Skillboss

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:15 AM UTC
• Version: 0.1.4

Overview

SkillBoss mostly matches its app and AI gateway purpose, but it uses broad local and remote authority with credential persistence and an automatic updater path that can run an uninspected shell script.

Install only if you are comfortable with a Bash-based gateway that sends prompts, files, deployment bundles, emails/SMS requests, product changes, and payment setup requests to SkillBoss/HeyBoss services. Keep API keys out of client-side code and public repositories, review any install/update.sh before allowing updates, and use the deployment/product/email/SMS commands only for projects and recipients you explicitly intend to modify or contact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (146)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The description presents a very broad fullstack application platform with deployment, databases, payments, auth, and serverless/webhook features. The supplied code chunk instead implements a command-line multi-provider API client/hub focused on AI/media, search/scraping, documents, email, and SMS verification. That overlap is real for AI generation, email, presentations, scraping/search, document parsing, and SMS verification, but major declared capabilities such as Cloudflare deployment, DB integrations, Stripe, and general auth are not evidenced here. More importantly, the code includes an undeclared capability: contacting a remote service to check versions and automatically running a local update shell script (`install/update.sh`) via `execSync`, which is materially different from the declared gateway description. Because the code's actual behavior is narrower in some areas and includes undeclared self-update/script execution behavior, this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The supplied code chunk only provides chat-completion request preparation and dispatch. It accepts chat-related parameters, constructs a messages array, optionally sets system/max_tokens/temperature, and calls run(). Nothing in this snippet implements or directly interfaces with deployment, databases, payments, auth, media generation, communications, scraping, document processing, or serverless/webhook features described in the declaration. While the declared description could refer to a larger skill, this specific code chunk materially underdelivers relative to that broad stated purpose and instead has a much narrower primary behavior: chat completion orchestration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description claims a comprehensive gateway/platform with many major capabilities across app deployment, databases, payments, authentication, AI generation, scraping, parsing, messaging, and APIs. The actual code shown only provides fetch retry logic for transient network failures and rate limiting. While this helper could support such a platform internally, the chunk itself does not implement or expose those declared capabilities. This is a material description-to-code mismatch in primary purpose, not merely an omitted implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a very broad platform/gateway for fullstack app development and many service integrations. The supplied code chunk is much narrower and has a different concrete purpose: a command-line product manager for an e-commerce/shopping backend. It performs CRUD operations on products through /api/shopping-service/admin-products endpoints and relies on local configuration files plus an API key for authorization. This is a materially different primary behavior from the declared purpose. While product management could loosely relate to ecommerce, the description does not accurately represent this code chunk's actual functionality, and most declared capabilities are absent from the code shown.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This code chunk does not implement or expose any of the major capabilities described. It only configures CSS tooling for a worker ecommerce template. While such configuration could be a minor supporting detail within a larger fullstack project, the supplied code itself is narrowly focused and does not accurately represent the declared broad gateway functionality. Therefore, for this chunk, the description materially overstates what the code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code chunk does not implement or expose the broad gateway functionality described. It is فقط a Tailwind configuration file for scanning HTML/React source files and setting theme/plugins. While a Tailwind config could be a supporting detail inside a larger ecommerce template, this specific chunk’s actual behavior is narrowly focused on CSS tooling and does not substantively match the declared primary purpose of a multi-capability fullstack/AI gateway. Therefore, the description materially overstates what this code chunk does.

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node ./scripts/api-hub.js version

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `Authorization: Bearer <your-api-key>`
**API Key:** Read from `~/.config/skillboss/credentials.json` -> `api_key` field, or `skillboss/config.json` -> `apiKey` field

## Code Examples (TypeScript/JavaScript)

• Confidence: 97% confidence
• Finding: The documentation instructs developers to read an API key from local credential files and integrate it directly into app code. In the context of public-facing apps, this creates a serious risk that the secret will be embedded in client-side code, exposed to users, or reused insecurely, enabling unauthorized API use and billing abuse.

Credential Access

High

• Category: Privilege Escalation

Content

```typescript
// Read API key from credentials file or config.json
const API_KEY = '<your-api-key>' // from ~/.config/skillboss/credentials.json or config.json
const API_BASE = 'https://api.heybossai.com/v1'

// ============================================================================

• Confidence: 98% confidence
• Finding: The example shows assigning the API key into application code from local credentials/config and then using it in Authorization headers. In a skill focused on helping build apps, developers may copy this pattern into frontend code, leaking the credential to end users and enabling account takeover of API usage, data access through the API, and cost theft.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup Steps

1. Run `./scripts/skillboss auth trial` or `./scripts/skillboss auth login` to get an API key
2. The key is auto-saved to `~/.config/skillboss/credentials.json` and `config.json`
3. Use the code patterns above, adjusting for your specific model

• Confidence: 94% confidence
• Finding: Telling users that keys are auto-saved to predictable local file paths increases the chance those secrets are mishandled, copied into code, or accidentally committed. In combination with the rest of the document's integration guidance, this makes insecure secret handling more likely for less experienced developers.

Credential Access

High

• Category: Privilege Escalation

Content

pnpm i mapbox-gl @turf/turf @types/mapbox-gl
```

The user needs to create a free Mapbox account and create an access token by visiting https://console.mapbox.com/account/access-tokens/.

The mapbox token needs to be added to the `.env` file:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

The mapbox token needs to be added to the `.env` file:

```txt title=".env"
REMOTION_MAPBOX_TOKEN==pk.your-mapbox-access-token
```

• Confidence: 96% confidence
• Finding: The file explicitly instructs placement of an access token in `.env` without any safeguards or caveats. Although Mapbox public tokens are often intended for client use, presenting it generically as a secret-bearing env var can mislead users into unsafe handling and accidental disclosure through commits, logs, or build output.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script performs a network version check and then automatically executes a local shell updater via execSync with no integrity verification, explicit opt-in, or trust boundary hardening. That creates a software supply-chain and arbitrary code-execution path: if the update source, local update script, or install directory is tampered with, running ordinary CLI commands can trigger unintended code execution.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/api-hub.js:804

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/stripe-connect.js:112

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/client.js:112