PropAI Sync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:01 AM UTC
• Version: 2026.2.28

Overview

This skill is coherent for PropAI Sync operations, but it asks agents to run deployment and login workflows with insufficient scoping and an unpinned executable dependency.

Review this skill before installing in an environment with Railway or production deployment credentials. Prefer pinning the Railway CLI, running deployment steps only after explicit user approval, using staging credentials by default, and changing smoke output to record only whether an API key was received rather than any literal key prefix.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/hosted-smoke.mjs:136
• Finding: Partial API Key Disclosure in Smoke-Test Output## Vulnerability Details **File Location**: `scripts/hosted-smoke.mjs`, lines 136-149 **Vulnerability Type**: Sensitive credential material exposed through logging **Risk Level**: Low **Vulnerable Code**: ```js console.log( JSON.stringify( { health_ok: Boolean(health?.ok), bootstrap_user: bootstrap.userId ?? null, api_key_prefix: apiKey.slice(0, 9), me_user: me.userId ?? null, me_api_keys: Array.isArray(me.apiKeys) ? me.apiKeys.length : null, run_dir: path.relative(repoRoot, runDir), }, null, 2, ), ); ``` ### Technical Analysis The script prints the first nine characters of a newly generated API key to standard output. This credential fragment is not required to establish that bootstrap or authenticated endpoint validation succeeded. Standard output is commonly retained in CI job logs, terminal transcripts, build artifacts, and handoff records. Consequently, the API-key prefix may remain accessible longer and to more users than the credential itself. Although a prefix alone ordinarily does not permit authentication, it reduces credential secrecy and may support correlation, identification, or guessing attacks if the remaining key material has insufficient entropy or is disclosed elsewhere. The API key is otherwise sent only to a loopback endpoint as part of the declared authenticated smoke test. That local transmission is necessary for the test and does not constitute external exfiltration. ### Attack Path 1. A user or CI runner executes the hosted smoke script. 2. The gateway issues an API key during bootstrap. 3. The script writes the first nine characters of that key to standard output. 4. CI infrastructure or another logging system retains the output. 5. An actor with access to those logs obtains the key prefix. 6. The actor correlates the prefix with separately exposed credential material or exploits weak remaining-key entropy, if suc ...[truncated 452 chars]
• Remediation: ## Remediation Suggestions - Remove the `api_key_prefix` field from smoke-test output. - Log only whether an API key was returned, such as `api_key_received: true`. - If run correlation is operationally necessary, calculate a one-way cryptographic digest of the key and expose only a short digest identifier rather than any literal credential characters. - Ensure smoke-test credentials are short-lived, restricted to test data, and revoked or invalidated after the run. - Configure CI systems to redact credentials and limit access and retention for smoke-test logs.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27
• Finding: Unpinned Railway CLI Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 27-29 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable Code**: ```md 1. Authenticate Railway CLI: - `npx @railway/cli login` - `npx @railway/cli status` ``` ### Technical Analysis The Skill directs users to execute `@railway/cli` through `npx` without specifying a reviewed version or requiring a locally locked installation. Depending on the local npm configuration and package availability, `npx` may retrieve the current package version from the package registry and execute it immediately. This makes effective behavior dependent on mutable upstream package state. A compromised package release, package-maintainer account, registry response, or unexpectedly incompatible future release could execute code that was not present during the Skill audit. The package name uses the expected Railway namespace, and there is no evidence in the reviewed files that the dependency is presently malicious; the risk arises from unpinned remote dependency execution. ### Attack Path 1. An attacker compromises the relevant package publication channel or causes a malicious or vulnerable version to be distributed. 2. A user follows the Skill instructions and runs `npx @railway/cli login` or `npx @railway/cli status`. 3. `npx` retrieves the unpinned package version from the configured registry. 4. Package installation hooks or CLI entry-point code execute on the user's workstation or CI runner. 5. The compromised code operates with the invoking process's permissions and can access resources available to that account. ### Impact Assessment Successful supply-chain compromise could allow arbitrary code execution with the privileges of the user or CI runner invoking `npx`. Depending on the environment, accessible resources may include repository contents, environment variables, deployment credentials, Railway authentication s ...[truncated 283 chars]
• Remediation: ## Remediation Suggestions - Pin `@railway/cli` to a reviewed exact version instead of resolving the latest available release. - Prefer declaring the CLI in the repository's development dependencies and committing the package-manager lockfile. - Execute the locked local binary, or use `npx --no-install`, so the command fails rather than downloading an undeclared package. - Enforce lockfile integrity and dependency review in CI. - Upgrade the pinned version deliberately after reviewing release notes, provenance, and security advisories. - Run deployment tooling in a restricted CI environment with narrowly scoped, short-lived credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to use networked operations and likely environment-backed credentials, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and increases the chance an agent executes sensitive network or credential-bearing actions without clear sandbox boundaries or user visibility.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly obtains an API key from a live bootstrap endpoint and reuses it against `/api/users/me`, but provides no warning or handling guidance for sensitive credentials or production-like hosted data. In an agent workflow, this can lead to accidental logging of secrets, inclusion in handoff notes, or use against live systems without informed user approval.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: Using `npx @railway/cli login` without pinning a version allows whatever package version is current at execution time to be fetched and run. In an agent context, this creates a supply-chain risk where a compromised or breaking upstream release could execute arbitrary code or alter authentication behavior during a privileged login flow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: Using `npx @railway/cli status` without a pinned version has the same runtime supply-chain exposure as the login command. Because it operates in a deployment-validation workflow, an unexpected package version could misuse local credentials, alter deployment checks, or misreport environment state.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/hosted-smoke.mjs:90

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/hosted-smoke.mjs:12