raycast

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:28 AM UTC
• Version: 1.0.0

Overview

This Raycast extension reference skill is mostly coherent, but it includes unsafe examples that could lead agents to mishandle passwords, clipboard contents, browser data, or selected files.

Review generated code before using it, especially around password fields, clipboard reads, BrowserExtension data, AI prompts, OAuth tokens, LocalStorage/Cache, file writes, and trash actions. Require explicit user consent, redaction, and confirmation for sensitive data or file-modifying behavior instead of copying the examples as-is.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api/form.md:363

Finding

Password Form Examples Log Submitted Credentials

Content

View full analysis

console.log(values)} /> } > ); } ``` ```tsx import { ActionPanel, Form, Action } from "@raycast/api"; import { useState } from "react"; export default function Command() { const [password, setPassword] = useState(""); return ( console.log(values)} /> } > ); } ``` ### Technical Analysis Both examples pass the complete form values object to `console.log`. Because the form contains a `Form.PasswordField`, the logged object includes the submitted password in plaintext. A password field only conceals characters in the user interface; it does not automatically redact the value after submission. These examples therefore contradict the surrounding documentation stating that entered password characters must remain secret. Since the Skill directs agents to treat these API references as a primary source of truth, generated extensions may reproduce this unsafe pattern. ### Attack Path 1. A developer or coding agent copies one of the documented password-form examples. 2. A user enters a password and submits the form. 3. Raycast invokes `onSubmit` with an object containing the plaintext password. 4. `console.log(values)` serializes the complete object. 5. T ...[truncated 823 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: examples.md:57

Finding

Clipboard Contents Are Automatically Submitted to a Remote AI Service

Content

View full analysis

(""); const [loading, setLoading] = useState(true); useEffect(() => { async function summarize() { if (!environment.canAccess(AI)) { showToast({ style: Toast.Style.Failure, title: "AI access required" }); return; } const text = await Clipboard.readText(); if (!text) { showToast({ style: Toast.Style.Failure, title: "No text in clipboard" }); return; } try { const result = await AI.ask(`Summarize this: ${text}`); setSummary(result); } catch (e) { showToast({ style: Toast.Style.Failure, title: "AI request failed" }); } finally { setLoading(false); } } summarize(); }, []); ``` ### Technical Analysis The command reads the current clipboard immediately after loading and places its complete contents into an `AI.ask` prompt. AI processing inherently involves sending the prompt through Raycast's AI infrastructure or configured model provider. The network transfer is functionally necessary for the declared AI summarization feature, and the example correctly verifies API availability with `environment.canAccess(AI)`. It is therefore not covert or unrelated exfiltration. However, availability authorization does not establish user consent to transmit the particular clipboard value. Clipboards frequently contain passwords, API tokens, private keys, personal data, confidential messages, or proprietary source code. The example provides no preview, confirmation, sensitivity check, content-size restr ...[truncated 1299 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (60)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 5)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 25)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 26)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 77)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 118)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 119)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 287)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 407)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 420)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 432)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 440)May include surrounding context.

md

## Prerequisites

A Raycast extension can use OAuth for authorizing access to a provider's resources on the user's behalf. Since Raycast is a desktop app and the extensions are considered "public", we only support the [PKCE flow](https://datatracker.ietf.org/doc/html/rfc7636) (Proof Key for Code Exchange, pronounced “pixy”). This flow is the official recommendation for native clients that cannot keep a client secret. With PKCE, the client dynamically creates a secret and uses the secret again during code exchange, ensuring that only the client that performed the initial request can exchange the code for the access token (”proof of possession”).

{% hint style="info" %}
Providers such as Google, Twitter, GitLab, Spotify, Zoom, Asana or Dropbox are all PKCE-ready.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api/oauth.md (reported line 118)May include surrounding context.

md

## Token Refresh

Since access tokens usually expire, an extension should provide a way to refresh the access token, otherwise users would be logged out or see errors.
Some providers require you to add an offline scope so that you get a refresh token. (Twitter, for example, needs the scope `offline.access` or it only returns an access token.)
A basic refresh flow could look like this:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 16)May include surrounding context.

md

const cache = new Cache();

export default function Command() {
  const { isLoading, data, revalidate } = useFetch("https://api.example.com/items", {
    onWillExecute: () => {
      const cached = cache.get("items");
      if (cached) return JSON.parse(cached);

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example reads arbitrary clipboard contents and sends them directly to the AI service with AI.ask without an explicit user warning, confirmation step, or data minimization. Clipboard data often contains sensitive information such as secrets, tokens, personal data, or confidential text, so normalizing this pattern in sample code can lead developers to build extensions that exfiltrate sensitive data unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents Action.Trash, which moves files or folders to the Trash, but the action-specific section does not warn readers that it is a destructive operation or advise confirmation before use. Although a general note later mentions destructive styling and confirmation alerts, the Action.Trash documentation itself lacks a direct warning despite describing a user-data-affecting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file includes an example that streams AI output directly into the selected file path via fs.promises.writeFile, which can overwrite user data. Although the example shows status feedback, it does not warn users that the operation modifies the selected file's contents or that this may be destructive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'User Feedback' example writes AI-generated output to file.path, affecting user data, but the surrounding documentation only discusses progress feedback and completion messages. The markdown omits a user-facing warning that the example changes the selected file and may overwrite existing content.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api/ai.md (reported line 156)May include surrounding context.

md

The AI model to use to answer to the prompt. Defaults to `AI.Model["OpenAI_GPT-4o_mini"]`.

| Model                                          | Description                                                                                                        |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| OpenAI_GPT-5_mini                              | OpenAI's latest model, great for well-defined tasks and precise prompts.                                           |
| OpenAI_GPT-5_nano                              | OpenAI's latest model, great for summarization and classification tasks.                                           |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api/ai.md (reported line 181)May include surrounding context.

md

| Groq_GPT-OSS_20b                               | OpenAI's first open-source model, 20b variant.                                                                     |
| Groq_GPT-OSS_120b                              | OpenAI's first open-source model, 120b variant.                                                                    |
| Anthropic_Claude_4.5_Haiku                     | Anthropic's offering focusing on being the best combination of performance and speed.                              |
| Anthropic_Claude_4_Sonnet                      | Anthropic's most intelligent model.                                                                                |
| Anthropic_Claude_4.5_Sonnet                    | Anthropic's most intelligent model with the highest intelligence across most tasks.                                |
| Anthropic_Claude_4_Opus                        | Anthropic's model for complex tasks with exceptional fluency.                                                      |
| Anthropic_Claude_4.1_Opus                      | Anthropic's model for complex tasks with exceptional fluency.                                                      |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api/ai.md (reported line 202)May include surrounding context.

md

| Google_Gemini_3_Flash                          | Fast thinking model with strong balance of speed, performance, and value.                                          |
| Google_Gemini_3_Pro                            | Advanced thinking model for complex problem solving.                                                               |
| Google_Gemini_2.5_Pro                          | Advanced thinking model for complex problem solving.                                                               |
| Google_Gemini_2.5_Flash                        | Fast, well-rounded thinking model.                                                                                 |
| Google_Gemini_2.5_Flash_Lite                   | Fast model optimized for large-scale text output.                                                                  |
| Together_AI_Qwen3-235B-A22B-Instruct-2507-tput | A varied model with enhanced reasoning.                                                                            |
| Together_AI_DeepSeek-R1                        | Open-source model matching OpenAI-o1 performance.                                                                  |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api/ai.md (reported line 206)May include surrounding context.

md

| Google_Gemini_3_Flash                          | Fast thinking model with strong balance of speed, performance, and value.                                          |
| Google_Gemini_3_Pro                            | Advanced thinking model for complex problem solving.                                                               |
| Google_Gemini_2.5_Pro                          | Advanced thinking model for complex problem solving.                                                               |
| Google_Gemini_2.5_Flash                        | Fast, well-rounded thinking model.                                                                                 |
| Google_Gemini_2.5_Flash_Lite                   | Fast model optimized for large-scale text output.                                                                  |
| Together_AI_Qwen3-235B-A22B-Instruct-2507-tput | A varied model with enhanced reasoning.                                                                            |
| Together_AI_DeepSeek-R1                        | Open-source model matching OpenAI-o1 performance.                                                                  |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly demonstrates reading the contents of an open browser tab and copying that data to the clipboard, but it does not warn that page content may contain sensitive information such as emails, tokens, internal documents, or personal data. In an agent skill whose purpose is to help build Raycast extensions, this omission increases the risk that developers will implement privacy-invasive behavior without adding consent, minimization, or disclosure controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation describes enumerating open browser tabs and exposes URLs and related metadata, but it provides no warning that tab lists can reveal sensitive browsing activity, internal app locations, account identifiers, or other private context. In a development reference skill, lack of privacy guidance can normalize collecting or logging this metadata without user awareness or necessity.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api/caching.md (reported line 51)May include surrounding context.

md

#### Methods

| Method                                                                                       |
| :------------------------------------------------------------------------------------------- |
| <code>get(key: string): string \| undefined</code>                             |
| <code>has(key: string): boolean</code>                                         |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api/caching.md (reported line 138)May include surrounding context.

md

#### Parameters

| Name    | Description                                                                                                                | Type                |
| :------ | :------------------------------------------------------------------------------------------------------------------------- | :------------------ |
| options | Options with a `notifySubscribers` property. The default is `true`; set to `false` to disable notification of subscribers. | <code>object</code> |

Static analysis

No suspicious patterns detected.