openproof-skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:34 PM UTC
• Version: 1.2.1

Overview

This is a purpose-aligned OpenProof publishing CLI, but users should understand it stores an API token locally and uploads chosen document contents to OpenProof.

Install only if you intend to publish research to OpenProof. Treat ~/.openproof-token as a sensitive credential, review any file before running openproof publish on it, and avoid running template downloads in a directory where article-template.md or paper-template.tex already contains work you need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:49

Finding

API Token Stored Without Explicitly Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 49-52
Vulnerability Type: Insecure local credential storage
Risk Level: Medium

Vulnerable Code:

js

function saveToken(token) {
  fs.writeFileSync(TOKEN_FILE, token);
  console.log(`✅ Token saved to ${TOKEN_FILE}`);
}

Technical Analysis

The API token returned during agent registration is written to ~/.openproof-token without an explicit file mode. Consequently, the resulting permissions depend on the process environment and operating-system umask. Under permissive settings, the credential file may be readable by other local users.

The token is subsequently placed in the bearer authorization header for authenticated publication requests. A local user who obtains this token could therefore impersonate the registered agent when interacting with the OpenProof API.

Attack Path

1. A victim runs openproof register, causing the API token to be saved in ~/.openproof-token.
2. The process has a permissive umask, resulting in a token file readable by another local account.
3. A local attacker reads the contents of that file.
4. The attacker submits requests to the OpenProof API using the stolen token as a bearer credential.
5. The attacker may publish content under the victim's registered agent identity, subject to the privileges associated with that token.

Impact Assessment

Exploitation requires local access and file-read permissions resulting from permissive file creation settings. It does not directly grant operating-system privilege escalation. However, it can compromise the victim's OpenProof identity and allow unauthorized authenticated API actions, particularly publication under that identity.

Remediation

View remediation

Remediation Suggestions

Create the token file with owner-only permissions and verify its state before using it:

js

function saveToken(token) {
  fs.writeFileSync(TOKEN_FILE, token, {
    encoding: 'utf8',
    mode: 0o600
  });
  fs.chmodSync(TOKEN_FILE, 0o600);
  console.log(`✅ Token saved to ${TOKEN_FILE}`);
}

Additionally:

• Inspect the destination with lstat and reject symbolic links before writing.
• Where compatible with the intended registration workflow, use exclusive creation to prevent unintended replacement.
• Validate and correct the permissions of existing token files before reading them.
• Avoid printing the token beyond the already truncated registration message.
• Document that the token is a sensitive bearer credential and provide a secure token-revocation procedure.

T09 · Insecure Skill Coding Practices

Note

• Location: index.js:169

Finding

Template Downloads Overwrite Existing Local Files Without Confirmation

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 169-174
Vulnerability Type: Unsafe file overwrite
Risk Level: Low

Vulnerable Code:

js

res.on('end', () => {
    fs.writeFileSync(filename, body);
    console.log(`✅ Saved to ${filename}`);
});

Technical Analysis

The template command writes the downloaded response to a fixed filename in the current working directory:

• article-template.md
• paper-template.tex

fs.writeFileSync uses truncating write behavior by default. If a file with the selected name already exists, its contents are replaced without warning or confirmation.

The filenames are fixed rather than attacker-controlled, and the user must explicitly invoke the template command. This limits the issue's severity, but running the command in a directory containing a valuable file with the same name can cause data loss.

Attack Path

1. A user has an existing article-template.md or paper-template.tex file in the current working directory.
2. The user invokes openproof templates article or openproof templates paper from that directory.
3. The client downloads the template response.
4. fs.writeFileSync truncates and replaces the existing file without requesting confirmation.
5. The prior local content is lost unless recoverable from version control or backups.

Impact Assessment

The impact is confined to overwriting one of two fixed filenames in the invoking user's current directory. This does not grant additional privileges or arbitrary-path write access. The primary consequence is local data loss or disruption of a project file with a matching name.

Remediation

View remediation

Remediation Suggestions

Refuse to overwrite an existing file by using exclusive creation:

js

res.on('end', () => {
  try {
    fs.writeFileSync(filename, body, {
      encoding: 'utf8',
      flag: 'wx'
    });
    console.log(`✅ Saved to ${filename}`);
  } catch (err) {
    if (err.code === 'EEXIST') {
      console.error(`❌ Refusing to overwrite existing file: ${filename}`);
      return;
    }
    throw err;
  }
});

Alternatively, require an explicit --force option before replacing an existing file. The implementation should also report write errors cleanly and consider allowing the user to select a destination path.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose understates the skill's real behavior by omitting additional networked actions, local token persistence, and inconsistencies in claimed publishing support. This mismatch can mislead users into authorizing a skill under false assumptions, which is especially risky because it handles credentials and transmits potentially sensitive research to a remote service.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

The CLI logic is contained in `index.js`. It communicates with `https://openproof.enthara.ai/api`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares an environment dependency and uses a sensitive token, but does not declare an explicit tool scope or permissions model. That makes the skill's effective capabilities less transparent to users and reviewers, increasing the chance that secrets are accessed or used without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill does not clearly warn that registration persists an API key locally and that publishing uploads research content to an external service. In a skill intended for agents handling potentially sensitive data, that omission raises the risk of accidental credential exposure or unintended exfiltration of proprietary or confidential content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code accesses a sensitive credential from process.env.OPENPROOF_TOKEN and from a token file in the user's home directory, and also writes the API token back to disk. While it logs that the token was saved, there is no disclosure that the skill reads credentials from the environment or persists them in a home-directory file, which is relevant sensitive-behavior warning for users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment at L093 states the extension check prevents Local File Inclusion, but the implementation merely restricts file suffixes before reading the provided path. A user can still point the command at arbitrary local files with allowed extensions anywhere on the filesystem, so the documentation overstates the security effect of this check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The publish command reads an arbitrary local document and sends its full contents to a remote service without an explicit privacy or data-transfer warning. In an agent-skill setting, this increases the risk of accidental exfiltration of proprietary, personal, or secret material because the user may not realize the exact file contents are being transmitted off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The downloadTemplate function fetches remote content and writes paper-template.tex or article-template.md into the current working directory. It logs after the operation starts, but there is no advance warning or confirmation that a local file write will occur and may overwrite an existing file.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package description is broad enough to make the skill appear applicable to many agent and research workflows without clearly limiting its intended use. In agent ecosystems, vague descriptions can cause over-invocation or inappropriate trust, which increases the chance that higher-risk capabilities are exposed in the wrong context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.