Halo Cli Shared

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:14 PM UTC
• Version: 0.1.1

Overview

This skill is a straightforward Halo CLI helper, with expected authentication and install guidance but a supply-chain caution around the unpinned global npm install.

Before installing, verify the `@halo-dev/cli` package source and consider pinning a reviewed version or installing in a controlled environment. Expect Halo authentication to create a local profile and store credentials in your system keyring; only use profiles for Halo instances you trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Remediation

View remediation

``` 2. Document the expected npm registry and verify package provenance before installation, including the publisher, release metadata, and integrity information where available. 3. Establish a controlled update process in which new versions and their transitive dependencies are reviewed before changing the documented version. 4. Avoid running npm installation commands with `sudo`, as root, or through another elevated account. 5. Where practical, install the dependency in an isolated project or controlled environment with a lockfile instead of globally. 6. Consider disabling lifecycle scripts during initial inspection with `--ignore-scripts`, while recognizing that this may prevent legitimate package functionality and is not a substitute for package review. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

- otherwise `$XDG_CONFIG_HOME/halo/config.json`
- otherwise `~/.config/halo/config.json`

Credentials are stored in the system keyring.

## Routing

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

## Shared Rules

- Most command areas require an authenticated profile.
- Use `halo auth login` to create a profile.
- Use `--profile <name>` when more than one profile exists.
- Use `--json` when output is meant for automation or follow-up parsing.
- In non-interactive mode, dangerous commands usually require `--force`.

Static analysis

No suspicious patterns detected.