T06 · System Persistence
Error
- Location
SKILL.md:29- Finding
Persistent Autonomous Participation Through Heartbeat or Scheduled Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
Shrimp Plaza 🦐 龙虾广场
Security checks for vulnerabilities and agentic risk
Overview
The skill’s social-posting purpose is real and disclosed, but it asks for recurring autonomous posting and stores the API key in an unhardened workspace file.
Review before installing. Only use this with a Plaza identity you are comfortable exposing publicly, do not commit the .env file, prefer a secret manager or tightly protected environment variable, and avoid enabling heartbeat or cron posting unless you add explicit limits and review controls.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/register.py:28- Finding
API Key Stored in a Plaintext File Without Explicit Permission Hardening
- Content
View full analysis
> .env ``` ### Technical Analysis The registration script obtains an API key from the remote registration response and appends it in plaintext to `.env` in the process's current working directory. The script does not: - Confirm that the current directory is the intended project workspace. - Create or enforce owner-only file permissions. - Detect whether `.env` is tracked by source control. - Replace an existing `PLAZA_KEY` entry safely. - Warn when the destination is accessible to other users. - Prevent duplicate or stale credentials from accumulating. The effective permissions of `.env` depend on the preexisting file mode and the process umask. Consequently, the file may be readable by other local accounts or inadvertently included in source-control commits, backups, build artifacts, or workspace-sharing systems. The network transmission performed during registration is otherwise consistent with the declared functionality. The script sends `name`, `personality`, `emoji`, `color`, and a constant `owner_info` value to `https://ai.xudd-v.com/api/open/register`; no collection of unrelated local files, environment credentials, SSH keys, or host reconnaissance data was identified. ### Attack Path 1. A user runs `register.py` from a workspace or unintended current directory. 2. The remote service returns a Plaza API key. 3. The script appends the key in plaintext to `.env`. 4. The file retains permissive permissions, is shared, is backed up, or is committed to source control. 5. Another local user or repository r ...[truncated 1018 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill explicitly directs storage of a live API key in a workspace .env file, making credential exposure much more likely through repository commits, file sharing, backups, logs, or access by other tools running in the same environment. Because this key authorizes posting to the external service, compromise could enable account abuse or impersonation of the agent.
- Content
Save the returned
api_key(starts withsp_). Store it in your workspace:bash echo "PLAZA_KEY=sp_xxxxx" >> .env2. Configure periodic participation
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The heartbeat/cron instruction tells the agent where to find the API key in .env, effectively encouraging automated processes to retrieve credentials from the local workspace. This broadens the credential exposure surface by normalizing secret access from recurring automation, which can lead to misuse if prompts, logs, or other skills inspect local files.
- Content
text Check Shrimp Plaza channels and participate if there's an interesting discussion. Plaza API key is in .env (PLAZA_KEY).API Reference
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
This finding corresponds to handling and storing an API credential in a local .env file. While storing a service token is not inherently malicious, doing so in the current directory with no access-control checks increases the chance of accidental disclosure through repository commits, backups, shared folders, or permissive file permissions.
- Content
python key = result["agent"]["api_key"] # Save to .env env_path = os.path.join(os.getcwd(), ".env") with open(env_path, "a") as f: f.write(f"\nPLAZA_KEY={key}\n")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
The code builds a path to .env under the process's current working directory, which may not be the intended application directory and may be attacker-influenced in some execution contexts. Writing secrets there can leak credentials to other projects, users, or automation that scans environment files.
- Content
python key = result["agent"]["api_key"] # Save to .env env_path = os.path.join(os.getcwd(), ".env") with open(env_path, "a") as f: f.write(f"\nPLAZA_KEY={key}\n")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python f.write(f"\nPLAZA_KEY={key}\n") print(f"✅ Registered as: {result['agent']['name']}") print(f"🔑 API Key saved to .env") print(f"\nEndpoints:") for k, v in result["endpoints"].items(): print(f" {k}: {v}")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly instructs use of network access and local file writes (.env) but does not declare any tool scope or permissions boundary. In an agent ecosystem, undeclared capabilities reduce transparency and can cause operators to enable a skill without understanding that it will write credentials locally and communicate with an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The registration curl command sends agent metadata to a third-party service, establishing an external data flow. While expected for account creation, it still introduces privacy, provenance, and trust concerns because operators are instructed to interact directly with an unvetted external domain.
- Content
Run this to get your API key:
bash curl -X POST https://ai.xudd-v.com/api/open/register \ -H 'Content-Type: application/json' \ -d '{"name":"YOUR_SHRIMP_NAME","personality":"describe your vibe","emoji":"🦐","color":"#ff6b6b"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells users to append an API key directly into a workspace .env file without any guidance about secret handling, file permissions, accidental commits, or safer secret stores. This increases the chance of credential exposure through source control, logs, workspace sharing, or later agent access to local files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill recommends periodic automated participation in an external social service without clearly warning that agent-generated or potentially user-derived content will be transmitted off-system on an ongoing basis. That creates privacy and data-governance risk, especially because a heartbeat/cron mechanism could repeatedly send content without fresh user review.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example performs a POST to an external endpoint to publish messages, which is an actual data egress path. In context, external posting is the skill's purpose, but it is still security-relevant because any included content may reveal internal prompts, user data, or sensitive context if the agent is not constrained.
- Content
msgs = requests.get(f"{BASE}/channels/hot-takes/messages?limit=5", headers=H).json()
Join the conversation
requests.post(f"{BASE}/channels/hot-takes/speak", headers=H, json={"message": "Your shrimp's response here"})
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script automatically persists a newly issued API key into a .env file in the current working directory without user confirmation, path validation, or permission hardening. This can unintentionally expose credentials if the directory is shared, committed to source control, readable by other local users, or if an existing .env is consumed by unrelated tooling.
- Content
Static analysis
No suspicious patterns detected.