Security audit
permission-vending-machine
Security checks for vulnerabilities and agentic risk
Overview
The skill's code largely matches its stated purpose, but there are multiple inconsistencies and insecure defaults (undeclared credentials/binaries, a public HTTP approval surface that can approve the most-recent request without a token, and instructions to run a persistent daemon) that warrant caution before installing.
What to consider before installing: - Metadata mismatch: The skill metadata declares no required credentials or binaries, but the code and docs require many sensitive credentials (IMAP/SMTP user+password, Sendblue API/CLI, Discord/Telegram/Slack tokens/webhooks). Treat config.yaml as containing secrets and store it securely. - Exposed HTTP approval surface: The daemon binds an HTTP approval server and will, if a token is missing or not found, approve the most-recent pending request. If you run the server bound to non-local interfaces (0.0.0.0) or allow external access, an attacker could trigger approvals. Before deploying, inspect server.py, restrict the bind address to localhost or behind an authenticated proxy, and limit firewall/network exposure. - Mail and SMS approvals are simple and can be spoofed if mailbox or phone routing is compromised. IMAP polling looks for plain 'APPROVE'/'DENY' text and an optional token; do not rely on this as a sole secure approval mechanism. - Missing declared dependency: the code invokes the 'sendblue' CLI via subprocess for iMessage/SMS confirmations. Install and audit that binary, or disable Sendblue channel if you don't run macOS or don't trust the CLI. - Run safely first: run the service in a restricted environment (local container or VM), point http_approval_base to localhost, enable only channels you control, and test end-to-end with non-destructive dummy scopes. Review and/or harden the HTTP routes (require tokens, signatures, or network restrictions) and consider adding strict token validation so that arbitrary requests cannot approve the most-recent pending grant. - Audit persistence: the vault DB stores grants and audit logs on disk. Ensure the DB path is placed in an appropriate directory with correct permissions and that backups/rotations are considered. - If you lack the ability to audit the full server code or to harden the deployment, treat this skill as high-risk for automatic inclusion on systems that host sensitive data or expose services to untrusted networks.
Static analysis
No suspicious patterns detected.