Canary

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:03 AM UTC
• Version: 1.0.0

Overview

Canary appears to be a legitimate secret-scanning skill, but its instructions give it very broad access to sensitive local credential stores and include one workflow that can expose unredacted secrets in chat.

Review carefully before installing. Use Canary only if you are comfortable with a secrets tool reading many local credential locations, and prefer running deep scans with narrowed paths or explicit exclusions. Do not paste raw shell-history or file-content output into a hosted chat; redact secrets locally first and rotate any credential that was pasted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: claude-project/system-prompt.md:64

Finding

Shell-history command can disclose complete secrets to a remote Claude conversation

Content

View full analysis

Vulnerability Details

File Location: claude-project/system-prompt.md:20-26, 64-68; supporting workflow in claude-project/project-instructions.md:47, 57-63
Vulnerability Type: Sensitive information disclosure through unsafe command output
Risk Level: High

Vulnerable code:

markdown

3. You give them a small batch of commands to run in their terminal — start with the most critical checks
4. They paste back the results
5. You analyze the output, flag any issues with severity levels, explain the risk in plain language, and provide fix commands

bash

# Check for secrets in history (look for patterns like KEY=, TOKEN=, PASSWORD=)
grep -iE "(api.?key|secret|token|password|credential)\s*[:=]" ~/.bash_history ~/.zsh_history 2>/dev/null | head -20

The setup guide reinforces this workflow:

markdown

Canary will ask your OS, give you commands to run, and analyze whatever you paste back

bash

find ~ -name ".env" -not -path "*/node_modules/*" -exec ls -la {} \; 2>/dev/null
ls -la ~/.aws/credentials 2>/dev/null
ls -la ~/.ssh/ 2>/dev/null

Technical Analysis

The shell-history command returns complete matching lines rather than sanitized findings. Shell histories frequently contain commands such as environment-variable assignments, authorization headers, database connection strings, or command-line options containing live passwords and tokens.

Although the prompt says users should not paste actual secrets, the prescribed workflow asks them to paste command output back into Claude without requiring local review or redaction. The command itself performs no masking. Limiting output with head -20 reduces quantity but does not protect confidentiality.

This behavior also conflicts with the Skill's privacy claim that secrets never leave the user's computer. In Claude Project advisory mode, pasted results are necessarily transmitted to the conversation service and may become p ...[truncated 1268 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not print complete matching history lines. Use a local scanner that emits only:
   • The history file path
   • The line number
   • The probable credential type
   • A fully redacted value or length
2. Redact output before it reaches the terminal. Do not rely on the user to manually remove secrets.
3. Avoid matching and returning an entire line. Parse assignments locally and replace values with [REDACTED].
4. Add an explicit checkpoint instructing the user to inspect output locally and never paste any secret-bearing line.
5. Prefer a result format such as:

   text

   ~/.zsh_history:418 — possible API token assignment — value redacted
   

6. For connection strings, remove the entire credential component rather than showing a partial password.
7. If a real secret is pasted, advise immediate revocation or rotation and do not repeat it.
8. Correct the privacy documentation to distinguish fully local OpenClaw scanning from the remote Claude Project workflow.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:382

Finding

Default scanning scope systematically accesses high-value credentials beyond minimum privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:116-118, 382-450
Vulnerability Type: Excessive access to sensitive local files and user data
Risk Level: Medium

Vulnerable instructions:

markdown

### On Startup (Light Scan)

1. Silently check these locations:
   - `~/.openclaw/.env`, `~/.clawdbot/.env`, and any `.env` in the current workspace
   - File permissions on all config files found above

The on-demand scan expands to the following sensitive locations:

markdown

*OpenClaw & Agent Config:*
- `<workspace>/skills/*/` — all installed skill directories
- `<workspace>/.clawhub/` — lock files and cached configs
- `~/.openclaw/` and `~/.clawdbot/` — full agent config directories
- Session/conversation logs if accessible

*SSH & GPG:*
- `~/.ssh/` — keys, config, `known_hosts`, `authorized_keys`
- `~/.gnupg/` — GPG private keys and config

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config
- `~/.config/doctl/config.yaml` — DigitalOcean CLI config
- `~/.config/hcloud/cli.toml` — Hetzner Cloud CLI config

The instructions additionally include registry credentials, container and orchestration credentials, database password files, shell histories, Git credentials, personal directories, broad application configuration directories, and temporary directories:

markdown

*Local System Directories:*
- `~/Downloads/`, `~/Desktop/`, `~/Documents/` — credential files, exported keys, service account JSONs, `.pem` files left in the open
- Browser password export CSVs [...]
- `~/Library/Application Support/` (macOS) and `~/.config/` (Linux) — application configs that may store tokens
- `/tmp/` and `/var/tmp/` — temporary files that may contain secrets [...]

Technical Analysis

Reading credential files is related ...[truncated 3005 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply progressive, explicit consent:
   • Keep startup checks limited to permission metadata.
   • Require separate opt-in consent for private keys, histories, conversation logs, personal directories, and cloud credentials.
2. Exclude session and conversation logs by default.
3. Exclude broad trees such as ~/Documents/, ~/Library/Application Support/, and all of ~/.config/ unless users select specific subdirectories.
4. Scan known credential paths individually rather than recursively scanning entire configuration trees.
5. Use metadata-only checks first. Read contents only when permissions, location, or filename indicate a concrete exposure risk.
6. Process secret matching in a local isolated component and return only redacted findings to the language model.
7. Never place full secret values in prompts, model context, logs, state files, or reports.
8. Use an allowlist of file types, strict size limits, recursion limits, and non-following symlink semantics enforced by implementation rather than documentation alone.
9. Display the exact categories and paths before a deep scan and allow users to deselect each category.
10. Clearly separate permission auditing from content scanning so users can choose the least-invasive mode.
11. Document that SSH checks are read-only and prohibit modification of key contents, SSH configuration, and authorized_keys; permit only explicitly confirmed permission changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (85)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The skill description itself declares that it scans .env files, installed skills, and shell history, including startup behavior. This reveals a broad credential-collection design that is risky because it targets common locations where users paste or store secrets.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: canary
description: >
  Scans your OpenClaw environment for leaked secrets — API keys, tokens, credentials in
  .env files, installed skills, and shell history. Runs silently on startup, deep scans
  on demand. Fixes issues with your permission.
tags:
  - security

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Including .netrc in known credential file paths indicates planned access to a classic multi-service credential store. This widens the skill's reach into unrelated accounts and services beyond the user's immediate project.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- Git repositories in the workspace for committed secrets
- SSH keys and config (`~/.ssh/`) for weak permissions
- Shell history files for commands containing tokens or passwords
- Known credential file paths (`.netrc`, `.npmrc`, `.pypirc`, Docker config, AWS credentials, etc.)

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Including .netrc in known credential file paths indicates planned access to a classic multi-service credential store. This widens the skill's reach into unrelated accounts and services beyond the user's immediate project.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- Git repositories in the workspace for committed secrets
- SSH keys and config (`~/.ssh/`) for weak permissions
- Shell history files for commands containing tokens or passwords
- Known credential file paths (`.netrc`, `.npmrc`, `.pypirc`, Docker config, AWS credentials, etc.)

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Referencing .netrc in the detection scope confirms the skill is designed to inspect plaintext credential files. While aligned with the skill's purpose, it still constitutes sensitive credential access that should not occur silently or by default.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

| Secret Type | Examples | Where It Looks |
|---|---|---|
| **API Keys** | Shodan, VirusTotal, OpenAI, Anthropic, AWS, GCP, Stripe, GitHub tokens | `.env` files, skill configs, shell history, git repos |
| **Passwords** | Plaintext passwords in configs, database connection strings with embedded passwords | Config files, `.env`, `.netrc`, skill directories |
| **Private Keys** | SSH private keys, PEM files, JWTs with embedded secrets | `~/.ssh/`, workspace, skill directories |
| **Cloud Credentials** | AWS access keys, GCP service account JSON, Azure tokens | `~/.aws/`, `~/.config/gcloud/`, env vars, configs |
| **Tokens & Sessions** | OAuth tokens, bearer tokens, session cookies, webhook URLs | Chat history, shell history, `.env` files |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill advertises scanning broad cloud credential locations like ~/.config/gcloud/, signaling intent to inspect local authentication material. Even for defensive purposes, this is dangerous because it trains the agent to read highly privileged secrets from outside the project scope.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

| **API Keys** | Shodan, VirusTotal, OpenAI, Anthropic, AWS, GCP, Stripe, GitHub tokens | `.env` files, skill configs, shell history, git repos |
| **Passwords** | Plaintext passwords in configs, database connection strings with embedded passwords | Config files, `.env`, `.netrc`, skill directories |
| **Private Keys** | SSH private keys, PEM files, JWTs with embedded secrets | `~/.ssh/`, workspace, skill directories |
| **Cloud Credentials** | AWS access keys, GCP service account JSON, Azure tokens | `~/.aws/`, `~/.config/gcloud/`, env vars, configs |
| **Tokens & Sessions** | OAuth tokens, bearer tokens, session cookies, webhook URLs | Chat history, shell history, `.env` files |
| **Local System Files** | Credential exports, service account JSONs, PEM/key files, password manager CSV exports, Kubernetes tokens, Terraform state secrets, database passwords | `~/Downloads/`, `~/Desktop/`, `~/Documents/`, `~/.kube/config`, `*.tfstate`, `~/.config/`, `~/Library/Application Support/`, `~/.my.cnf`, `~/.pgpass`, browser password export CSVs, Redis/MongoDB configs |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill includes ~/.kube/config among sensitive system files to inspect, which often contains cluster tokens and certificates. Access to Kubernetes credentials can lead to significant infrastructure compromise if leaked or mishandled.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

| **Private Keys** | SSH private keys, PEM files, JWTs with embedded secrets | `~/.ssh/`, workspace, skill directories |
| **Cloud Credentials** | AWS access keys, GCP service account JSON, Azure tokens | `~/.aws/`, `~/.config/gcloud/`, env vars, configs |
| **Tokens & Sessions** | OAuth tokens, bearer tokens, session cookies, webhook URLs | Chat history, shell history, `.env` files |
| **Local System Files** | Credential exports, service account JSONs, PEM/key files, password manager CSV exports, Kubernetes tokens, Terraform state secrets, database passwords | `~/Downloads/`, `~/Desktop/`, `~/Documents/`, `~/.kube/config`, `*.tfstate`, `~/.config/`, `~/Library/Application Support/`, `~/.my.cnf`, `~/.pgpass`, browser password export CSVs, Redis/MongoDB configs |

### Severity Levels

Credential Access

High

• Category: Privilege Escalation
• Confidence: 74% confidence

Finding

Creating backups of secret-bearing files means the skill intentionally duplicates sensitive content into another location, even if the destination is protected. This increases the number of credential copies on disk and therefore the exposure surface if backup handling, encryption, or permissions fail.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

**Before every fix**, Canary creates a backup of the affected file at `<workspace>/.canary/backups/` with a timestamp (e.g., `.env.2026-02-07T14:30:00.bak`). If anything goes wrong, you can ask Canary to roll back:

- *"Canary, undo that last fix"*
- *"Restore my .env file"*

Backups are stored with owner-only permissions and automatically deleted after 7 days. Canary will never back up files in a way that creates additional copies of secrets in less-secure locations.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

- **Don't lecture.** Offer the fix, explain the risk once, and let the user decide. Avoid repeating warnings or adding disclaimers the user didn't ask for.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs the agent to inspect credential-bearing files and even look for symlinks to cloud credential stores such as ~/.aws/credentials. Accessing these locations exposes highly sensitive authentication material and substantially increases risk if the skill misbehaves, is tampered with, or over-collects data.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

- **Git history**: If a `.git` directory exists, check `git log --diff-filter=A` for files that commonly contain secrets (`.env`, credentials, key files). Also check `git diff --cached` for secrets staged but not yet committed.
- **Filename heuristics**: Flag files with suspicious names regardless of content — `credentials`, `secret`, `password`, `token`, `private_key`, `service_account`, `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.jks`, `id_rsa`, `id_ed25519`. If they exist in unexpected locations (Downloads, Desktop, workspace root), escalate severity.
- **File size heuristics**: Small files (under 10KB) in unexpected locations (Downloads, Desktop, Documents, temp directories) with secret-like names or extensions are likely exported keys or tokens. Flag for review.
- **Symlink detection**: Check if any files in scanned directories are symlinks pointing to credential files elsewhere on the system. A symlink to `~/.aws/credentials` in a shared workspace is an exposure vector.
- **Encoding detection**: Check for base64-encoded secrets in config files. Decode and run pattern matching against the decoded content — base64 encoding is often used to obscure secrets but does not protect them.
- **Duplicate secret detection**: If the same secret value appears in multiple locations, flag all instances but group them as a single finding. This helps the user understand the blast radius if that secret is compromised.
- **Stale credential detection**: If a credential file hasn't been modified in over 90 days, flag it as a heads-up — long-lived credentials that are never rotated are a common risk.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md

vercel_[a-zA-Z0-9]{24,}

# ── Code & Package Registries ───────────────────────────────
# GitHub Personal Access Token
ghp_[a-zA-Z0-9]{36}
github_pat_[a-zA-Z0-9_]{80,}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Scanning ~/.aws/config can reveal account structure, profiles, endpoints, and related cloud configuration that may aid further compromise. Combined with other credential reads, it expands the sensitivity of collected environment data well beyond the workspace.

Content

Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.

md

- `~/.gnupg/` — GPG private keys and config

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Scanning ~/.aws/config can reveal account structure, profiles, endpoints, and related cloud configuration that may aid further compromise. Combined with other credential reads, it expands the sensitivity of collected environment data well beyond the workspace.

Content

Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.

md

- `~/.gnupg/` — GPG private keys and config

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The generic credential filename reference in this cloud-provider context points to concrete auth-bearing files and reinforces that the skill performs high-sensitivity credential inspection. In aggregate, this materially increases risk compared with ordinary workspace scanning.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config
- `~/.config/doctl/config.yaml` — DigitalOcean CLI config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The generic credential filename reference in this cloud-provider context points to concrete auth-bearing files and reinforces that the skill performs high-sensitivity credential inspection. In aggregate, this materially increases risk compared with ordinary workspace scanning.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config
- `~/.config/doctl/config.yaml` — DigitalOcean CLI config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The generic credential filename reference in this cloud-provider context points to concrete auth-bearing files and reinforces that the skill performs high-sensitivity credential inspection. In aggregate, this materially increases risk compared with ordinary workspace scanning.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config
- `~/.config/doctl/config.yaml` — DigitalOcean CLI config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Scanning ~/.azure/ may expose Azure CLI tokens, subscription context, and cached credentials. This broad credential-store access makes the skill more dangerous because it touches active cloud auth material outside the workspace.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

md

*Cloud Providers:*
- `~/.aws/credentials`, `~/.aws/config`
- `~/.config/gcloud/application_default_credentials.json`
- `~/.azure/` — Azure CLI profiles and tokens
- `~/.oci/config` — Oracle Cloud config
- `~/.config/doctl/config.yaml` — DigitalOcean CLI config
- `~/.config/hcloud/cli.toml` — Hetzner Cloud CLI config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

~/.netrc can contain credentials for multiple services and hosts in plaintext. Reading it gives broad account access and creates unnecessary exposure if the skill or hosting agent is compromised.

Content

Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.

md

- `~/.config/hcloud/cli.toml` — Hetzner Cloud CLI config

*Package Managers & Registries:*
- `~/.netrc` — often contains login credentials for multiple services
- `~/.npmrc` — NPM auth tokens
- `~/.pypirc` — PyPI upload credentials
- `~/.gem/credentials` — RubyGems API key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

~/.npmrc often contains registry auth tokens, and direct scanning of it exposes package publishing credentials. Such tokens can enable package takeover or malicious package publication if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

md

*Package Managers & Registries:*
- `~/.netrc` — often contains login credentials for multiple services
- `~/.npmrc` — NPM auth tokens
- `~/.pypirc` — PyPI upload credentials
- `~/.gem/credentials` — RubyGems API key
- `~/.cargo/credentials.toml` — Rust crate registry token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

~/.docker/config.json may contain registry credentials or auth tokens. Reading it as part of a generalized secrets scan exposes container registry access that could be abused to pull, push, or poison images.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md

- `~/.composer/auth.json` — PHP Composer tokens

*Containers & Orchestration:*
- `~/.docker/config.json` — Docker Hub and registry credentials
- `~/.kube/config` — Kubernetes cluster tokens and certificates
- `~/.helm/` — Helm repository credentials
- `*.tfstate` and `*.tfstate.backup` in workspace — Terraform state with plaintext secrets

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

~/.kube/config frequently contains live cluster access material, and broad scanning of it grants the skill visibility into production or development infrastructure credentials. This is a substantial privilege expansion beyond ordinary app scanning.

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

md

*Containers & Orchestration:*
- `~/.docker/config.json` — Docker Hub and registry credentials
- `~/.kube/config` — Kubernetes cluster tokens and certificates
- `~/.helm/` — Helm repository credentials
- `*.tfstate` and `*.tfstate.backup` in workspace — Terraform state with plaintext secrets
- `~/.terraform.d/credentials.tfrc.json` — Terraform Cloud tokens

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Pulumi and Terraform credential files can provide direct access to infrastructure state and cloud environments. Scanning them as part of a general-purpose skill substantially increases the impact of any misuse or leakage.

Content

Scanner excerpt · SKILL.md (reported line 415)May include surrounding context.

md

- `~/.helm/` — Helm repository credentials
- `*.tfstate` and `*.tfstate.backup` in workspace — Terraform state with plaintext secrets
- `~/.terraform.d/credentials.tfrc.json` — Terraform Cloud tokens
- `~/.pulumi/credentials.json` — Pulumi access tokens
- `~/.vagrant.d/` — Vagrant cloud tokens

*Databases:*

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Pulumi and Terraform credential files can provide direct access to infrastructure state and cloud environments. Scanning them as part of a general-purpose skill substantially increases the impact of any misuse or leakage.

Content

Scanner excerpt · SKILL.md (reported line 415)May include surrounding context.

md

- `~/.helm/` — Helm repository credentials
- `*.tfstate` and `*.tfstate.backup` in workspace — Terraform state with plaintext secrets
- `~/.terraform.d/credentials.tfrc.json` — Terraform Cloud tokens
- `~/.pulumi/credentials.json` — Pulumi access tokens
- `~/.vagrant.d/` — Vagrant cloud tokens

*Databases:*

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

~/.git-credentials contains plaintext repository credentials in many setups. A skill that reads this file gains direct access to source control accounts and potentially private repositories.

Content

Scanner excerpt · SKILL.md (reported line 434)May include surrounding context.

md

*Git:*
- `<workspace>/.git/` — check for secrets in tracked files
- `~/.gitconfig` — may contain tokens in URL credentials
- `~/.git-credentials` — plaintext git credentials

*Local System Directories:*
- `~/Downloads/`, `~/Desktop/`, `~/Documents/` — credential files, exported keys, service account JSONs, `.pem` files left in the open

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The custom path example explicitly encourages users to add more secret-heavy locations such as project .env files and credential folders, expanding scan reach further into sensitive areas. Without strict consent and least-privilege controls, this can lead to overbroad credential access.

Content

Scanner excerpt · SKILL.md (reported line 466)May include surrounding context.

md

# Add your own directories or files for Canary to include in deep scans
custom_paths:
  - ~/projects/my-app/.env
  - ~/work/secrets/
  - /opt/myservice/config/
  - ~/Dropbox/credentials/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 654)May include surrounding context.

md

>
> There's one thing I can't fix automatically though — your GitHub token (`ghp_...(36 chars)`) was committed to a git repo. I've added the file to `.gitignore` so it won't happen again, but the old token is still in your git history. Here's what I'd recommend:
>
> 1. Go to github.com → Settings → Developer settings → Personal access tokens
> 2. Find the token that starts with `ghp_`
> 3. Click "Regenerate" to get a new one
> 4. Replace the old token in your `.env` file with the new one

Static analysis

No suspicious patterns detected.