Security checks for vulnerabilities and agentic risk
Overview
This InsForge SDK skill is not malicious, but it mixes frontend guidance with admin/backend operations and includes unsafe security-sensitive examples users should review before installing.
Install only if you are intentionally working on an InsForge project and review generated changes carefully. Pin the SDK version, do not copy examples that log tokens, keep admin tokens and bulk import/delete operations server-side only, require explicit confirmation for destructive actions, and harden any RLS SECURITY DEFINER functions before deployment.
### Technical Analysis
The installation command resolves the package through the mutable `latest` npm distribution tag. Consequently, the code installed by a user may differ from the code that existed when this Skill was reviewed.
This prevents reproducible installation and creates a supply-chain exposure. If the package publisher account, npm package, or release process is compromised, a future malicious release can become `latest` without any modification to this Skill. Depending on npm configuration and package contents, code could execute during installation through lifecycle scripts or later when the SDK is imported into an application.
The SDK dependency is relevant to the Skill's declared functionality, but automatically selecting an unrestricted future version exceeds the minimum dependency trust necessary for that functionality.
### Attack Path
1. An attacker compromises the package publisher account, release pipeline, or npm package.
2. The attacker publishes a malicious package version and assigns it the `latest` tag.
3. A developer follows the documented `npm install @insforge/sdk@latest` instruction.
4. npm resolves and installs the attacker-controlled release.
5. Malicious code executes through a lifecycle script or when the application imports and uses the SDK.
6. The dependency obtains the privileges of the installation process or application, potentially including access to source code, environment variables, build credentials, browser data supplied to the SDK, and network connectivity.
### Impact Assessment
Successful exploitation could result in arbitrary code execution in a developer or CI environment, compromise of application
...[truncated 457 chars]
Remediation
View remediation
Remediation Suggestions
Replace the mutable tag with a reviewed exact version:
bash
npm install --save-exact @insforge/sdk@1.1.0
The actual version should be the release reviewed and approved by the project, rather than assuming the example version above is appropriate.
Commit and enforce a lockfile such as package-lock.json.
Use npm ci in automated builds so dependency resolution cannot silently drift.
Review package provenance, release signatures where available, maintainers, and dependency changes before upgrades.
Configure dependency update tooling to submit explicit, reviewable version changes.
Consider disabling lifecycle scripts during dependency retrieval where compatible:
bash
npm ci --ignore-scripts
Run dependency installation and builds in a restricted environment without unnecessary production secrets.
T09 · Insecure Skill Coding Practices
Error
Location
auth/sdk-integration.md:117
Finding
Bearer Access Token Exposed Through Browser Console Logging
The example explicitly writes a bearer access token to the browser console. A bearer token grants access based on possession, so disclosure may permit replay without knowing the user's password.
Console output can be observed or retained by browser extensions, developer tools, automated test systems, remote-debugging sessions, support recordings, injected scripts that wrap console methods, and client-side telemetry products that capture console messages. Copying this example into production code therefore expands token exposure beyond the authentication SDK's intended session storage.
Retrieving the current session is necessary for authentication functionality, but logging the token is not required and exceeds minimum data exposure.
Attack Path
A developer copies the session example into an application.
An authenticated user opens the application, causing getCurrentSession() to return the active access token.
The application writes the token to the browser console.
A malicious or overprivileged browser extension, remote debugger, support operator, injected logging wrapper, or telemetry collector obtains the console output.
The attacker extracts the bearer token.
The attacker replays it in requests to the InsForge project before the token expires or is revoked.
Requests execute with the compromised user's authorization context.
Impact Assessment
An attacker may obtain the same API privileges as the affected authenticated user, including access to database rows, stor
...[truncated 372 chars]
Remediation
View remediation
Remediation Suggestions
Remove all access-token logging:
javascript
const { data, error } = await insforge.auth.getCurrentSession()
if (error) {
console.error('Unable to obtain the current session')
} else if (data.session) {
console.log('Authenticated user:', data.session.user.id)
}
Do not log refresh tokens, OTPs, password-reset tokens, cookies, authorization headers, or complete session objects.
Add centralized logging redaction for fields such as accessToken, refreshToken, authorization, cookie, otp, and password.
Disable or remove verbose authentication debugging in production builds.
Review browser telemetry and error-reporting tools to ensure console messages and request headers are not collected without redaction.
Use short-lived access tokens and effective revocation or rotation mechanisms to reduce the impact of accidental disclosure.
Add static-analysis rules that reject token-bearing values passed to console.* and logging APIs.
T05 · Unauthorized Access and Privilege Escalation
Error
Location
database/postgres-rls.md:95
Finding
Insufficiently Hardened SECURITY DEFINER Functions Can Enable Privilege Escalation
Content
View full analysis
Vulnerability Details
File Location: database/postgres-rls.md:95-112 Vulnerability Type: Unsafe privileged PostgreSQL function guidance Risk Level: High
Vulnerable Code
sql
-- DANGEROUS: This function runs as the calling role, so RLS is enforced
-- on every table it touches — creating recursion risk
CREATE OR REPLACE FUNCTION is_company_member(company_uuid UUID)
RETURNS BOOLEAN AS $$
SELECT EXISTS (
SELECT 1 FROM company_memberships
WHERE company_id = company_uuid AND user_id = auth.uid()
);
$$ LANGUAGE sql STABLE;
-- SAFE: SECURITY DEFINER runs as the function owner (postgres),
-- bypassing RLS on queried tables and breaking the recursion
CREATE OR REPLACE FUNCTION is_company_member(company_uuid UUID)
RETURNS BOOLEAN AS $$
SELECT EXISTS (
SELECT 1 FROM company_memberships
WHERE company_id = company_uuid AND user_id = auth.uid()
);
$$ LANGUAGE sql STABLE SECURITY DEFINER;
The guide then states:
markdown
**Rule: Any helper function called from an RLS policy MUST be `SECURITY DEFINER`** if it queries tables that also have RLS enabled.
Technical Analysis
A SECURITY DEFINER function executes with the privileges of its owner rather than the caller. This can be appropriate for breaking recursive RLS evaluation, but it creates a privileged execution boundary that must be explicitly hardened.
The documented function does not:
set a trusted search_path;
schema-qualify company_memberships;
establish a dedicated, minimally privileged owner;
revoke default EXECUTE permission from PUBLIC; or
grant execution only to intended roles.
If an attacker has CREATE rights in a schema searched before the intended object's schema, an unqualified object reference can resolve to an attacker-controlled object. The privileged function may then access that object under the function owner's privileges. This risk is configurat
...[truncated 2194 chars]
Remediation
View remediation
Remediation Suggestions
Use SECURITY DEFINER only after determining that the RLS design cannot safely avoid it.
Create a dedicated non-login, non-superuser function-owner role with only the required table privileges.
Schema-qualify every referenced function, table, type, operator where practical, and sequence:
sql
SELECT EXISTS (
SELECT 1
FROM app.company_memberships AS cm
WHERE cm.company_id = company_uuid
AND cm.user_id = auth.uid()
);
Set a trusted search path in the function definition:
sql
CREATE OR REPLACE FUNCTION app.is_company_member(company_uuid uuid)
RETURNS boolean
LANGUAGE sql
STABLE
SECURITY DEFINER
SET search_path = pg_catalog, app
AS $function$
SELECT EXISTS (
SELECT 1
FROM app.company_memberships AS cm
WHERE cm.company_id = company_uuid
AND cm.user_id = auth.uid()
);
$function$;
Remove default public execution and grant only the intended role:
sql
REVOKE ALL ON FUNCTION app.is_company_member(uuid) FROM PUBLIC;
GRANT EXECUTE ON FUNCTION app.is_company_member(uuid) TO authenticated;
Ensure untrusted roles cannot create objects in trusted schemas:
sql
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
Apply equivalent restrictions to every schema in the function's search path.
Avoid ownership by postgres or another superuser. Transfer ownership to the dedicated function-owner role.
Audit every definer function for SQL injection, mutable session state, unsafe dynamic SQL, unqualified references, and excessive grants.
Test policies under the actual anon and authenticated roles, not only an administrator or superuser.
Replace the blanket “MUST use SECURITY DEFINER” guidance with a risk-based recommendation that includes all mandatory hardening controls.
The skill documents a privileged DELETE endpoint that accepts arbitrary userIds under an admin bearer token, with no mention of guardrails such as authorization scoping, confirmation requirements, rate limiting, or protection against bulk misuse. In a code-generation skill, this is more dangerous because agents may operationalize the endpoint directly into tooling or admin flows that enable mass account deletion.
Content
Scanner excerpt · auth/backend-configuration.md (reported line 85)May include surrounding context.
The quick-reference table prominently lists the destructive delete-users endpoint with no adjacent warning, making it easy for an agent or developer to select and invoke the operation without appreciating its irreversible impact. While this line alone is duplicative of the main endpoint definition, the condensed presentation increases misuse risk in this skill context.
Content
Scanner excerpt · auth/backend-configuration.md (reported line 117)May include surrounding context.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · storage/sdk-integration.md (reported line 48)May include surrounding context.
Download File
javascript
// Get key from database
const { data: post } = await insforge.database
.from('posts')
.select('image_key')
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger criteria are broad enough to activate on generic requests like auth, file uploads, or database access even when the project may not use InsForge. In an agent setting, over-broad activation can misroute users into provider-specific code paths, causing incorrect integration advice, unintended data operations, or security-sensitive recommendations in the wrong environment.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The skill explicitly covers updating and deleting database rows, file deletion, and writing RLS policies, but the description does not warn that these actions can modify or remove user data or affect access control. For markdown files, omission of warnings about behaviors affecting user data or system integrity is in scope.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The file states that the skill covers client-side SDK integration and directs backend infrastructure operations to the separate insforge-cli skill. However, later sections provide detailed SQL for creating triggers, enabling RLS, and creating policies, which are backend/database configuration tasks rather than frontend SDK usage.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The skill explicitly says backend configuration should use another skill, yet it embeds trigger creation and RLS policy setup here. That mismatch can cause an agent to perform privileged backend changes in a frontend-assistance context, increasing the chance of unsafe schema, trigger, or access-control modifications without appropriate review.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The workflow walks users through enabling RLS, creating channel patterns, triggers, and publish paths without emphasizing production impact, privilege requirements, or access-control failure modes. In this context, mistakes can expose realtime channels, permit unauthorized publish/subscribe activity, or create overly permissive backend behavior that affects live data access.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The manifest and introduction say backend infrastructure operations should use insforge-cli, but this file later introduces backend configuration content for Auth and AI. Even if implemented through HTTP APIs rather than CLI, these are still backend configuration capabilities that exceed the stated client-side SDK integration scope.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · ai/sdk-integration.md (reported line 137)May include surrounding context.
md
| Mistake | Solution |
|---------|----------|
| ❌ Using unconfigured model IDs | ✅ Check configurations first via backend-configuration.md |
| ❌ Hardcoding model IDs without verification | ✅ Verify model exists in project's AI configurations |
| ❌ Ignoring errors | ✅ Always handle `error` in response |
| ❌ Storing base64 image data in database | ✅ Upload to storage, save URL/key to database |
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The documentation exposes a bulk user-deletion admin endpoint without any safety guidance such as confirmation prompts, dry-run behavior, audit logging, or scope restrictions. In an agent skill context, this increases the chance that generated code or operator actions invoke destructive account deletion too easily, leading to accidental or over-broad data loss.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · auth/sdk-integration.md (reported line 55)May include surrounding context.
md
console.log('Verified and signed in:', verifyData.user)
} else if (data?.accessToken) {
// No verification required — user is already signed in
console.log('Signed in:', data.user)
}
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · auth/sdk-integration.md (reported line 218)May include surrounding context.
md
console.log('Verified and signed in:', verifyData.user)
} else if (data?.accessToken) {
// No verification required — user is already signed in
console.log('Signed in:', data.user)
}
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The documentation explicitly logs data.session.accessToken, which encourages developers to print a bearer credential to browser consoles or logs. Access tokens are sensitive secrets; exposing them in logs increases the chance of theft through debugging tools, shared devices, log collection, screenshots, or third-party monitoring.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The password reset flow handles a reset code and exchanged reset token but provides no warning that these values are equivalent to authentication credentials for account recovery. Documentation omissions here can lead integrators to log, store, or transmit reset tokens insecurely, enabling account takeover if exposed.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The document presents a policy with FOR SELECT USING (true) as part of a generic "Minimal RLS Setup" without clearly constraining it to intentionally public data. Later sections correctly warn that USING (true) is overly permissive on sensitive tables, so the earlier example can mislead users into deploying globally readable access patterns in inappropriate contexts, causing unintended cross-user or cross-tenant data exposure.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The document mixes frontend SDK usage with backend SQL, table creation, triggers, and RLS policy setup, despite the skill metadata saying backend infrastructure belongs in a different skill. This scope confusion can cause an agent to generate privileged database configuration guidance in the wrong context, potentially leading to unsafe deployment practices or omission of the proper backend security review.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
This frontend SDK skill includes administrative HTTP bulk-upsert guidance that requires an admin token or API key, which is outside the stated frontend-only scope. In an agent skill, this can mislead users or downstream agents into placing privileged bulk data operations in client-facing code paths, increasing the risk of secret exposure and unauthorized mass data modification.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The bulk-upsert section explicitly shows use of an admin token or API key over an HTTP API but does not warn that these credentials are highly sensitive and must never be embedded in frontend applications. Given this skill is meant to assist frontend development, the omission materially increases the chance that privileged credentials and sensitive import data are handled in an unsafe client-side context.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
Stating that the SDK automatically includes the user's auth token without warning that authenticated user context is sent to the backend can cause developers to invoke functions with more identity data than they realize. This increases the risk of accidental exposure of user-scoped operations, sensitive claims, or unintended authorization behavior in downstream functions, especially in a frontend-focused skill where calls may be added broadly.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The document says it is about using the InsForge SDK to invoke serverless functions from a frontend application, but these lines instruct the user to create functions via admin API and verify deployment state. Creating or administering functions is backend infrastructure work, which the manifest explicitly says should use the insforge-cli skill instead.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · auth/backend-configuration.md (reported line 140)May include surrounding context.
md
| Mistake | Solution |
|---------|----------|
| ❌ Invoking without checking function exists | ✅ Verify function via admin API first |
| ❌ Invoking a draft function | ✅ Ensure function status is `"active"` |
| ❌ Ignoring errors | ✅ Always handle `error` in response |
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · auth/sdk-integration.md (reported line 230)May include surrounding context.
md
| Mistake | Solution |
|---------|----------|
| ❌ Invoking without checking function exists | ✅ Verify function via admin API first |
| ❌ Invoking a draft function | ✅ Ensure function status is `"active"` |
| ❌ Ignoring errors | ✅ Always handle `error` in response |
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · functions/sdk-integration.md (reported line 60)May include surrounding context.
md
| Mistake | Solution |
|---------|----------|
| ❌ Invoking without checking function exists | ✅ Verify function via admin API first |
| ❌ Invoking a draft function | ✅ Ensure function status is `"active"` |
| ❌ Ignoring errors | ✅ Always handle `error` in response |
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · storage/sdk-integration.md (reported line 99)May include surrounding context.
md
| Mistake | Solution |
|---------|----------|
| ❌ Invoking without checking function exists | ✅ Verify function via admin API first |
| ❌ Invoking a draft function | ✅ Ensure function status is `"active"` |
| ❌ Ignoring errors | ✅ Always handle `error` in response |
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
