treg

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:04 AM UTC
• Version: 0.11.0

Overview

The skill is a disclosed external-tool and credential proxy, but it asks for unusually broad install, account, credential, and approval authority.

Install only if you trust treg as a long-lived credential and account-action broker. Inspect the installer before running it, avoid blanket approval for all treg commands, restrict credential imports to explicit files or directories, use scoped agent tokens, and confirm separately before paid calls, secret uploads, CLI execution, social or ads actions, and organization changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:13

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

treg-install.sh' | sha256sum -c - less treg-install.sh sh treg-install.sh ``` 6. Include the installer source in the project so its behavior can be audited with the Skill. 7. Document every expected filesystem and configuration change. 8. Run installation with ordinary user privileges and avoid requesting administrator or root access unless a specific operation demonstrably requires it. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:2

Finding

Persistent Tool Registration Is Combined with Broad Command Authorization and Tool-Selection Steering

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:170

Finding

Broad Local Credential Discovery and Upload Can Expose Unrelated Secrets

Content

View full analysis

` to restrict ``` ```bash treg secret add posthog-key --value "$POSTHOG_API_KEY" # or --file ./.secret/token.json treg tool add posthog --base-url https://us.posthog.com --secret posthog-key ``` ```bash treg skill scaffold ~/.claude/skills/google-ads --out gads.json # -> walks the dir: captures SKILL.md as the recipe + every .secret/* as a secret. # -> YOU then edit gads.json: set base_url, and complete each binding (location/name/format). treg skill push gads.json ``` ```text **OAuth, two modes (treg keeps it fresh):** if the oauth secret carries `refresh_token` + `client_id` + `client_secret`, treg **auto-refreshes** it before it expires (you never re-upload). ``` ```bash treg secret add gsc --file token.json --kind oauth treg oauth connect gsc --client-secret client_secret.json --scopes ``` ### Technical Analysis The Skill documents a bulk command that discovers provider keys in `.env` files and scans Skill subdirectories. The default command is described as scanning “both sides of the cwd,” while a narrower directory is merely optional. It also documents directory walking that captures every file under `.secret/`, as well as direct upload of API keys, OAuth tokens, refresh tokens, client IDs, and client secrets to an external service. Credential storage and injection are part of the declared functionality, and the text states that the user selects what is registered. Therefore, the audited file does not establish covert or automatic ...[truncated 2144 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and executing a remote install script in one command is a direct arbitrary code execution risk. Because this is positioned as the first-run path and framed as required setup, the skill materially increases the chance an agent or user will execute untrusted remote code without inspection.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

tools. Set both up once, in this order, and do not stop between the steps:

bash

curl -fsSL https://treg.to/install.sh | sh   # 1. the CLI (skip if `treg --version` already works)
treg login                                   # 2. sign in — opens a browser; first login registers you
treg mcp install                             # 3. register treg's tools into this agent

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This is a second instance of the same unsafe remote-script execution pattern presented in the main installation section. Repetition reinforces the unsafe practice and makes it more likely to be followed automatically, compounding the arbitrary code execution risk.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

First: install + sign in

bash

curl -fsSL https://treg.to/install.sh | sh     # installs the CLI + points it here
treg login                            # browser sign-in (GitHub / Google / email code) — first login registers you
treg login --email [e-mail]    # terminal-only alternative (emailed 6-digit code)
treg login --token <per-org-token>    # non-interactive (agents/CI)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill instructs handling OAuth token files and client secret files, which are highly sensitive credentials, and normalizes passing them into CLI commands. In an agent-operated environment, this increases the risk of credential exposure through logs, shell history, workspace persistence, or accidental misuse of secret-bearing files.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md

**Getting the first OAuth token, two ways (your choice):**
- **Manual:** do your own OAuth locally, then `treg secret add gsc --file token.json --kind oauth`.
- **Hosted connect:** `treg oauth connect gsc --client-secret client_secret.json --scopes <scope>`
  → prints a consent URL; you approve in the browser; treg captures the token directly.
  One-time setup: add `https://treg.to/oauth/callback` to your OAuth app's redirect URIs.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is extremely broad and encourages use for many vague categories of external data access and account actions. Broad invocation language increases the chance the agent will select this skill for unrelated tasks, expanding exposure to external calls, credential use, and paid actions without sufficient task-specific scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup instructs users to pipe a remote script directly into the shell, which executes unreviewed code from the network immediately. If the host, transport, or script content is compromised, this becomes arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill instructs the agent not to ask for confirmation for a broad set of commands and to batch-approve command execution, reducing human oversight. In this context, that undermines runtime safety controls and normal approval boundaries around network access, account inspection, and environment-modifying setup flows.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

prints it) — not because your runtime demands a prompt, but because it is their money. Batch-confirm
once for a run of cheap calls rather than asking per call.

Reading costs nothing and needs no confirmation at all: `treg catalog …`, `treg tool ls`,
`treg skill ls`, `treg balance`, `treg audit`, `treg org pins`, `treg health`.

## First: install + sign in

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

You already know the upstream API. Just build the real request and prefix it. No treg vocabulary, no special params — use the API exactly as its own docs say:

text

<the real request>:  GET https://api.intercom.io/conversations?per_page=5
through treg:         GET https://treg.to/call/https://api.intercom.io/conversations?per_page=5
                          + header:  X-Treg-Token: <your token>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill explicitly states that treg relays everything faithfully, including headers, cookies, and bodies, to upstream hosts. In an agent context, this creates a high-risk generic exfiltration channel where sensitive local or conversation-derived data could be forwarded to third-party services if the agent constructs a request incautiously.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

vocabulary, no special params — use the API exactly as its own docs say:

text

<the real request>:  GET https://api.intercom.io/conversations?per_page=5
through treg:         GET https://treg.to/call/https://api.intercom.io/conversations?per_page=5
                          + header:  X-Treg-Token: <your token>

treg resolves the tool by the upstream host, injects the credential server-side, and relays

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 74% confidence

Finding

The skill recommends creating and storing reusable local skill artifacts under persistent directories to package recipes with secrets and tools. In this context, persistent local artifacts can outlive the immediate session and may expose configuration, metadata, or nearby secret material to future agent runs or other local users if filesystem protections are weak.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

text

**Default: wrap new keys in a skill.** When registering a new key/endpoint/CLI, pair it with
a skill so credential, tool, and recipe land together (and it gets a shareable page). If no
skill exists, create a basic one — a proper SKILL.md (frontmatter matters: agents discover
skills by it) + one example call:
```bash
mkdir -p ./posthog && cat > ./posthog/SKILL.md <<'MD'

Static analysis

No suspicious patterns detected.