T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:183- Finding
Broad Environment Credential Enumeration May Expose Secrets
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 183–191
Vulnerability Type: Environment credential reconnaissance and disclosure
Risk Level: MediumVulnerable Code
bash # Verify whether environment variables are configured echo "Configuration check:" env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/" # Linux/macOS # Or PowerShell # Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-TableTechnical Analysis
The Skill instructs an AI agent with
execaccess to enumerate environment variables whose names contain broad terms such asAPI,KEY,TOKEN, orSECRET. This operation is not limited to the credentials required for calendar synchronization and therefore violates least-privilege principles.The Unix pipeline masks values before displaying them, but still reveals the names and existence of unrelated sensitive variables. The PowerShell command is more severe because
Get-ChildItem Env:returns environment-variable names and values, andFormat-Tabledoes not redact those values. If the command is uncommented and executed as directed, credentials may be included in terminal output, the agent context, conversation history, execution logs, or platform telemetry.The issue is classified as unauthorized access because the Skill requests visibility into credentials outside its documented calendar-related needs. No evidence in the audited file shows direct exfiltration or subsequent misuse of the discovered credentials.
Attack Path
- A user loads the Skill in an AI agent that has the declared
execcapability. - The user or agent follows the documented environment-validation procedure.
- On Linux or macOS, the command discovers the names and existence of all variables matching broad secret-related keywords.
- On Windows PowerShell, the suggested command enumerates both matching variable names and their values.
- The command output enters the agent's context and may be reta ...[truncated 1018 chars]
- A user loads the Skill in an AI agent that has the declared
- Remediation
View remediation
Remediation Suggestions
- Remove broad enumeration commands based on generic patterns such as
API,KEY,TOKEN, andSECRET. - Document the exact provider-specific environment variables required by the Skill.
- Check only whether each required variable is present, without printing its value. For example:
bash if [ -n "${CALENDAR_API_KEY:-}" ]; then echo "CALENDAR_API_KEY is configured" else echo "CALENDAR_API_KEY is not configured" fipowershell if ($null -ne $env:CALENDAR_API_KEY -and $env:CALENDAR_API_KEY.Length -gt 0) { Write-Output "CALENDAR_API_KEY is configured" } else { Write-Output "CALENDAR_API_KEY is not configured" }- Avoid returning secret-bearing command output to the AI model, chat transcript, or logs.
- Require explicit user confirmation before accessing any credential-related environment variable.
- Apply output redaction at the agent or execution-wrapper level as defense in depth.
- Use narrowly scoped calendar-provider credentials and rotate any credentials that may already have been exposed through this validation procedure.
- Remove broad enumeration commands based on generic patterns such as