agentsecrets

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:30 AM UTC
• Version: 1.1.4

Overview

This is a coherent secrets-management integration, but it asks users to trust broad credential automation and unpinned external CLI installs for security-sensitive operations.

Review before installing. Use this only if you trust the AgentSecrets publisher and CLI distribution path, prefer a pinned and verifiable release, keep domain allowlists tight, avoid environment-variable injection for sensitive services when possible, and require explicit user approval before production or global secret changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-25; additional affected instructions at README.md:24-28
Vulnerability Type: Unpinned and unverifiable third-party executable dependencies
Risk Level: Medium

The Skill recommends installing or directly executing the security-critical agentsecrets CLI from mutable package registry references without pinning an exact version or verifying a checksum or signature.

Complete affected code from SKILL.md:22-25:

yaml

- npx @the-17/agentsecrets (Run without install)
- brew install The-17/tap/agentsecrets (macOS/Linux)
- pip install agentsecrets-cli (Python/Universal)
- go install github.com/The-17/agentsecrets/cmd/agentsecrets@v3.0.0 (Go devs - prefer pinned version)

Additional affected installation instructions from README.md:24-28:

bash

brew install The-17/tap/agentsecrets
# or
npm install -g @the-17/agentsecrets
# or
pip install agentsecrets-cli

Technical Analysis

The npm, npx, Homebrew, and Python installation paths resolve mutable package or tap state at installation time. In particular, the npx instruction may download and immediately execute the package version currently published by the external registry. These paths do not specify an exact version and do not require users to verify a cryptographic digest, signature, provenance attestation, or trusted release artifact.

This dependency is security-sensitive because the Skill delegates credential handling and authenticated network activity to the installed executable. The documented capabilities include indirect OS-keychain access, secret synchronization, environment-variable injection, MCP registration, and authenticated API calls. Consequently, the executable operates at a substantially higher trust level than an ordinary utility.

The Go installation command is pinned to v3.0.0, which reduces unintended version drift for that installation path, but the documentation ...[truncated 2399 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin exact versions in every installation command, including npm/npx, pip, and Homebrew workflows. Avoid floating tags and implicit latest-version resolution.
2. Replace direct unpinned npx execution with a pinned package invocation and require verification before first execution.
3. Publish SHA-256 or stronger digests for release artifacts and provide commands that verify them before installation.
4. Use signed releases and document verification of the signing identity and trusted public key.
5. Where supported, provide package provenance attestations and require package-manager integrity or lockfile validation.
6. Prefer a single, audited installation path rather than presenting several independently mutable distribution channels.
7. Pin the Homebrew formula or release artifact rather than relying on the current state of a mutable tap.
8. Pin Python dependencies using exact versions and hashes, such as a requirements file using hash-checking mode.
9. Retain the pinned Go version, but add release signature or checksum verification and periodically review pinned updates.
10. Document a controlled upgrade process that verifies source changes, release provenance, checksums, and security impact before changing the approved version.
11. Run the CLI with the minimum operating-system privileges required and restrict its filesystem, keychain, environment, and network access wherever platform sandboxing permits.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a full secrets-management infrastructure with zero-knowledge handling for AI agents across the credential lifecycle. This specific code chunk does not implement that functionality. Instead, it performs a simple readiness check: confirming the agentsecrets binary exists, checking initialization status, printing suggested commands, and listing secret names. While this is related to the broader product domain, the actual primary purpose of the code is environment validation and user guidance, not managing credentials or enforcing zero-knowledge behavior. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad secrets-management platform that manages the full credential lifecycle while ensuring agents never see secret values. The supplied code chunk does not implement such infrastructure; it is only a passthrough wrapper for invoking agentsecrets call. Its actual behavior is to check that agentsecrets exists, validate inputs superficially, and then execute a network call to a user-provided URL. The wrapper itself does not show credential creation, rotation, revocation, storage management, or any lifecycle features, nor can it substantiate the 'without ever seeing values' guarantee beyond delegating to another binary. Additionally, the manifest indicates network access and audit-log writing, which are concrete behaviors not reflected in the high-level declared purpose. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-health.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# SECURITY MANIFEST
# =================
# Environment variables accessed: None (reads from OS keychain via agentsecrets binary)
# External endpoints called: User-specified API URL only (passed as argument)
# Local files read: None
# Local files written: ~/.agentsecrets/proxy.log (audit trail, key names only, never values)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/secure-call.sh (reported line 6)May include surrounding context.

sh

#!/usr/bin/env bash
# SECURITY MANIFEST
# =================
# Environment variables accessed: None (reads from OS keychain via agentsecrets binary)
# External endpoints called: User-specified API URL only (passed as argument)
# Local files read: None
# Local files written: ~/.agentsecrets/proxy.log (audit trail, key names only, never values)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README makes a strong 'agent never sees the value' claim, but the documented workflow includes authenticated calls and environment injection patterns that necessarily expose usable secret material to a spawned process or runtime context. In an agent skill, this kind of misleading security guarantee is dangerous because operators may trust the tool with high-value credentials under a false assumption about isolation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

agentsecrets secrets diff # detect any drift between local and cloud agentsecrets secrets pull # sync if needed agentsecrets call
--url https://api.stripe.com/v1/balance
--bearer STRIPE_KEY # make the authenticated call agentsecrets proxy logs # audit what happened

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

agentsecrets secrets diff # detect any drift between local and cloud agentsecrets secrets pull # sync if needed agentsecrets call
--url https://api.stripe.com/v1/balance
--bearer STRIPE_KEY # make the authenticated call agentsecrets proxy logs # audit what happened

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends running the CLI via npx @the-17/agentsecrets without a pinned version, which allows whatever package version is current at execution time to be fetched and run. In a secrets-management skill, this is especially risky because a compromised upstream release or dependency could gain code execution in a highly privileged context and interact with local credentials, keychains, or outbound proxy features.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.