Satgate

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:11 AM UTC
• Version: 2.0.0

Overview

The skill broadly fits its SatGate CLI purpose, but its install and MCP/proxy instructions create review-worthy supply-chain and credential exposure risks.

Review before installing. Use this only if you trust the SatGate GitHub releases and npm bridge, prefer a pinned/audited version, install to a user-owned directory when possible, avoid wrapping untrusted commands, and use short-lived least-privilege tokens that you can revoke. Do not place real tokens in shared MCP configs or committed files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:45

Finding

Downloaded CLI Binary Is Executed When Integrity Verification Fails Open

Content

View full analysis

/dev/null; then ACTUAL=$(sha256sum "$BINARY" | awk '{print $1}') elif command -v shasum &>/dev/null; then ACTUAL=$(shasum -a 256 "$BINARY" | awk '{print $1}') else echo "⚠️ No sha256sum or shasum found — skipping verification." ACTUAL="$EXPECTED" fi if [ "$EXPECTED" != "$ACTUAL" ]; then echo "❌ Checksum verification FAILED!" echo " Expected: $EXPECTED" echo " Actual: $ACTUAL" echo " The binary may have been tampered with. Aborting." exit 1 fi echo " ✓ Checksum verified." else echo "⚠️ Binary not found in SHA256SUMS — skipping verification." fi cd - >/dev/null fi # Install chmod +x "${TMPDIR}/${BINARY}" mkdir -p "$INSTALL_DIR" 2>/dev/null || true if [ -w "$INSTALL_DIR" ]; then mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}" else echo " Installing to ${INSTALL_DIR} (requires sudo)..." sudo mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}" fi echo "" echo ...[truncated 2733 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:96

Finding

Unpinned npm Bridge Is Executed with Access to a Capability Token

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/configure.sh:24

Finding

API Credentials Are Written Through Unescaped JSON Construction and Visible Terminal Input

Content

View full analysis

"$CONFIG_FILE" <

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents an operational CLI for managing an API economic firewall and performing actions like token minting, status checks, token validation, and command wrapping. The supplied code does not implement those management functions. Instead, it is a setup/configuration script that prompts the user for a cloud URL and API key and writes a local JSON config file in the user's home directory. This is a materially different primary purpose from the declared functionality, so the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a full terminal management tool for an API economic firewall with operational capabilities like minting and validating tokens and wrapping commands. The supplied code chunk is only a health-check script. Its primary purpose is diagnostic: confirm the CLI is installed, inspect config presence, and test gateway connectivity. While checking status/connectivity is loosely related to the broader tool, this code does not provide the main declared capabilities and therefore does not accurately represent the described functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents shell-capable operations but does not declare any explicit tool restrictions such as allowed-tools or permissions. In an agent setting, this creates an unnecessarily broad execution surface and makes it easier for the skill to invoke sensitive local commands without governance. The risk is amplified because the skill includes command-wrapping behavior intended to run arbitrary programs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs users to place an API key in an environment variable but omits warnings about secret handling, shell history, process inspection, logging, and persistence risks. In agent and terminal workflows, credentials in env vars are commonly exposed to child processes, debug output, or accidental commits, which can lead to unauthorized access to the SatGate tenant.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The wrap command is documented as injecting a bearer token into every outbound request, but the documentation does not clearly warn that this can propagate credentials to unintended destinations. If an agent or wrapped command contacts third-party hosts, redirects, telemetry endpoints, or untrusted services, the bearer token may be disclosed and reused to access protected resources or incur spend under the operator's account.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill explicitly encourages wrapping and running arbitrary commands ('Run any command') through a proxy that injects authentication material, with no documented restriction on command class or destination. In an agent context, this is dangerous because it can grant broad shell execution and automatic credential use to untrusted or overly capable workloads, increasing the chance of token exfiltration, misuse, or lateral access to external services.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Wrap an agent command through SatGate proxy

bash

# Run any command with SatGate as HTTP proxy — injects token automatically
satgate-cli wrap --token <macaroon> -- python my_agent.py
satgate-cli wrap --token <macaroon> --gateway https://gw.example.com -- node agent.js
satgate-cli wrap --token <macaroon> -- curl https://api.openai.com/v1/chat/completions

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Run any command with SatGate as HTTP proxy — injects token automatically

satgate-cli wrap --token -- python my_agent.py satgate-cli wrap --token --gateway https://gw.example.com -- node agent.js satgate-cli wrap --token -- curl https://api.openai.com/v1/chat/completions

text

The wrap command starts a local HTTP proxy that injects the SatGate Bearer token into every outbound request. Set `SATGATE_TOKEN` env var as an alternative to `--token`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MCP example shows a token placed directly in a plaintext configuration block without stating that it is a secret. Users may copy this pattern into config files, repos, screenshots, or shared workstation profiles, resulting in credential leakage and unauthorized use of the SatGate proxy.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/configure.sh (reported line 53)May include surrounding context.

sh

}
EOF

chmod 600 "$CONFIG_FILE"

echo ""
echo "✓ Config written to ${CONFIG_FILE}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 96)May include surrounding context.

sh

mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
else
  echo "  Installing to ${INSTALL_DIR} (requires sudo)..."
  sudo mv "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
fi

echo ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The installer runs the freshly downloaded binary immediately after installation via $INSTALL_DIR/$BINARY version. Even though the script attempts checksum verification, that verification is optional and can be skipped if SHA256SUMS is unavailable, the binary is missing from the checksum file, or no local hash tool exists, which means untrusted downloaded code may execute during install without explicit user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.