ClawHub
Back to skill

Security audit

Sentio Platform

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Sentio administration helper, but it gives an agent access to live project operations and credentials without enough safety boundaries.

Review before installing. Use only narrowly scoped Sentio credentials, avoid pasting API keys or bearer tokens into chat or command lines, prefer a safer login or secret mechanism if available, pin the Sentio CLI version, and require explicit confirmation before deletes, processor activation, pause/stop, public SQL sharing, or account-link actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Execution of an Unpinned npm CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8 and 12–13
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

text
Use `npx @sentio/cli@latest` for SQL, data queries, alerts, endpoints, and project management.

## Setup

1. Check login status: `npx @sentio/cli@latest login --status`
2. If not logged in, ask the user for api key and run: `npx @sentio/cli@latest login --api-key <key>`

Technical Analysis

The Skill directs the Agent to execute npx @sentio/cli@latest. The latest tag is mutable and does not identify a specific reviewed package version. Depending on the local npm cache and configuration, npx may download the package from the configured npm registry and immediately execute it.

Consequently, the code that runs can change after this Skill has been audited. Compromise of the package publisher, npm account, release pipeline, registry, or package itself could cause future invocations to execute attacker-controlled code. The risk is elevated because the same process may have access to Sentio credentials, project files, environment variables, and the user account's local permissions.

This is primarily a third-party supply-chain weakness rather than evidence that the currently documented Sentio package is malicious.

Attack Path

  1. An attacker compromises the npm package, publisher credentials, release process, or distribution channel for @sentio/cli.
  2. The attacker publishes a malicious release and assigns or causes it to receive the latest tag.
  3. A user or Agent follows the Skill and invokes npx @sentio/cli@latest.
  4. npx retrieves and executes the changed package.
  5. The malicious package runs with the invoking account's permissions and may read credentials, environment variables, or accessible project files before transmitting or modifying them.

Impact Assessment

Successful exploitation could permit arbitrary code execution wi ...[truncated 326 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed version such as @sentio/cli@X.Y.Z.
  • Manage the CLI through a project manifest and lockfile rather than downloading a mutable release at execution time.
  • Verify package provenance and registry integrity before installation.
  • Use npm integrity metadata and an approved package registry or mirror where feasible.
  • Review new versions before updating the pinned dependency.
  • Run the CLI with only the filesystem, network, and credential access needed for the requested Sentio operation.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:13
Finding

API Keys and Bearer Tokens Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13 and lines 152–153
Vulnerability Type: Sensitive credentials exposed through command arguments
Risk Level: Medium

text
2. If not logged in, ask the user for api key and run: `npx @sentio/cli@latest login --api-key <key>`
text
- All commands accept `--api-key <key>` or use saved credentials from `sentio login`.
- All commands accept `--token <token>` for bearer token auth.

Technical Analysis

The Skill explicitly tells the Agent to request an API key from the user and place it in a command-line argument. It also advertises equivalent --api-key and --token options for all commands.

Command-line secrets may be exposed through shell history, process listings, terminal capture, command telemetry, CI logs, Agent execution traces, crash reports, or audit systems. Requesting a credential in conversational context can additionally place the secret in chat history and associated logging or retention systems.

Authentication is necessary for the declared Sentio administration functionality, but placing raw credentials in chat and process arguments is not the minimum-exposure authentication mechanism.

Attack Path

  1. The Agent asks the user to provide a Sentio API key or bearer token.
  2. The user submits the secret in the conversation.
  3. The Agent interpolates the secret into a command using --api-key or --token.
  4. The conversation, command, shell history, process metadata, terminal output, or execution telemetry records the value.
  5. A local user, log operator, compromised monitoring system, or other party with access to those records retrieves the credential.
  6. The attacker authenticates to Sentio and performs operations authorized by that credential.

Impact Assessment

Exposure may allow unauthorized access to Sentio resources within the credential's scope. Based on the documented Skill capabilit ...[truncated 448 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not ask users to paste API keys or bearer tokens into conversational context.
  • Prefer an authenticated login flow with hidden interactive input, operating-system credential storage, or another secret manager supported by the CLI.
  • If environment-based authentication is supported, inject the secret only for the child process and prevent it from appearing in generated commands or logs.
  • Avoid command-line credential flags because arguments may be observable by other processes and telemetry systems.
  • Redact credentials from Agent traces, terminal output, errors, audit logs, and diagnostic bundles.
  • Use narrowly scoped, short-lived credentials and rotate any secret that may already have been exposed.
  • Require explicit confirmation before destructive project operations and ensure the credential has only the permissions necessary for the requested task.

T09 · Insecure Skill Coding Practices

Warning
Location
references/openapi.swagger.json:9966
Finding

API Specification Allows Authentication Credentials in Query Strings

Content
View full analysis

Vulnerability Details

File Location: references/openapi.swagger.json, lines 9966–9983
Vulnerability Type: API key transmission through URL query parameters
Risk Level: Medium

json
"securityDefinitions": {
  "ApiKeyHeaderAuth": {
    "type": "apiKey",
    "name": "api-key",
    "in": "header"
  },
  "ApiKeyQueryAuth": {
    "type": "apiKey",
    "name": "api-key",
    "in": "query"
  }
},
"security": [
  {
    "ApiKeyHeaderAuth": []
  },
  {
    "ApiKeyQueryAuth": []
  },
  {
    "": []
  }
]

Technical Analysis

The Swagger specification defines ApiKeyQueryAuth as a global authentication alternative, permitting an API key to be sent as the api-key URL query parameter. Although the API uses HTTPS, query parameters remain vulnerable to exposure in application and proxy logs, monitoring platforms, browser history, copied URLs, error reports, and other systems that record complete request URLs.

Header-based API-key authentication is already defined in the same specification and provides a lower-exposure alternative. Therefore, query-string authentication exceeds the minimum necessary credential exposure for the declared remote API functionality.

The empty global security entry may also imply unauthenticated access as an alternative in Swagger 2.0 tooling. Whether the server actually permits such access was not established by the static files, so it is not independently reported as a confirmed access-control vulnerability.

Attack Path

  1. A client generator or custom integration follows the Swagger definition and selects ApiKeyQueryAuth.
  2. The client sends a request such as https://api.sentio.xyz/...?...&api-key=SECRET.
  3. A proxy, gateway, application server, monitoring product, browser, or diagnostic system records the full URL.
  4. A party with access to the recorded URL obtains the API key.
  5. The party reuses the key against the Sentio API ...[truncated 564 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove ApiKeyQueryAuth from securityDefinitions and from all global or operation-level security alternatives.
  • Require the existing ApiKeyHeaderAuth mechanism over HTTPS.
  • Update generated clients, examples, and documentation to prohibit credentials in URLs.
  • Configure gateways, proxies, application servers, and observability systems to redact the api-key query parameter during migration.
  • Rotate credentials previously used in query strings if URL logging may have occurred.
  • Prefer short-lived, narrowly scoped tokens where the platform supports them.
  • Review the empty global security alternative and explicitly mark only genuinely public operations as unauthenticated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
When constructing or editing `dashboard.json` for import, refer to `references/openapi.swagger.json` for the full schema. Key structure:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
When constructing or editing `dashboard.json` for import, refer to `references/openapi.swagger.json` for the full schema. Key structure:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
When constructing or editing `dashboard.json` for import, refer to `references/openapi.swagger.json` for the full schema. Key structure:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/openapi.swagger.json (reported line 5)May include surrounding context.

json
{
  "swagger": "2.0",
  "info": {
    "title": "Sentio API",
    "description": "Sentio Open API",
    "version": "version not set"
  },
  "host": "api.sentio.xyz",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "paths": {
    "/v1/ai/chat": {
      "post": {
        "summary": "Create Chat Session",
        "description": "Initialize a new AI chat session. Returns a session_id that can be used with PostSessionMessage to have a conversation with the AI. Messages are generated as part of runs, with is_final indicating run completion.",
        "operationId": "CreateChatSession",

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Fork, simulation, and transaction-trace endpoints provide powerful blockchain debugging and execution-analysis capabilities that are materially broader than the declared scope of project modification and dashboard/alert management. Such capabilities can be abused to analyze transactions, probe contract behavior, or manipulate simulation environments in ways a user would not expect from this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The account-link session endpoint is unrelated to normal Sentio project management tasks and can initiate identity/account binding workflows. Including identity-affecting functionality in a broader project-management skill creates an unnecessary privilege surface and raises the risk of unauthorized account linking or social-engineering-assisted misuse.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to ask for an API key and pass it directly on the command line, and later notes bearer-token usage, without any warning about secret handling. In practice this can expose credentials through terminal history, logs, telemetry, screenshots, or process inspection, making credential compromise more likely in an agent-mediated workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents destructive operations such as alert, endpoint, and project deletion without requiring confirmation, backup, scope validation, or explicit user approval. In an agent setting, this increases the chance of accidental or over-broad destructive actions against live resources, especially when the agent is following natural-language requests that may be ambiguous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill includes processor lifecycle commands such as activate, pause, resume, and stop with no warning about production impact or requirement for change confirmation. In this context, these commands can directly disrupt monitoring, data ingestion, and operational visibility for a live project, so omission of safeguards materially increases operational risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is described as focused on Sentio project building, SQL, alerts, and dashboards, but the OpenAPI spec also exposes a general AI chat subsystem that can create sessions, post messages, and retrieve model outputs. That expands the agent’s reachable capability surface beyond the declared purpose, increasing the chance of prompt-injection chaining, unintended data handling, or misuse through undocumented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The SQL sharing operation can make queries publicly accessible, yet the spec does not prominently warn that query text, embedded logic, and potentially sensitive project context may be exposed to others. In an agentic setting, weak disclosure around public sharing increases the chance of accidental data exposure through autonomous or user-misunderstood actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This DELETE operation removes a refreshable materialized view, but the description gives no indication of whether the removal is destructive, irreversible, or affects dependent workflows. Users need an explicit warning when an API action can delete stored analytical objects or disrupt downstream usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This manifest documents a DELETE operation for dashboards but provides only a brief summary and no warning that it removes user-created dashboard data or whether deletion is reversible. For manifest files, destructive behaviors that can affect user data should be explicitly disclosed so users understand the risk before invoking the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Coin and price management APIs are adjacent to analytics but are not clearly justified by the skill manifest, especially operations that add coins or manage price-related resources. This mismatch broadens the reachable functionality and can expose users to unintended state changes or data-sharing behaviors outside the expected project-management workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Activating a pending processor version changes live runtime behavior and can materially affect indexed data, alerts, and downstream dashboards. Without a clear warning in the API contract, an agent or operator may trigger a production-impacting state change without adequate awareness or validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The API includes a DELETE operation for forks but does not warn that the action removes a stored fork resource and may not be reversible. Because this can destroy user-managed simulation state or configuration, the manifest should explicitly communicate the deletion risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The AutoConfig flag allows automatically executing generated queries, enabling the AI subsystem to move directly from suggestion to action. In a skill that already has broad data and project-management access, this creates an agentic execution path that can amplify prompt injection, unintended resource consumption, or accidental exposure without a human review checkpoint.

Content

Scanner excerpt · references/openapi.swagger.json (reported line 3486)May include surrounding context.

json
"properties": {
        "executeQuery": {
          "type": "boolean",
          "title": "Whether to automatically execute generated queries (SQL or Insight)"
        }
      },
      "title": "AutoConfig contains configuration specific to Auto scenarios"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

Automatically executing AI-generated insight queries permits the model to trigger analytics operations without separate confirmation. Because this skill includes access to project metrics, logs, and dashboards, that autonomy increases risk of unintended expensive queries, exposure of sensitive operational data, or misuse driven by adversarial prompts.

Content

Scanner excerpt · references/openapi.swagger.json (reported line 3623)May include surrounding context.

json
"properties": {
        "executeQuery": {
          "type": "boolean",
          "title": "Whether to automatically execute generated Insight queries"
        }
      },
      "title": "InsightConfig contains configuration specific to Insight scenarios"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

Automatically executing AI-generated SQL is especially risky because SQL can access, transform, and potentially expose broad project data, and may also interact with saved/sharing workflows elsewhere in the spec. In the context of this skill, autonomous SQL execution meaningfully increases the blast radius of prompt injection or model mistakes.

Content

Scanner excerpt · references/openapi.swagger.json (reported line 3787)May include surrounding context.

json
"properties": {
        "executeQuery": {
          "type": "boolean",
          "title": "Whether to automatically execute generated SQL queries"
        }
      },
      "title": "SqlConfig contains configuration specific to SQL scenarios"

Static analysis

No suspicious patterns detected.