Aicoo Onboarding

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 2.0.0

Overview

This onboarding skill is disclosed and product-related, but it needs Review because it pushes broad local data upload, all-scope sharing, and public/social actions without enough scoping or explicit consent.

Before installing, treat this as a high-trust Aicoo onboarding skill. Only use it if you are comfortable with selected local project/profile information being uploaded to Aicoo, and do not let it scan broad folders, Git history, memory files, secrets, customer data, or private notes by default. Review exactly what will be posted or shared, avoid scope all share links unless intentional, and store API keys in a safer secret store rather than a shell startup file.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:47
• Finding: Unrestricted Local Context Collection and External Synchronization<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47-66 **Vulnerability Type**: Excessive local data access and external disclosure **Risk Level**: High ### Vulnerable Code ```markdown ### 1c. Scan local context Read available local signals to understand the user: - `README.md`, `package.json`, `Cargo.toml` (project tech stack) - `docs/`, `notes/`, any markdown (domain knowledge) - Git history (what they're working on) - Claude memory files (if available) ### 1d. Sync to Aicoo ```bash curl -s -X POST "https://www.aicoo.io/api/v1/accumulate" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "files": [ {"path": "General/about-me.md", "content": "# [User Name]\n\n## Role\n...\n\n## Current Work\n..."}, {"path": "Technical/architecture.md", "content": "..."} ] }' | jq . ``` ``` ### Technical Analysis The skill directs the agent to inspect a broad and insufficiently bounded set of local resources, including arbitrary Markdown files, personal notes, Git history, and Claude memory files. It subsequently instructs the agent to transmit synthesized profile and architecture information to an external Aicoo API. No path allowlist, secret detection, sensitivity classification, file-by-file preview, or explicit approval checkpoint is required before transmission. The phrase “any markdown” can encompass credentials, internal documentation, customer information, private notes, and proprietary project records. Claude memory may also contain information collected in unrelated sessions. Although synchronization is part of the declared onboarding function, accessing all of these sources exceeds the least privilege needed to initialize an account. ### Attack Path 1. A user invokes the onboarding skill to initialize Aicoo. 2. The agent follows the instruction to inspect project files, notes, arbitrary Markdown files, Git history, and Claude memory. 3. Sensitive information is encoun ...[truncated 887 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace broad scanning with an explicit allowlist of user-selected files and directories. 2. Exclude Claude memory, hidden files, environment files, credentials, Git internals, and personal notes by default. 3. Do not interpret “any markdown” as authorization to scan recursively. 4. Run secret and sensitive-data detection before preparing an upload. 5. Display the exact file paths and complete outgoing content to the user before transmission. 6. Require affirmative, per-upload consent rather than treating skill invocation as blanket consent. 7. Minimize uploaded content by extracting only fields necessary for onboarding. 8. Document data retention, deletion, and revocation procedures. 9. Provide a local-only onboarding mode that does not synchronize project information. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:160
• Finding: Workspace-Wide Share Token Published Through an Open Discovery Post<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 160-207 **Vulnerability Type**: Excessive sharing scope and insecure access-control configuration **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST "https://www.aicoo.io/api/v1/os/share" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "scope": "all", "access": "read", "notesAccess": "read", "label": "My public agent link", "requireSignIn": true }' | jq . ``` ```text Your agent is now shareable! Link: https://www.aicoo.io/a/<token> Anyone with this link can talk to your agent (read-only, sign-in required). ``` ```bash curl -s -X POST "https://www.aicoo.io/api/square" \ -H "Authorization: Bearer $AICOO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "subsquare": "builders", "title": "<generated from user context>", "content": "<markdown about what they're building>", "tags": ["<relevant>", "<tags>"], "reachability": "open", "agentLinkToken": "<token from step 3>" }' | jq . ``` ### Technical Analysis The share operation uses `"scope": "all"` together with read access to notes. This grants the token access to the entire synchronized workspace instead of limiting it to information intentionally prepared for public use. The same token is then attached to a Square post configured with `"reachability": "open"`. While `"requireSignIn": true` prevents anonymous access, it does not enforce least privilege or limit access to specifically approved recipients. An authenticated third party who discovers the post may be able to interact with the shared agent using knowledge derived from all synchronized content. This is particularly dangerous when combined with the earlier broad local-context synchronization behavior. Material collected from notes, Git history, and agent memory can enter the workspace before a workspace-wide token is created. ### Attack Path 1. The onboardi ...[truncated 1131 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the default share scope from `"all"` to specifically selected public notes or folders. 2. Create a dedicated public folder containing only sanitized onboarding content. 3. Show the effective list of shared resources before token creation. 4. Require separate, explicit confirmation before: - Creating a share token. - Attaching the token to a post. - Publishing the post with open reachability. 5. Do not automatically reuse a general workspace token for public discovery. 6. Generate a separate least-privilege token for each intended audience. 7. Add a short expiration period and provide immediate revocation controls. 8. Restrict investor or private links to approved recipients where the platform supports it. 9. Warn users that sign-in requirements are not equivalent to private or recipient-restricted access. 10. Test agent responses for indirect disclosure before publication. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27
• Finding: Live API Key Recommended for Plaintext Shell-Profile Persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-35 **Vulnerability Type**: Plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```text To get started, you need an Aicoo API key. 1. Go to https://www.aicoo.io/settings/api-keys 2. Generate a key 3. Run: export AICOO_API_KEY=aicoo_sk_live_xxxxxxxx (Add to ~/.zshrc for persistence) ``` ### Technical Analysis The skill recommends adding a live API key directly to `~/.zshrc`. Shell startup files are plaintext configuration files and are commonly read by local tools, included in workstation backups, copied into dotfile repositories, or exposed in support bundles. Environment variables exported by the shell may also be inherited by unrelated child processes. This increases the number of processes and tools able to access the credential. The issue does not hardcode an actual credential in the repository, but it promotes an insecure credential-storage practice that can result in account compromise. ### Attack Path 1. The user generates a live Aicoo API key. 2. Following the skill instructions, the user writes the key into `~/.zshrc`. 3. A local process, malicious extension, backup reader, shared account user, or leaked dotfile repository obtains the shell configuration. 4. The attacker extracts the API key. 5. The attacker uses the key as a bearer credential against authenticated Aicoo endpoints. 6. Depending on server-side authorization, the attacker may initialize or inspect the workspace, upload data, create share links, manage network connections, or publish posts as the victim. ### Impact Assessment Credential disclosure could grant the attacker the API permissions assigned to the compromised key. Based on the documented endpoints, those permissions may include access to workspace status, notes, synchronization, sharing, network operations, and Square publication. The exact privilege level depends on server-side key scoping, which is not defined in the audi ...[truncated 94 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend storing live API keys directly in shell startup files. 2. Use the operating system credential manager, a dedicated secrets manager, or a platform-supported secure credential store. 3. Load credentials only for the process that needs them instead of exporting them globally to all child processes. 4. If environment-based configuration is unavoidable: - Store the secret in a separate file outside version-controlled directories. - Restrict permissions to the owning user. - Ensure the file is excluded from backups and source control where appropriate. - Source it only in the required execution context. 5. Support scoped, short-lived API tokens where possible. 6. Document key rotation and immediate revocation procedures. 7. Warn users never to paste credentials into chat, logs, examples, screenshots, or committed dotfiles. 8. Redact authorization headers and token values from diagnostic output. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Ssd 3

High

• Confidence: 99% confidence
• Finding: The onboarding flow encourages broad collection of local context, including project files, notes, git history, memory files, and owner profile data, then syncs that information to the cloud. This is dangerous because it normalizes over-collection at first run and can capture secrets, sensitive business information, or personal data outside the minimum required for setup.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill instructs reading local files and syncing that context to remote APIs without a clear warning that private project files, notes, and profile information will leave the local environment. This creates a significant privacy and confidentiality risk, especially during onboarding when users may not expect bulk data transmission.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill creates a shareable agent link with broad scope and read access to notes/content, but does not prominently warn the user about exposure of their information or ongoing inbound access. A user may unknowingly create a durable access channel to personal or project context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill directs publishing a public Square post derived from inferred user context as part of onboarding, which exceeds the minimum scope needed to get started. Public posting can disclose user identity, projects, interests, and agent reachability to a broad audience before the user fully understands the implications.

Context Leakage

High

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AICOO_API_KEY" | jq .
```

### Step 4: Explore and collect context

Ask startup basics (product, team, traction, boundaries), then scan local files.

• Confidence: 95% confidence
• Finding: The instruction to collect context by asking about product, team, traction, and then scanning local files encourages aggregation of highly sensitive business and technical information. In a first-time setup flow, this creates a strong risk of unnecessary context leakage because users may not realize that investor, customer, financial, and internal engineering details are being centralized and potentially transmitted.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The manifest uses broad triggers such as 'init', 'initialize', 'register', and 'API key', which could cause the skill to activate for generic setup conversations unrelated to this platform. Because the skill performs high-impact actions like scanning local files, syncing data, creating links, and posting publicly, overbroad invocation increases the chance of unintended execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

↓
2. DISCOVER — Find 10 interesting people, talk to their agents
      ↓
3. SHARE    — Create your own share link so others can reach you
      ↓
4. POST     — Use that link to post on Square (become discoverable)
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Generate a key
3. Run: export AICOO_API_KEY=aicoo_sk_live_xxxxxxxx

(Add to ~/.zshrc for persistence)
```

### 1b. Initialize workspace

• Confidence: 90% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1d. Sync to Aicoo

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/accumulate" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 96% confidence
• Finding: This command transmits local file content to an external API endpoint. In context, the transmission is intentional product behavior, but it is still security-relevant because the skill pairs it with broad local scanning and lacks meaningful consent and scoping safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The onboarding skill goes beyond setup by instructing the agent to search for other users, initiate chats with strangers' agents, and perform connect/request actions. These are externally visible actions on behalf of the user and can create unintended social/network effects without explicit, step-specific consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

For open posts — talk to their agent immediately:

```bash
curl -s -X POST "https://www.aicoo.io/api/chat/guest-v04" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "<agentLinkToken>",

• Confidence: 84% confidence
• Finding: This command sends a guest chat message to another user's agent. While not inherently malicious, it is an outbound network action performed during onboarding and can create unintended third-party interactions without explicit user direction.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Open posts — instant connect
curl -s -X POST "https://www.aicoo.io/api/v1/network/connect" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"shareToken": "<agentLinkToken>"}' | jq .

• Confidence: 92% confidence
• Finding: This command performs an external connect action on the user's behalf. Because connection state can affect the user's social graph and future interactions, performing or strongly steering this action during onboarding is risky without clear consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"shareToken": "<agentLinkToken>"}' | jq .

# Closed posts — send request
curl -s -X POST "https://www.aicoo.io/api/v1/network/request" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to": "<username>"}' | jq .

• Confidence: 91% confidence
• Finding: This command sends a network request to another user, creating an externally visible action attributed to the onboarding user. In context, this exceeds setup needs and may lead to unintended outreach or spam-like behavior if broadly triggered.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Goal**: User has a shareable link. Others can now reach them.

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/share" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 96% confidence
• Finding: This command creates a share object that exposes the user's agent and notes/content to others via a tokenized link. Even if intended, this is a high-impact external action because it changes access posture and can enable broad sharing of user context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs creation of an open public post linked to the user's agent without a clear warning about public discoverability, inbound interactions, and correlation with synced personal/work context. Users may unintentionally expose themselves to unsolicited contact or overshare sensitive information.

External Transmission

Medium

• Category: Data Exfiltration

Content

Use the share link token from Step 3 to create an **open** post:

```bash
curl -s -X POST "https://www.aicoo.io/api/square" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 97% confidence
• Finding: This command publishes content publicly to Square and associates it with the user's agent link token. The action is high impact because it combines public disclosure with a contact channel, amplifying privacy and reputation risks if performed from inferred context.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The example tells users to export a live API key directly in the shell with no guidance on secure handling, shell history exposure, process inspection, or safer alternatives. This can lead to accidental credential disclosure, especially when users copy/paste commands into shared terminals, recorded sessions, or persisted shell configs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to scan local files and bulk-sync documents to a remote service without warning that local content may include secrets, private documents, credentials, customer data, or internal architecture details. In an onboarding context, users are especially likely to follow these steps broadly, which increases the risk of oversharing sensitive material.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 5: Create first note (OS endpoint)

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 6: Bulk sync project docs

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/accumulate" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This step transmits project documents to a remote endpoint in bulk, which materially increases the chance of exposing proprietary or sensitive information during onboarding. Because the example encourages syncing architecture and pitch-deck materials, users may upload confidential business and technical data without adequate review.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: A first-time onboarding example should not normalize creation of external share links, especially for investor access, without a clear security checkpoint. This expands access beyond the local workspace and can expose sensitive company, product, financial, or technical information to unintended parties if the wrong folders are shared or the link is redistributed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The share-link step creates externally accessible access to workspace content but does not prominently warn the user that this is a publication or delegation action. Even with sign-in required, recipients outside the organization may gain access to sensitive information, and users may underestimate the consequences because the step is framed as routine onboarding.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 7: Create investor share link

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/share" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 94% confidence
• Finding: This API call creates a share artifact that enables external access to workspace content, making the transmission security-sensitive rather than a routine internal API operation. In the context of onboarding, presenting this as a standard step can cause users to expose data prematurely or too broadly.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/first-time-setup.md:16

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:45