T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/invoke_artifact.mjs:13- Finding
Untrusted Artifact Can Exfiltrate Arbitrary Environment Variables
- Content
View full analysis
- Remediation
View remediation
Security audit
aicade galaxy skills
Security checks for vulnerabilities and agentic risk
Overview
This skill is built for AICADE Galaxy, but its handling of API keys, dynamic artifacts, and logs is broad enough that users should review it carefully before installing.
Install only if you trust the publisher and the AICADE Galaxy endpoint you configure. Use a low-privilege API key, keep debug mode off, verify the base URL is the intended HTTPS AICADE Galaxy service, do not invoke tools from untrusted artifact JSON files, and protect or remove the generated `.env` and logs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_artifact.mjs:47- Finding
API Key Can Be Sent to Arbitrary or Plaintext Destinations
- Content
View full analysis
{ const url = new URL(urlString); const transport = url.protocol === "https:" ? https : http; const request = transport.request( url, { method: "GET", headers, }, ``` The Python implementation similarly sends the key to the configured URL: ```python base_url = env.get("AIC ...[truncated 2064 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_artifact.mjs:102- Finding
Credentials and Sensitive Invocation Data Are Written to Logs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_env.mjs:25- Finding
API Key Input Is Visible and Stored Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an operational integration with AICADE Galaxy for monetization and payment-related platform capabilities. The actual code chunk is only a local bootstrap utility: it reads .env, checks for three required variables, conditionally executes a setup script, and always executes an export script. There is no evidence here of discovering services, invoking gateway tools, processing payments, interacting with blockchain/AicadePoint, managing subscriptions/memberships, or listing platform capabilities. While this bootstrap behavior could support a larger integration, the supplied chunk's primary purpose is materially different from the declared end-user functionality, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises an operational integration with AICADE Galaxy for discovering and calling monetization/payment-related platform tools. The actual code chunk is a setup utility that writes configuration values to .env and prints static notes about a header, a fixed services path, and an output file location. While these details suggest the broader project may later connect to AICADE Galaxy, this code itself does not perform the described platform interactions. Therefore the description materially overstates the behavior of the supplied code chunk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `SKILL.md` does not hardcode the live service list. The latest supported tools come from the exported artifact.
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The artifact controls which environment variable to read and which header name to send, allowing untrusted metadata to exfiltrate arbitrary local secrets to a remote endpoint. Because the skill dynamically invokes external monetization/payment services, this expands the trust boundary significantly and makes credential theft or misuse far more dangerous than a normal fixed-header integration.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js from typing import Dict ENV_PATH = Path(".env") DEFAULTS = { "AICADE_GALAXY_BASE_URL": "https://aicadegalaxy.com/agent",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from typing import Dict ENV_PATH = Path(".env") DEFAULTS = { "AICADE_GALAXY_BASE_URL": "https://aicadegalaxy.com/agent",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js from typing import Dict ENV_PATH = Path(".env") DEFAULTS = { "AICADE_GALAXY_BASE_URL": "https://aicadegalaxy.com/agent",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from typing import Dict ENV_PATH = Path(".env") DEFAULTS = { "AICADE_GALAXY_BASE_URL": "https://aicadegalaxy.com/agent",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js from typing import Dict ENV_PATH = Path(".env") DEFAULTS = { "AICADE_GALAXY_BASE_URL": "https://aicadegalaxy.com/agent",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from typing import Dict ENV_PATH = Path(".env") DEFAULTS = { "AICADE_GALAXY_BASE_URL": "https://aicadegalaxy.com/agent",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 75% confidence
- Finding
The description explicitly states that bootstrap ensures '.env is configured,' indicating the install-time script may read, write, or populate environment-based secrets or sensitive configuration. Performing this during a required bootstrap phase is risky because install-time code can access credentials earlier than necessary, and in a monetization/blockchain/payment-oriented skill the environment may contain API keys, wallet material, or service tokens.
- Content
json "command": ["python3", "scripts/bootstrap.py"] }, "required": true, "description": "Must be executed on first install or first activation. This step ensures .env is configured and exports the latest artifact." }, "export": { "preferred": {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill directs the host to execute shell commands, read/write files, use environment variables, and make networked API calls, yet it declares no explicit permissions or tool scope. That creates an overbroad trust boundary where a host may permit powerful operations without clear least-privilege constraints, increasing the chance of unintended command execution, secret exposure, or unsafe file/network access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list contains broad phrases such as 'ai payments', 'paid api', and 'responsepaths' that could match ordinary user requests and activate the skill unexpectedly. In this skill, accidental activation is more dangerous because first use is instructed to run bootstrap, which may consume API credentials, write files, and contact an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to set API credentials and run bootstrap/export/invoke flows that may contact external services, but it does not clearly warn that data and secrets may be transmitted off-platform. This weakens informed consent and can lead users or host systems to send sensitive parameters, artifacts, or credential-backed requests to a third-party endpoint without adequate review.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_script(command: List[str], label: str) -> None: try: result = subprocess.run(command, check=False) except OSError as exc: raise RuntimeError(f"Failed to run {label}: {exc}") from exc
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
When debug mode is enabled, the code logs the full outbound request headers, including the X-API-Key value. This can expose the API key to console output, CI logs, shared terminals, or log aggregation systems, enabling unauthorized use of the Galaxy admin API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
When debug mode is enabled, the script logs the full request headers, including the X-API-Key value. This can expose live credentials to console output, CI logs, terminal history capture, or centralized log collectors, allowing anyone with log access to reuse the API key against the AICADE Galaxy gateway.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
When debug mode is enabled, the script logs the full invocation payload and full result object, which can include secrets, personal data, payment metadata, API responses, or auth-related fields. In a monetization and payment-oriented skill, these values are especially sensitive, so broad console logging creates a realistic confidentiality risk through terminal history, CI logs, or centralized log collectors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The debug log captures the full request payload before invocation, which may contain payment parameters, account identifiers, API inputs, or other user-supplied sensitive data. Even if intended for troubleshooting, logging complete request bodies without strong safeguards can leak sensitive information to operators, log platforms, or other users of the environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The unconditional console log prints the tool name together with the entire payload for every invocation, regardless of debug mode. This guarantees potential exposure of secrets or sensitive business/payment inputs in normal operation, making it more severe than optional debug-only logging.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Authentication material sourced from environment variables is automatically attached to outbound headers with no user-facing indication, so users may not realize that invoking a tool transmits local credentials to the configured service. In this skill's context of dynamic external services and payment workflows, silent credential transmission materially increases the risk of secret disclosure and unauthorized account actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
When AICADE_GALAXY_DEBUG=true, the script logs the full invocation payload and the full tool result to stdout. Those values can contain sensitive request parameters, payment-related data, API outputs, or other user data, and because this skill is specifically designed to invoke monetization and payment services, such data exposure is more dangerous than in a low-sensitivity context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The debug logger prints complete request payloads and complete response contents without redaction or user warning. In a skill that handles paid APIs, subscriptions, blockchain payments, and dynamic gateway services, these logs may capture financial metadata, user identifiers, service responses, or secrets returned by downstream systems, creating unnecessary data leakage risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The function reads a credential from an environment variable and injects it into an HTTP header for the outgoing request. While this may be intended behavior, the file provides no user-facing warning, comment, or other disclosure that secrets will be read from the environment and sent to a remote service.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The install step is marked required and described as running on 'first install or first activation,' which is broad enough to trigger code execution in more situations than strictly necessary. Because this skill bootstraps by executing local scripts before normal use, an installer or host may run attacker-controlled code earlier than expected, increasing the attack surface during onboarding.
- Content