T03 · Remote Payload Retrieval and Execution
Error
- Location
references/coding-agent-landscape.md:26- Finding
Unverified Remote PowerShell Installer Is Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Credential Safety
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent credential-safety policy, but it under-controls plaintext secret storage and includes an unsafe example that copies credentials into another .env file.
Review this before installing if you store real API keys locally. Use least-privilege tokens, restrict ~/.localcfg/base.env permissions, keep it out of backups and repositories, and avoid the credential-bridge pattern unless you explicitly approve the destination and can ensure the target .env is private, gitignored, and temporary. Do not run the referenced remote PowerShell installer one-liner without independent verification.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:56- Finding
Credential Bridge Persists Secrets to an Unvalidated Plaintext Destination
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The credential-bridging example reads a secret from the central credential store and writes it into another tool's
.envfile in plaintext. Even though the skill warns against logging secrets, this pattern duplicates sensitive material into an additional file, increasing exposure through file permissions, accidental commits, editor history, backups, or downstream tooling that may read or print the.envcontents.- Content
md key = os.getenv("SOME_API_KEY") # 只取当前需要的变量 if key: target_env = Path("/path/to/target/.env") content = target_env.read_text() if "SOME_API_KEY" not in content: target_env.write_text(content + f"\nSOME_API_KEY={key}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to store API keys and tokens in a plaintext file under the home directory, but it does not require restrictive file permissions, encryption, or clear handling warnings. In the context of an agent credential skill, this is more dangerous because the skill explicitly governs secret use, so normalizing plaintext long-lived secret storage can increase exposure to other local processes, backup systems, or overly broad agent access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
1. 创建凭据文件
bash mkdir -p ~/.localcfg创建
~/.localcfg/base.env：
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
1. 创建凭据文件
bash mkdir -p ~/.localcfg创建
~/.localcfg/base.env:
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ### 3. 在 Agent 中安装本 Skill **Claude Code：** 将 `SKILL.md` 放入 `~/.claude/skills/ps/SKILL.md`（或创建软链接）。 **Codex：** 将 `SKILL.md` 放入全局 agents 目录，并参考 `agents/openai.yaml` 配置触发策略。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing skill content is written entirely in Chinese, including the description and operational instructions, with no indication that the user may choose another language. This can violate language/locale policy when a specific language is imposed without opt-in or documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented PowerShell command pipes a remotely fetched script directly into
iex, which executes unverified code from the network without integrity checking, pinning, or user warning. If the install endpoint is compromised, intercepted, or changed, users could execute arbitrary code on their system during installation.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documentation is written entirely in Chinese, including operational setup instructions, with no indication that the user can choose another language or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content