ClawHub
Back to skill

Security audit

Tene CLI — Local-First Secrets

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent secret-manager guidance, but it repeatedly recommends unverified remote installation and self-update patterns for tooling that handles secrets.

Review before installing. Prefer a pinned, verified release or package-manager install instead of curl | sh, do not run installation steps in CI jobs that already have TENE_MASTER_PASSWORD or deployment secrets, and require explicit user approval before running tene update. The secret-handling guardrails are useful, but the installation and update paths need stricter verification for a tool that manages credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:29
Finding
Unverified Remote Installer Is Downloaded and Executed Directly## Vulnerability Details **File Location**: - `README.md:29` - `SKILL.md:78` - `SKILL.md:334` - `examples/01-init-and-first-secret.md:26` - `examples/03-multi-env-ci-cd.md:88` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -sSfL https://tene.sh/install.sh | sh ``` The same installation pattern is also used in the documented GitHub Actions workflow: ```yaml env: TENE_MASTER_PASSWORD: ${{ secrets.TENE_MASTER_PASSWORD }} steps: - uses: actions/checkout@v4 - name: Install tene run: curl -sSfL https://tene.sh/install.sh | sh - name: Deploy with prod secrets run: tene run --env prod --no-keychain -- ./scripts/deploy.sh ``` ### Technical Analysis The installation command retrieves a mutable shell script from an external website and sends it directly to a shell interpreter. The payload is not inspected or stored for review before execution, and the instructions do not require any of the following controls: - A fixed installer or release version - A cryptographic checksum - A publisher signature - An immutable release URL - Independent verification against the source repository HTTPS protects the transport connection but does not establish that the current server-side script is the same payload that was reviewed when this Skill was published. Compromise of the website, hosting account, DNS configuration, TLS termination infrastructure, or release process could therefore turn the documented installation command into arbitrary code execution. The risk is particularly significant in the CI example. The installer executes in a job where `TENE_MASTER_PASSWORD` is configured as an environment variable. A malicious installer process can inherit job environment variables, inspect the checked-out repository, access available runner credentials, and modify files or later workflow behavior. Although the domain is descri ...[truncated 1726 chars]
Remediation
## Remediation Suggestions 1. Remove every `curl ... | sh` installation instruction. 2. Pin installation to a specific, immutable Tene release rather than a mutable installer endpoint. 3. Download the release artifact to disk before executing or installing it. 4. Publish SHA-256 checksums through a separately protected release channel and verify the selected artifact before installation. 5. Prefer signed release artifacts and validate the publisher signature with a pinned public key. 6. Pin the operating-system and architecture-specific artifact explicitly in CI. 7. Run installation in a step that does not have access to `TENE_MASTER_PASSWORD` or other deployment credentials. Scope secrets only to the deployment step that requires them instead of defining them at job level. 8. Use a minimal-permission CI token and an isolated, ephemeral runner. 9. Verify the installed binary version and signature before permitting it to access the vault. 10. Apply the corrected installation guidance consistently in `README.md`, `SKILL.md`, and both affected examples.

T08 · Insecure Dependencies

Error
Location
SKILL.md:81
Finding
Mutable Latest Dependencies Are Downloaded and Executed Without Integrity Pinning## Vulnerability Details **File Location**: - `SKILL.md:81` - `tests/test.md:20` **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash go install github.com/tomo-kay/tene/cmd/tene@latest ``` ```bash tene run -- npx --yes promptfoo@latest eval -c evals/tene-skill.promptfoo.yaml ``` ### Technical Analysis Both commands resolve the dependency identified as `latest` at execution time. Consequently, the code executed by a user can change after the Skill itself has been reviewed. The `go install ...@latest` command builds and installs whichever upstream revision currently resolves as the latest module version. It does not constrain installation to a version audited alongside this Skill. The `npx --yes promptfoo@latest` command is especially sensitive because it automatically downloads and executes package code without an interactive confirmation. It is additionally wrapped by `tene run --`, whose declared purpose is to inject vault secrets into the child process. Therefore, the downloaded package and its transitive runtime code may receive the selected environment’s secrets even though dependency retrieval and evaluation do not inherently require access to all vault credentials. The instructions provide no fixed version, committed lockfile, artifact checksum, signature verification, or allowlist limiting which secrets are exposed to the child process. ### Attack Path 1. An attacker compromises an upstream maintainer or package-registry account, or causes a malicious release to become the version selected by `latest`. 2. A user follows one of the documented commands. 3. The package manager resolves and downloads the mutable latest version. 4. The downloaded code executes locally during installation or through `npx`. 5. For the `npx` command, execution occurs as a child of `tene run`. 6. The malicious package reads inherited environment variables contain ...[truncated 972 chars]
Remediation
## Remediation Suggestions 1. Replace `@latest` with explicit, reviewed versions for both Go and npm dependencies. 2. Record the expected Go module version and checksum, and retain normal Go checksum verification. 3. Install `promptfoo` as a pinned development dependency using a committed lockfile rather than downloading it dynamically with `npx --yes`. 4. Use lockfile-enforcing installation modes in CI, such as `npm ci`. 5. Review transitive dependencies and use registry provenance or package signatures where available. 6. Do not execute dependency installation or general evaluation tools under `tene run` unless they demonstrably require secrets. 7. If an evaluation requires a credential, provide only that specific credential through an explicit allowlist rather than exposing the complete selected vault environment. 8. Run third-party evaluation tools in an isolated container or sandbox with restricted filesystem and network access. 9. Remove automatic confirmation flags such as `--yes` where interactive review is appropriate. 10. Add dependency-update review procedures so version changes are separately audited before adoption.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (39)

External Script Fetching

High
Category
Supply Chain
Content
```bash
# 1. Install tene
curl -sSfL https://tene.sh/install.sh | sh

# 2. Initialize a vault in your project
cd my-project
Confidence
97% confidence
Finding
The command fetches an installation script from an external domain and executes it immediately, creating a direct remote code execution path. In a skill intended for AI-assisted workflows, this is more dangerous because users or agents may copy the command without scrutiny, amplifying supply-chain and compromise risk.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# 1. Install tene
curl -sSfL https://tene.sh/install.sh | sh

# 2. Initialize a vault in your project
cd my-project
Confidence
96% confidence
Finding
The '| sh' shell chaining pattern is dangerous because it converts untrusted network data directly into executable shell commands with no review boundary. This materially increases exploitability compared with a plain download, since any tampering leads to immediate command execution on the host.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
---
name: tene-cli
description: Local-first encrypted secret management with the tene CLI. Activate when the user mentions secrets, API keys, credentials, tokens, .env files, environment variables, or asks to run a command that needs secrets injected. Enforces strict AI safety rules (never print plaintext, never read .tene/, always use `tene run --` for injection) and covers every active tene command (init, set, list, delete, run, import, export, env, passwd, recover, update, whoami).
version: 1.0.0
metadata:
  openclaw:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High
Category
Supply Chain
Content
- kind: download
        url: https://tene.sh/install.sh
        bins: [tene]
        label: "Install tene via the official curl installer"
---

# tene — Local-First Encrypted Secret Management
Confidence
99% confidence
Finding
The skill metadata instructs installation via a downloaded shell script from `https://tene.sh/install.sh`, which is a classic remote-code execution pattern. In agent contexts this is especially dangerous because it encourages fetching and running mutable external code without integrity verification, pinning, or signature checking.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# macOS / Linux (official installer — recommended)
curl -sSfL https://tene.sh/install.sh | sh

# From source (requires Go 1.25+)
go install github.com/tomo-kay/tene/cmd/tene@latest
Confidence
99% confidence
Finding
`curl -sSfL https://tene.sh/install.sh | sh` chains a network fetch directly into shell execution, eliminating opportunities for review or integrity checks. In a skill that may be followed by an agent or copied by users, this materially increases the chance of silent compromise through malicious or changed installer content.

Credential Access

High
Category
Privilege Escalation
Content
# Then delete the plaintext file
rm .env
echo ".env" >> .gitignore
```

Update all commands to use `tene run --`:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Self-Modification

High
Category
Rogue Agent
Content
tene version                     # v1.x.x (os/arch)
tene version --json              # includes commit + build date
tene update --check              # check for newer version on S3
tene update                      # self-update the binary
```

---
Confidence
90% confidence
Finding
`tene update` is a self-update capability that modifies the installed binary, which is risky in agent-driven environments because it changes executable code outside normal package-management controls. If suggested or run automatically, it could introduce unreviewed code changes or supply-chain compromise paths.

Self-Modification

High
Category
Rogue Agent
Content
| `tene passwd` | Change master password | — | ✅ (prompts) |
| `tene recover` | Restore via BIP-39 mnemonic | — | ✅ (prompts) |
| `tene version` | Version info | `--json` | ✅ |
| `tene update` | Self-update | `--check` | ✅ |
| `tene whoami` | Vault status | — | ✅ |

### Global flags (apply to all commands)
Confidence
90% confidence
Finding
The command reference marks `tene update` as AI-safe, which understates the risk of a self-modifying action. Labeling binary self-update as safe can lead downstream agents to execute it without review, opening the door to unauthorized code changes or supply-chain abuse.

External Script Fetching

High
Category
Supply Chain
Content
env:
  TENE_MASTER_PASSWORD: ${{ secrets.TENE_MASTER_PASSWORD }}
steps:
  - run: curl -sSfL https://tene.sh/install.sh | sh
  - run: tene run --env prod --no-keychain -- ./deploy.sh
```
Confidence
99% confidence
Finding
The CI example pipes `curl` directly into `sh`, causing unverified remote script execution in an automated environment that may also hold deployment secrets. This creates a high-impact supply-chain risk: compromise of the download endpoint or network path could immediately execute attacker-controlled code during deployment.

Chaining Abuse

High
Category
Tool Misuse
Content
env:
  TENE_MASTER_PASSWORD: ${{ secrets.TENE_MASTER_PASSWORD }}
steps:
  - run: curl -sSfL https://tene.sh/install.sh | sh
  - run: tene run --env prod --no-keychain -- ./deploy.sh
```
Confidence
99% confidence
Finding
The CI pipeline repeats the same chaining-abuse pattern in an even more sensitive context, where the job may have access to production deployment secrets and credentials. Combining automated secret usage with direct remote-script execution substantially amplifies the blast radius of any installer compromise.

Credential Access

High
Category
Privilege Escalation
Content
TENE_MASTER_PASSWORD: ${{ secrets.TENE_MASTER_PASSWORD }}
steps:
  - run: curl -sSfL https://tene.sh/install.sh | sh
  - run: tene run --env prod --no-keychain -- ./deploy.sh
```

Never set `TENE_MASTER_PASSWORD` in a developer machine's shell profile — it
Confidence
86% confidence
Finding
The CI example normalizes use of `TENE_MASTER_PASSWORD` in environment variables alongside secret-injected deployment, which can expose a highly sensitive master password to CI logs, process environments, or misconfigured runners if users copy the pattern carelessly. Although the text warns against developer-shell use, the guidance still encourages handling a vault-unlocking secret through environment-based automation.

External Script Fetching

High
Category
Supply Chain
Content
# Verify installation
tene version
# If "command not found":
curl -sSfL https://tene.sh/install.sh | sh

# Initialize vault in the project root
cd my-next-app
Confidence
98% confidence
Finding
The example instructs users to fetch and immediately execute a remote installer script with `curl ... | sh`, which removes any opportunity to inspect, verify, or pin the downloaded code before execution. If the hosting domain, TLS path, installer endpoint, or upstream release process is compromised, users could execute arbitrary code on their machine.

Chaining Abuse

High
Category
Tool Misuse
Content
# Verify installation
tene version
# If "command not found":
curl -sSfL https://tene.sh/install.sh | sh

# Initialize vault in the project root
cd my-next-app
Confidence
97% confidence
Finding
The `| sh` pattern is dangerous because it directly pipes untrusted network content into a shell, enabling immediate command execution without validation. In a security-sensitive secret-management skill, this is especially risky because users are being guided to install tooling that will handle credentials, making supply-chain compromise particularly impactful.

Credential Access

High
Category
Privilege Escalation
Content
rm .env

# Ensure .env stays out of source control
grep -q '^\.env$' .gitignore || echo '.env' >> .gitignore
grep -q '^\.env\.\*$' .gitignore || echo '.env.*' >> .gitignore

# Update npm scripts in package.json:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
tene set DATABASE_URL --env prod

# Bulk import from per-env .env files (if they exist)
tene import .env.local --env local --overwrite
tene import .env.prod  --env prod  --overwrite
rm .env.local .env.prod
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
tene set DATABASE_URL --env prod

# Bulk import from per-env .env files (if they exist)
tene import .env.local --env local --overwrite
tene import .env.prod  --env prod  --overwrite
rm .env.local .env.prod
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
tests/test.md:96