Halo Cli Auth

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:47 AM UTC
• Version: 0.1.1

Overview

This is a simple Halo CLI authentication guide, with the main caution that its examples place real passwords or tokens on the command line if copied literally.

Before installing, confirm you trust the Halo CLI you are using and prefer secure login methods such as an interactive prompt, stdin, or another non-history mechanism if supported. If you must use the documented flags, avoid shared systems and logs, disable command tracing, and rotate any token or password that may have been recorded.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Authentication Secrets Exposed Through Command-Line Arguments

Content

View full analysis

``` ```bash halo auth login \ --profile local \ --url http://127.0.0.1:8090 \ --auth-type basic \ --username admin \ --password ``` ```bash halo auth login --profile production --url https://halo.example.com --auth-type bearer --token ``` ### Technical Analysis The documented workflows instruct users to replace placeholders with bearer tokens or passwords supplied directly as command-line arguments. Command-line secrets can be exposed through: - Shell history files. - Process listings and process-monitoring utilities. - Terminal session recording. - Diagnostic or audit logs that capture executed commands. - Automation logs and continuous integration output. - Error reports containing reconstructed command lines. Although the examples contain placeholders rather than actual credentials, their recommended substitution pattern encourages insecure handling of real secrets. Storage in a system keyring after authentication does not prevent exposure while the login command is being entered or executed. ### Attack Path 1. A user follows the documented workflow and replaces `` or `` with a valid secret. 2. The shell records the command in its history, or a monitoring mechanism captures the process arguments. 3. An attacker with access to the affected user account, history file, process metadata, terminal recording, automation log, or diagnostic archive retrieves the secret. 4. The attacker submits the recovered credential to the corresponding Halo instance. 5. The attacker performs actions permitted by the compromised Halo account until the credential expires or is revoked. This path requires local, logg ...[truncated 684 chars]

Remediation

View remediation

`. 4. Do not place literal credentials in documentation, scripts, shell history, environment files, or continuous integration logs. 5. If command-line arguments are the CLI's only supported input mechanism: - Add a prominent warning explaining the process-list, history, and logging risks. - Recommend temporarily disabling shell history or using a leading-space history exclusion where reliably supported. - Ensure command tracing such as `set -x` is disabled. - Avoid shared systems while entering credentials. 6. Continue storing persistent secrets in the system keyring with access restricted to the appropriate operating-system user. 7. Instruct users to revoke and rotate any credential accidentally entered into a recorded command line. 8. Consider enhancing the Halo CLI with `--token-stdin`, `--password-stdin`, or secure interactive prompting if those facilities are not currently available. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.