Keys Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:45 AM UTC
• Version: 0.5.1

Overview

The skill is coherently about local secrets management, but it needs Review because it recommends risky secret exposure patterns and an unpinned third-party CLI that would handle sensitive credentials.

Review this before installing. Only use a pinned, trusted version of the `keys` CLI, avoid `eval $(keys expose)`, avoid printing secrets to terminal output, protect generated .env files with file permissions and .gitignore, and sync secrets only between trusted machines on trusted networks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Secret-Management Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-24 **Vulnerability Type**: Unpinned and unverifiable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown The `keys` CLI must be installed first: ```bash brew install stym06/tap/keys ``` Or with Go: ```bash go install github.com/stym06/keys@latest ``` ``` ### Technical Analysis The Skill instructs users to install a third-party CLI that will receive direct access to API keys and other secrets. The Go installation command explicitly selects the mutable `latest` version, while the Homebrew command also lacks a pinned version, checksum, signature, or other integrity-verification requirement. Consequently, the code executed by users may differ from the code that was reviewed during this audit. If the upstream repository, Homebrew tap, release pipeline, dependency graph, or maintainer account is compromised, a malicious version could be distributed through the documented installation process. Because the CLI's intended functions include storing, retrieving, exporting, injecting, and synchronizing credentials, a compromised release would operate within a particularly sensitive trust boundary. ### Attack Path 1. An attacker compromises the upstream repository, Homebrew tap, maintainer account, release pipeline, or one of the CLI's transitive dependencies. 2. The attacker publishes a malicious release or modifies the version resolved by `@latest`. 3. A user follows the installation instructions in `SKILL.md`. 4. The package manager downloads and executes the attacker-controlled version. 5. The user stores, retrieves, imports, injects, or synchronizes secrets through the compromised CLI. 6. The malicious CLI captures credentials and may disclose them using any network or local channel available to the user's account. ### Impact Assessment A compromised dependency would execute with the privileges of the user installing or invoking the CLI. It could potential ...[truncated 493 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific, security-reviewed semantic version or immutable commit: ```bash go install github.com/stym06/keys@vX.Y.Z ``` 2. Pin the Homebrew installation to a reviewed release where supported, or distribute a versioned formula with immutable source references. 3. Publish expected SHA-256 checksums and require verification before installation. 4. Prefer cryptographically signed releases and document signature verification. 5. Review and lock transitive dependencies used by the selected release. 6. Establish a controlled upgrade process in which new versions are audited before the pinned version is changed. 7. Document the expected upstream repository, release identity, and binary digest so users can detect source substitution. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:207
• Finding: Shell Command Injection Through Evaluation of Exported Secrets<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 207 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash eval $(keys expose) ``` ### Technical Analysis The documented command passes the textual output of `keys expose` to the shell's `eval` builtin. Unlike ordinary argument handling, `eval` reparses its input as shell program text. Any shell syntax present in the generated output may therefore be interpreted as executable commands rather than inert credential data. If a secret name or value originates from an untrusted or compromised `.env` file, synchronization peer, script, or user input, shell metacharacters and command substitutions could become part of the evaluated expression. Exploitability depends on the precise quoting and validation performed by the external `keys` CLI, which is not included in the audited artifact. The documented pattern nevertheless creates an unnecessary code-execution sink and becomes exploitable whenever the generated output is not perfectly shell-escaped for all supported inputs. ### Attack Path 1. An attacker supplies or influences a key name or value, such as through a malicious `.env` file imported with `keys import`, a synchronized profile, or another credential-provisioning workflow. 2. The malicious content contains shell syntax, command substitution, separators, or quoting designed to escape the intended assignment. 3. The affected value is stored in the active profile. 4. The user follows the documented quick-export workflow and runs: ```bash eval $(keys expose) ``` 5. `keys expose` emits the stored content as shell text. 6. `eval` reparses that output in the current shell. 7. If the CLI's escaping or validation is incomplete, the embedded payload executes with the user's privileges. ### Impact Assessment Successful exploitation provides arbitrary command execution in the user's current shell and with the user's operating-system privileg ...[truncated 424 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `eval $(keys expose)` recommendation. 2. Prefer a CLI operation that directly launches the target process with an environment map, avoiding generation and reparsing of shell source. 3. If shell output remains supported, strictly validate environment-variable names against a conservative pattern such as: ```text ^[A-Za-z_][A-Za-z0-9_]*$ ``` 4. Encode values using a rigorously tested, shell-specific quoting routine and reject unsupported control characters. 5. Do not rely on generic string escaping or manual quote replacement. 6. Add tests covering command substitutions, semicolons, newlines, backticks, quotes, backslashes, redirections, and shell operators. 7. Prefer safer usage resembling: ```bash keys run --all -- ./target-command ``` where the CLI constructs the child process environment through operating-system APIs rather than emitting executable shell text. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

---
name: keys-manager
description: Manage API keys locally from the terminal using the `keys` CLI. Use when users want to store, retrieve, search, import, export, or organize API keys and secrets. Handles .env file operations, profile-based key isolation, and secure key management workflows.
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: keys-manager
description: Manage API keys locally from the terminal using the `keys` CLI. Use when users want to store, retrieve, search, import, export, or organize API keys and secrets. Handles .env file operations, profile-based key isolation, and secure key management workflows.
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: keys-manager
description: Manage API keys locally from the terminal using the `keys` CLI. Use when users want to store, retrieve, search, import, export, or organize API keys and secrets. Handles .env file operations, profile-based key isolation, and secure key management workflows.
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: keys-manager
description: Manage API keys locally from the terminal using the `keys` CLI. Use when users want to store, retrieve, search, import, export, or organize API keys and secrets. Handles .env file operations, profile-based key isolation, and secure key management workflows.
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: keys-manager
description: Manage API keys locally from the terminal using the `keys` CLI. Use when users want to store, retrieve, search, import, export, or organize API keys and secrets. Handles .env file operations, profile-based key isolation, and secure key management workflows.
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to export secrets into `.env` files but does not warn that `.env` stores credentials in plaintext on disk, where they may be committed to source control, read by other local users, or captured by backups. Because this skill is specifically about managing secrets, omission of disk-handling warnings materially increases the chance of credential exposure.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill recommends `keys inject`, `keys expose`, and command substitution patterns that place secrets directly into shell commands or stdout without warning that credentials may leak via shell history, terminal logs, process inspection, CI logs, scrollback buffers, or command tracing. In a secrets-management skill, this is especially risky because the documented usage normalizes unsafe secret exposure paths.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The peer-to-peer sync feature transfers secrets across the network, and while the documentation mentions encryption, it does not warn users about trust boundaries, peer verification, local-network exposure, or the sensitivity of moving credentials between hosts. Users may incorrectly assume this is risk-free and sync secrets to less-trusted or compromised machines.

Static analysis

No suspicious patterns detected.