W-Spaces Deploy

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:48 AM UTC
• Version: 1.0.0

Overview

This W-Spaces deployment skill matches its stated purpose, but it handles passwords and API keys in ways that can expose credentials and can silently send them to a non-default endpoint if the environment is changed.

Review before installing. Use this only in trusted shells or CI jobs, avoid passing real passwords where command history or logs are captured, do not commit .env files, avoid storing live keys in ~/.bashrc, verify WSPACES_API_URL is unset or exactly the intended W-Spaces API, and rotate any key that may have appeared in logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wspaces_auth.sh:24

Finding

Credentials Exposed Through Process Arguments and Plaintext Storage

Content

View full analysis

> ~/.bashrc source ~/.bashrc ``` `SKILL.md` also suggests plaintext `.env` storage: ```text WSPACES_API_KEY=wsk_live_xxxx... ``` ### Technical Analysis Passwords supplied through `--password` are recorded in the invoking shell's command history under common shell configurations. The script then embeds those passwords in the JSON argu ...[truncated 2526 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wspaces_auth.sh:6

Finding

Unvalidated API Endpoint Override Can Redirect Credentials and API Keys

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SETUP.md (reported line 29)May include surrounding context.

paces_auth.sh --register --email [e-mail] --password yourpass --name "Your Name"

text

**Check your email** and click the verification link.

**Login to get API key:**
```bash
scripts/wspaces_auth.sh --login --email [e-mail] --password yourpass

Copy the apiKey from the response.

2. Set the API key

bash

export WSPACES_API_KEY="wsk_live_xxxx..."

To persist:

bash

echo 'export WSPACES_API_KEY="wsk_live_xxxx..."' >> ~/.bashrc
source ~/.bashrc

3. Verify

bash

scripts/wspaces_auth.sh --me

Should return your user info and credits balance.

Usage

Just tell your agent:

• "Create a W-Spaces project called My App"
• "Push this HTML to W-Spaces"
• "Deploy to wspaces.app"

What It Does

• Create projects on W-Spaces
• Push HTML/CSS/JS code
• Deploy to live URLs (*.wspaces.app)
• Manage API keys
• View deployment history

What It Doesn't Do

• No code generation
• No AI website builders
• No magic — just deploys what you

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill only pushes HTML to an existing project while claiming project creation and deployment, users may grant trust or credentials for a more complete workflow than actually exists. In agentic systems, inaccurate capability claims undermine review, policy enforcement, and safe operator expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

If the skill only pushes HTML to an existing project while claiming project creation and deployment, users may grant trust or credentials for a more complete workflow than actually exists. In agentic systems, inaccurate capability claims undermine review, policy enforcement, and safe operator expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill only pushes HTML to an existing project while claiming project creation and deployment, users may grant trust or credentials for a more complete workflow than actually exists. In agentic systems, inaccurate capability claims undermine review, policy enforcement, and safe operator expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

If the skill only pushes HTML to an existing project while claiming project creation and deployment, users may grant trust or credentials for a more complete workflow than actually exists. In agentic systems, inaccurate capability claims undermine review, policy enforcement, and safe operator expectations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/wspaces-api.md (reported line 70)May include surrounding context.

[{ "id": "guid", "name": "string", "prefix": "wsk_live_xxxx", "createdAt": "datetime", "lastUsedAt": "datetime|null", "isRevoked": false }]

text

### DELETE /api/v1/auth/api-keys/{id}
Revoke an API key. **Requires auth.**

**Response 204** No Content

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell scripts but does not declare any explicit tool scope or allowed tools. In an agent environment, this weakens least-privilege controls and can allow the skill to be executed with broader shell access than users or reviewers expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to store a live API key in a local .env file without any warning about credential sensitivity, file permissions, or exclusion from source control. This increases the risk of accidental secret exposure through git commits, shared workspaces, logs, backups, or other local tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents revoking API keys and deploying projects, both of which can affect access or production state, but it does not include any cautionary language about their operational impact. Under the markdown-file criteria, descriptions should warn when actions may affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill for deploying static websites with API key authentication, supporting project creation, code push, and deployment. This script implements end-user account registration/login and API key lifecycle management, which is broader than deployment operations and not described as part of the skill's purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wspaces_auth.sh (reported line 39)May include surrounding context.

sh

echo "Error: --email, --password, and --name required"
            exit 1
        fi
        curl -s -X POST "$API_BASE/api/v1/auth/register" \
            -H "Content-Type: application/json" \
            -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\",\"name\":\"$NAME\"}" | jq .
        ;;

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wspaces_auth.sh (reported line 49)May include surrounding context.

sh

echo "Error: --email and --password required"
            exit 1
        fi
        curl -s -X POST "$API_BASE/api/v1/auth/login" \
            -H "Content-Type: application/json" \
            -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\"}" | jq .
        ;;

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

The script allows the API destination to be overridden via WSPACES_API_URL while sending the sensitive X-API-Key header to that endpoint. In a skill or agent environment, an attacker who can influence environment variables could redirect this request to a malicious server and capture API keys, making the external transmission materially more dangerous than a normal API call.

Content

Scanner excerpt · scripts/wspaces_auth.sh (reported line 69)May include surrounding context.

sh

exit 1
        fi
        KEY_NAME="${KEY_NAME:-API Key}"
        curl -s -X POST "$API_BASE/api/v1/auth/api-keys" \
            -H "X-API-Key: $WSPACES_API_KEY" \
            -H "Content-Type: application/json" \
            -d "{\"name\":\"$KEY_NAME\"}" | jq .

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill for deploying static websites, including project creation, code push, and deployment. This script also implements project listing and retrieval operations (--list, --get), which are management/discovery capabilities not mentioned in the manifest description. While related to the same service, they go beyond the specifically claimed deployment actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The script sends user-supplied project metadata to an external service via curl, authenticated with an API key. External transmission is expected for deployment tooling, but in this skill context it is still security-relevant because the destination can be overridden by WSPACES_API_URL and the transfer occurs silently, which could enable unintended data disclosure or credential misuse if the environment is manipulated.

Content

Scanner excerpt · scripts/wspaces_project.sh (reported line 44)May include surrounding context.

sh

[ -n "$DESCRIPTION" ] && BODY="$BODY,\"description\":\"$DESCRIPTION\""
        BODY="$BODY}"

        curl -s -X POST "$API_BASE/api/v1/projects" \
            -H "X-API-Key: $WSPACES_API_KEY" \
            -H "Content-Type: application/json" \
            -d "$BODY" | jq .

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script performs authenticated outbound requests to a remote API using a sensitive API key, but provides no explicit user-facing notice at execution time about what data is being sent or to which endpoint. In an agent skill context, this increases the risk of silent transmission of project names, descriptions, IDs, and metadata to an external service under user credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wspaces_push.sh (reported line 49)May include surrounding context.

sh

# Escape JSON special characters
HTML_ESCAPED=$(echo "$HTML_CONTENT" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')

curl -s -X PUT "$API_BASE/api/v1/projects/$PROJECT_ID/code" \
    -H "X-API-Key: $WSPACES_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"html\":$HTML_ESCAPED}" | jq .

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script sends HTML content, including data read from a local file, to a remote W-Spaces API via curl. Although the script's name suggests a push action, the file itself provides no explicit user-facing disclosure beyond implementation comments that local content will be transmitted off-host.

Content

No source excerpt is available for this finding.