Security audit

CPA Manager

Security checks for vulnerabilities and agentic risk

Overview

CPA Manager is a real CPA operations skill, but it deserves review because it can change or remove managed accounts and includes an opt-in shell command hook.

Install only if you intend to let an agent help administer a CPA deployment. Use a least-privilege management token, verify the CPA base URL before uploads or deletes, keep config/state/log/export files out of shared locations and version control, run scan or --no-delete-401 first, and require explicit human approval before maintain, upload, refill, re-enable, or auto_register operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The maintain-refill flow can execute an arbitrary external shell command from configuration via asyncio.create_subprocess_shell, which is far beyond ordinary CPA account scanning/upload operations. Because it inherits a full environment and accepts configurable working directory and command text, anyone who can influence config can achieve arbitrary code execution and potentially exfiltrate local secrets or pivot to the host.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The markdown provides direct commands for maintain, upload, and refill workflows that can delete 401 accounts, disable accounts, upload auth files, and otherwise modify remote CPA state, but it does not present a clear, prominent warning about destructive consequences before the commands are shown. In an agent skill context, this increases the chance of accidental execution against production infrastructure and unintended loss or corruption of account inventory.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script exports account inventory and status data to JSON files, including email, account identifiers, auth_index, chatgpt_account_id, and operational status details, without access controls or a clear warning at the export point. On shared systems or CI runners, these files can become unintended local data leaks that expose sensitive account metadata useful for follow-on abuse.

Static analysis

No suspicious patterns detected.