Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed AI quota dashboard that handles user-provided API credentials, with sensitive but purpose-aligned behavior and no artifact-backed deception or exfiltration.
Install only if you are comfortable storing AI provider API keys or refreshed tokens under a local config directory. Prefer read-only service tokens, keep the config file owner-only, avoid browser session cookies, and do not expose the dashboard through port forwarding or a tunnel unless you add authentication and understand what account telemetry it reveals.
The skill's declared purpose and the documented behavior do not fully align: it references cookies and broad multi-provider support while the visible content emphasizes token files, refresh flows, and a narrower set of operational details. Security reviewers may approve the skill under incomplete assumptions, which is dangerous when the skill handles credentials and network requests.
The skill explicitly instructs persisting refreshed access tokens to disk, creating a durable credential store. Even though surrounding text recommends restrictive permissions, disk persistence materially increases the blast radius of local compromise, backup leakage, accidental sync, or insecure file handling elsewhere in the system.
- Sequential proxy handshakes scale with pool size. Set daemon runner timeout (`subprocess.run(timeout=...)`) to at least **60–75s** (not 25s) to prevent SIGKILL interruptions mid-poll.
2. **Proactive Pre-emptive Token Refresh (Zero Flapping):**
- Never wait for a provider to return `401 Unauthorized` before attempting a refresh. Check stored `expires` timestamps. If `now > expires - 300s`, proactively request a fresh access token via `refresh_token` and persist it to disk before querying quota endpoints.
3. **Graceful Cache Fallback:**
- Transient network timeouts (`URLError`, handshake lag, HTTP 502/503) must not wipe account telemetry or flag status as error. Retain the previous successful quota readings (`prev_cache`). An account is only truly in error if the token endpoint returns an unrecoverable revocation (`invalid_grant`) or credentials are missing.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
sudo ln -s /etc/nginx/sites-available/quota-dashboard /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d quota.mydomain.com
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## 1. Golden Rule: Standard API Credentials First
Always configure providers using official developer API keys or personal access tokens (e.g., OpenRouter `sk-or-...`, ElevenLabs `xi-api-key`, OpenAI `sk-...`, Anthropic `sk-ant-...`).
**Security Notice:** Avoid using or extracting third-party browser session cookies. If monitoring a self-hosted platform (e.g., LiteLLM, LibreChat, OpenWebUI), generate a dedicated read-only service token or API key from that platform's administration panel.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</style>
</head>
<body class="p-4 md:p-8 max-w-6xl mx-auto">
<!-- Header -->
<div class="flex flex-wrap items-center justify-between mb-8 pb-4 border-b border-gray-800 gap-4">
<div>
<h1 class="text-2xl md:text-3xl font-extrabold text-white flex items-center gap-3">
The skill describes behavior that implies access to environment variables, local files, networking, and shell-like operations, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, this weakens review and containment because operators cannot easily verify what the skill is expected to access, increasing the risk of over-privileged execution and accidental credential exposure.
The manifest description includes Russian phrases alongside English, which imposes multilingual output/metadata behavior without any stated user opt-in or justification. Under the policy, language or locale constraints should either be optional for the user or clearly documented as region-specific.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Credentials must be read strictly from isolated configuration files or environment variables.
2. **Strict Filesystem Isolation (`[PE3]`):**
- All credentials files must reside in dedicated directories with restrictive permissions (`chmod 700 ~/.config/ai-quota-dashboard` and `chmod 600 config.json`).
- Collector scripts must audit permissions and refuse execution if files are world-readable.
3. **Strict Origin Domain Pinning (`[SQP-2]`, `[E1]`):**
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Credentials must be read strictly from isolated configuration files or environment variables.
2. **Strict Filesystem Isolation (`[PE3]`):**
- All credentials files must reside in dedicated directories with restrictive permissions (`chmod 700 ~/.config/ai-quota-dashboard` and `chmod 600 config.json`).
- Collector scripts must audit permissions and refuse execution if files are world-readable.
3. **Strict Origin Domain Pinning (`[SQP-2]`, `[E1]`):**
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Credentials must be read strictly from isolated configuration files or environment variables.
2. **Strict Filesystem Isolation (`[PE3]`):**
- All credentials files must reside in dedicated directories with restrictive permissions (`chmod 700 ~/.config/ai-quota-dashboard` and `chmod 600 config.json`).
- Collector scripts must audit permissions and refuse execution if files are world-readable.
3. **Strict Origin Domain Pinning (`[SQP-2]`, `[E1]`):**
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Credentials must be read strictly from isolated configuration files or environment variables.
2. **Strict Filesystem Isolation (`[PE3]`):**
- All credentials files must reside in dedicated directories with restrictive permissions (`chmod 700 ~/.config/ai-quota-dashboard` and `chmod 600 config.json`).
- Collector scripts must audit permissions and refuse execution if files are world-readable.
3. **Strict Origin Domain Pinning (`[SQP-2]`, `[E1]`):**
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Credentials must be read strictly from isolated configuration files or environment variables.
2. **Strict Filesystem Isolation (`[PE3]`):**
- All credentials files must reside in dedicated directories with restrictive permissions (`chmod 700 ~/.config/ai-quota-dashboard` and `chmod 600 config.json`).
- Collector scripts must audit permissions and refuse execution if files are world-readable.
3. **Strict Origin Domain Pinning (`[SQP-2]`, `[E1]`):**
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Credentials must be read strictly from isolated configuration files or environment variables.
2. **Strict Filesystem Isolation (`[PE3]`):**
- All credentials files must reside in dedicated directories with restrictive permissions (`chmod 700 ~/.config/ai-quota-dashboard` and `chmod 600 config.json`).
- Collector scripts must audit permissions and refuse execution if files are world-readable.
3. **Strict Origin Domain Pinning (`[SQP-2]`, `[E1]`):**
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
## 6. Verification Checklist
- [ ] `config.json` has permissions `0600` (`ls -l ~/.config/ai-quota-dashboard/config.json`).
- [ ] No tokens or keys appear in `ps aux` or shell history.
- [ ] Provider endpoints match pinned domain verification checks.
- [ ] Dashboard is accessible via LAN IP, VPN, or reverse proxy.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Prevent unauthorized external connections while allowing local devices:
# Allow connections strictly from your home subnet (e.g., 192.168.1.0/24)
sudo ufw allow from 192.168.1.0/24 to any port 8885 proto tcp
sudo ufw status
The guide instructs users to download and install a network tunneling binary from the internet and then expose a local service through a third-party tunnel. While presented as a convenience feature, this creates external transmission and broadens exposure of what is described elsewhere as a dashboard containing quotas, subscriptions, and cookies, which may lead to unintended data disclosure if the service is weakly protected.
cloudflared:
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb
sudo dpkg -i cloudflared.deb
Installing a downloaded .deb with sudo grants root-level execution to externally sourced software. In a documentation context this is often legitimate, but it becomes security-relevant here because the package is fetched directly from the internet and is immediately used to expose a local dashboard through a tunnel.
cloudflared:
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb
sudo dpkg -i cloudflared.deb
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Generate htpasswd file:
htpasswd -c /etc/nginx/.htpasswd_quota admin
sudo chmod 640 /etc/nginx/.htpasswd_quota
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
*Mitigation:* Never pass tokens via CLI flags. Load tokens strictly from owner-restricted files or environment variables.
2. **Insecure Storage & Permissive Permissions (`[PE3]`):**
Saving credentials in world-readable files allows unauthorized local processes to read secrets.
*Mitigation:* All credential stores must reside under `~/.config/ai-quota-dashboard/` with mandatory file permissions `chmod 600` (read/write by owner only) and directory permissions `chmod 700`.
3. **Credential Egress & Unpinned Forwarding (`[SQP-2]`, `[E1]`):**
Detected: suspicious.install_untrusted_source