T09 · Insecure Skill Coding Practices
Error
- Location
hooks/scripts/check-config.sh:12- Finding
Arbitrary Command Execution Through Project-Controlled Environment File
- Content
View full analysis
- Remediation
View remediation
Security audit
Dep Radar
Security checks for vulnerabilities and agentic risk
Overview
DepRadar is mostly a disclosed dependency scanner, but it installs an automatic session-start hook that can execute shell code from a project config file.
Review before installing. At minimum, disable or fix the SessionStart hook so dotenv files are parsed without shell source, avoid project-controlled .claude/depradar.env in untrusted repos, pin or skip automatic npm dependency installation, use least-privilege API tokens, and only send notifications to webhook URLs you control.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/depradar.py:769- Finding
API Credentials Written Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/notify.py:27- Finding
Slack Notification Target Permits Arbitrary HTTP Endpoints
- Content
View full analysis
None: """POST a Slack Block Kit message to webhook_url.""" blocks = _build_slack_blocks(report) payload = json.dumps({"blocks": blocks}).encode("utf-8") req = urllib.request.Request( webhook_url, data=payload, headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=15) as resp: if resp.status not in (200, 204): raise RuntimeError(f"Slack webhook returned HTTP {resp.status}") ``` The payload includes project metadata: ```python def _build_slack_blocks(report: dict) -> list: """Build a Slack Block Kit message summarising breaking changes.""" breaking = report.get("packages_with_breaking_changes", []) project = report.get("project_path", "") ``` ### Technical Analysis Targets using the `slack://` prefix are not restricted to Slack webhook hosts and are not required to use HTTPS. A target such as `slack://http://example.test/collect` remains an HTTP URL and is passed directly to `urllib.request.urlopen()`. The POST body can contain the absolute project path, dependency names and versions, breaking-change descriptions, and affected source filenames. Therefore, a misleadingly named Slack option can transmit project metadata to any attacker-selected HTTP endpoint. The same primitive can make requests to loopback, link-local, or private-network addresses. Because the ...[truncated 1297 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/sync.sh:165- Finding
Installer Automatically Resolves and Executes Unlocked npm Dependencies
- Content
View full analysis
/dev/null && [[ -f "$target/scripts/lib/package.json" ]]; then npm install --prefix "$target/scripts/lib/" --silent 2>/dev/null \ && success "Installed JS AST dependencies (acorn) in $target/scripts/lib/" \ || warn "npm install for JS AST deps failed — regex fallback will be used" fi ``` ```json { "name": "depradar-js-helpers", "version": "1.0.0", "description": "JS/TS AST helper dependencies for /depradar", "private": true, "dependencies": { "acorn": "^8.11.0", "acorn-walk": "^8.3.0" } } ``` ### Technical Analysis The installer automatically invokes `npm install` whenever npm is available. The repository has no reviewed lockfile in the supplied directory structure, and the dependencies use caret ranges rather than exact versions. Installation can therefore resolve package versions that were not present during Skill review. The command does not use `--ignore-scripts`. npm package lifecycle scripts may execute during installation if introduced by a resolved package or its transitive dependencies. Resolution also follows the user's configured npm registry, which may be compromised or intentionally replaced with an untrusted source. The JavaScript AST feature is optional and has a regex fallback. Automatically introducing network access and third-party installation during Skill synchronization therefore exceeds the minimum behavior required for core operation. ### Attack Path 1. A user runs `scripts/sync.sh`. 2. npm i ...[truncated 983 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/lib/render.py:367- Finding
Untrusted Community and Release Content Is Embedded in Agent-Consumed Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (146)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
bash mkdir -p .claude cat > .claude/depradar.env << 'EOF' # Project-level settings — safe to commit (no secrets here) # GITHUB_TOKEN and other secrets should stay in ~/.config/depradar/.env EOF
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cache is stored in
~/.cache/depradar/. Delete it to clear everything:bash rm -rf ~/.cache/depradar/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cache is stored in
~/.cache/depradar/. Delete it to clear everything:bash rm -rf ~/.cache/depradar/
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding indicates the skill performs configuration loading and credential availability checks rather than the stated dependency analysis workflow. Touching local config and secrets-adjacent material under the guise of a scanner is risky because users may not expect the skill to inspect auth setup or build request headers to third-party services.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Where `{SKILL_ROOT}` is the directory containing this `SKILL.md` file.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Where `{SKILL_ROOT}` is the directory containing this `SKILL.md` file.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
The skill includes instructions to access and modify agent configuration/install directories under ~/.claude, ~/.codex, and ~/.agents. These locations are sensitive because changes there can affect future agent behavior, persistence, and trust boundaries beyond the current project.
- Content
md > "GitHub API rate limit reached. Add `GITHUB_TOKEN` to `~/.config/depradar/.env` for 5,000 requests/hour. Run `/depradar --diagnose` to check your config." **Script not found:** > "Could not find `depradar.py`. Make sure the skill is installed: copy the `depradar-skill/` directory to `~/.claude/skills/`. Run `bash ~/.claude/skills/depradar-skill/scripts/sync.sh` to install." **Python not found:** > "Python 3.8+ is required. Install from python.org or via: `brew install python3` (Mac) / `sudo apt install python3` (Linux)."
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill directs use of a local .env file containing API tokens and discusses reading those credentials for operation. In an agent setting, referencing secret-bearing files increases the risk of credential exposure through logs, accidental echoing, or overbroad file access beyond what a dependency scan should need.
- Content
Example Config File
bash # ~/.config/depradar/.env # Strongly recommended — free at github.com/settings/tokens # Scopes needed: (none — public repos only)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The troubleshooting advice instructs appending a GitHub token to ~/.config/depradar/.env. Encouraging direct secret material creation in predictable paths can lead to insecure storage practices and increases the chance that an agent later reads or mishandles the token.
- Content
Fix: Add
GITHUB_TOKENto~/.config/depradar/.env:bash echo "GITHUB_TOKEN=ghp_yourtoken" >> ~/.config/depradar/.envGet a token at: github.com/settings/tokens (no scopes needed for public repos)
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Locate config files ──────────────────────────────────────────────────────── PROJECT_ENV=".claude/depradar.env" GLOBAL_ENV="$HOME/.config/depradar/.env" # Load project-level env if present if [[ -f "$PROJECT_ENV" ]]; then