context.

python

LIMIT 5;
"""
    try:
        result = subprocess.run(
            ["psql", PG_DSN, "-t", "-A", "-F", "\t", "-c", query.strip()],
            capture_output=True, text=True, timeout=15,
        )

Static analysis

No suspicious patterns detected.