Recreation Information Database Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward campground-search CLI with expected network calls and a scoped RIDB API key, but users should avoid passing the API key on the command line.

Install only if you are comfortable sending campsite search coordinates to RIDB and location-name queries to OpenStreetMap/Nominatim. Set RIDB_API_KEY in the environment instead of using --api-key, and avoid putting home addresses or other sensitive exact locations into --location when latitude/longitude would suffice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.py:131

Finding

RIDB API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py, lines 131 and 160–166
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--api-key", help="RIDB API key (or set RIDB_API_KEY)")

python

result = search_facilities(
    lat=lat,
    lon=lon,
    radius=args.radius,
    limit=args.limit,
    activity=activity,
    api_key=args.api_key,
)

Technical Analysis

The CLI permits users to provide the RIDB API key through the --api-key argument. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through:

• Shell history files
• Process inspection utilities and process metadata
• Audit or endpoint-monitoring systems
• CI/CD job logs
• Terminal recordings and copied command transcripts
• Wrapper scripts or orchestration platforms that record invocation arguments

The implementation also supports RIDB_API_KEY, which is preferable, but the presence and documentation of the command-line option encourage an insecure credential-handling path.

The outbound use of the key itself is consistent with the Skill's declared functionality: it is transmitted in an HTTP header over HTTPS only to the documented RIDB endpoint. No evidence was found that the key is sent to Nominatim or any undisclosed host.

Attack Path

1. A user invokes the tool with python scripts/search.py --api-key SECRET and supplies search parameters.
2. The complete invocation is retained in shell history, automation logs, or terminal recordings, or is temporarily visible through local process inspection.
3. Another local principal, administrator, monitoring service, or person with access to those records extracts SECRET.
4. The party uses the recovered credential to make authenticated RIDB requests under the victim's API identity.

Exploitation requires acc ...[truncated 588 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option and obtain the credential from RIDB_API_KEY.
2. For interactive use, optionally support a non-echoing prompt through getpass.getpass() when the environment variable is absent.
3. For automation, support a credential store or a permission-restricted secret file rather than exposing the value in process arguments.
4. Do not include credential values in exceptions, debug messages, telemetry, or logs.
5. Update README.md, SKILL.md, and CLI help to demonstrate only secure credential-loading methods.
6. If backward compatibility requires retaining --api-key, deprecate it, emit a prominent warning, and advise users to rotate any key previously exposed through command history or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tainted flow: 'req' from os.environ.get (line 91, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search.py (reported line 39)May include surrounding context.

python

"User-Agent": "ridb-search/1.0 (camping availability checker)"
    })
    
    with urllib.request.urlopen(req, timeout=10) as resp:
        data = json.loads(resp.read().decode())
    
    if not data:

Tainted flow: 'req' from os.environ.get (line 91, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search.py (reported line 96)May include surrounding context.

python

"Accept": "application/json",
    })
    
    with urllib.request.urlopen(req, timeout=30) as resp:
        return json.loads(resp.read().decode())

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs users to set and rely on an environment variable containing an API key and explicitly describes network-backed behavior, but it does not declare any tool scope or permissions boundaries. In an agent ecosystem, this creates an authorization mismatch: the skill may be able to access secrets and make outbound requests without transparent, least-privilege declarations, increasing the risk of unintended secret exposure or unauthorized network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The geocoding function transmits raw user-provided location text to a third-party service without an explicit warning or consent step. While this is core functionality and not malicious, location queries can contain sensitive personal information such as home addresses, making this a real privacy issue rather than a code-execution flaw.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.