Security audit

Wine Archive

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent wine archive, but its import/export and Telegram label paths can expose arbitrary local files after a crafted import.

Review before installing. Do not import wine archives from untrusted sources, and avoid using --include-images or Telegram label sending until image paths are constrained to the label directory. If enabling LLM classification, assume message text may go to a model provider and be stored locally in an interaction log. Protect exported archive files because they can contain personal history and embedded label images.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/wine-import.js:123
Finding: Arbitrary Local-File Disclosure Through Unrestricted Label Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wine-import.js:123
Finding: Unbounded Base64 Image Decoding Enables Memory and Disk Exhaustion
Content: View full analysis
0; ``` ### Technical Analysis The importer imposes no limits on: - Input archive size - Number of image entries - Length of each Base64 string - Total decoded byte count - Number of wine or instance records - Allowed image formats `fs.readFileSync` loads the complete JSON archive into memory. JSON parsing creates additional in-memory string and object representations. `Buffer.from(entry.data, 'base64')` then allocates another buffer for the decoded bytes, and `writeFileSync` writes those bytes without a storage quota. A malicious or accidentally oversized archive can therefore consume substantial memory, block the Node.js event loop, fill the label storage volume, or terminate the p ...[truncated 1404 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: shared/interaction-store.js:105
Finding: Full LLM Prompts and Responses Are Persisted Without Retention Controls
Content: View full analysis
{ try { ensureDb(); insertStmt.run(payload); } catch (error) { console.error('[interaction-store] Failed to log LLM call:', error); } }); } ``` ### Technical Analysis When LLM intent classification is e ...[truncated 2024 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
bash
npm install npm run wine:init cp .env.example .env # Edit .env and add your ANTHROPIC_API_KEY if desired

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features

text
Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features

text
Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.sh (reported line 40)May include surrounding context.
sh
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features ``` Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.sh (reported line 42)May include surrounding context.
sh
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features ``` Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.sh (reported line 44)May include surrounding context.
sh
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features ``` Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.sh (reported line 47)May include surrounding context.
sh
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features ``` Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · shared/anthropic-provider.js (reported line 48)May include surrounding context.
js
cd skills/wine-archive npm install npm run wine:init cp .env.example .env # add ANTHROPIC_API_KEY for LLM features ``` Data is stored in `data/wine/wine.sqlite3` and label images in `data/wine/labels/`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
and adapt `lib/wine-store.js` `normalizeImageInPlace` for cross-platform resizing).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.
md
- **Node.js >= 22** required (`node:sqlite` built-in used in `shared/interaction-store.js`).

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.sh (reported line 41)May include surrounding context.
sh
node scripts/wine-service.js init # 5. Copy .env.example → .env if not already present if [[ ! -f ".env" ]]; then cp .env.example .env echo "" echo "Created .env from .env.example — add your ANTHROPIC_API_KEY if you want LLM features."

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · shared/anthropic-provider.js (reported line 15)May include surrounding context.
js
let smokeTestPromise = null; let cachedClient = null; function parseDotEnv(dotEnvPath = path.resolve(process.cwd(), '.env')) { if (!fs.existsSync(dotEnvPath)) return {}; const raw = fs.readFileSync(dotEnvPath, 'utf8'); const result = {};

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Telegram bridge section shows how to send wine information and labels to Telegram chats but does not warn users that message contents and attached label images leave the local system and are shared with Telegram recipients and infrastructure. Because the skill stores personal tasting history and archived label images, this omission can lead to unintentional disclosure of private data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README explicitly documents optional LLM intent classification but does not warn that user-provided wine notes and recall/chat text may be transmitted to a third-party model provider such as Anthropic or OpenAI. This can expose personal consumption history, purchase locations, and label-derived text to external services without informed user consent, creating a privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The export feature can produce a portable archive of personal tasting history and, with --include-images, embed label photos as base64. The skill documents the mechanics but does not clearly warn that this increases the sensitivity, portability, and accidental sharing risk of the resulting file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The Telegram bridge sends messages and media through an external messaging channel, which changes the trust boundary and may disclose archived label images or related content to third-party infrastructure or unintended recipients. The documentation describes how to send media but does not prominently warn users about the external transmission and recipient targeting risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The function sends raw user message content to an external LLM service via runner(prompt, ...), and the prompt explicitly embeds the full message text. Even though this is for intent classification, the code provides no indication of consent, minimization, redaction, or disclosure controls, so sensitive user content could be transmitted off-system unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The package description at L04 frames the skill as a local archive and recall tool for wine data. The additional scripts for a Telegram bridge and sending labels over Telegram at L16-L17 introduce external messaging/integration capability that is not justified by that stated purpose and goes beyond an obvious implementation detail of storage or natural-language recall.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The remove command performs a destructive delete via deleteWineEntry(Number(args.id)) and immediately reports success, but there is no confirmation prompt, cautionary message, or other user disclosure around the irreversible action. For a code file, destructive operations should include some visible warning unless the warning is provided elsewhere in accompanying markdown, which is not present in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code persistently logs full LLM prompts, responses, and errors to a local SQLite database, which can capture sensitive user inputs, model outputs, secrets, proprietary data, or personal information. Although some secret patterns are redacted, the redaction is incomplete and best-effort only, so sensitive data may still be stored without user awareness or consent, increasing privacy and data exposure risk if the host is compromised or logs are accessed by other local users/processes.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 22)May include surrounding context.
json
"wine:import": "node scripts/wine-import.js" }, "dependencies": { "@anthropic-ai/sdk": "^0.55.0", "better-sqlite3": "^11.8.1" }, "engines": {

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 23)May include surrounding context.
json
}, "dependencies": { "@anthropic-ai/sdk": "^0.55.0", "better-sqlite3": "^11.8.1" }, "engines": { "node": ">=22"

Static analysis

No suspicious patterns detected.