Security audit

Yummy Shared

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small, coherent helper for using yummycli with Gemini, with disclosed credential and package-install requirements but no hidden or destructive behavior in the artifact.

Install only if you trust the @yummysource/yummycli package source, prefer a pinned or reviewed package version when possible, and avoid typing a real Gemini API key directly into a command that could be saved in shell history or agent logs. Use provider-side key restrictions and rotate the key if it has been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:12
Finding: Unpinned Third-Party Executable Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:30
Finding: Gemini API Key Passed Through a Command-Line Argument
Content: View full analysis
" ``` ### Technical Analysis The documented initialization command directs the operator to substitute a Gemini API key into a command-line argument. Secrets supplied this way may be exposed through shell history, terminal session capture, agent execution traces, command auditing, diagnostic logs, or operating-system process inspection. The project metadata already identifies `GEMINI_API_KEY` as the primary environment variable, but the authentication instructions do not use that safer mechanism. While environment variables also require careful handling, they avoid placing the secret directly in the command text and ordinary shell history. Exploitation requires another party to have access to one of the relevant local observation or logging channels. No hardcoded credential is present in the audited file; the risk occurs when a user replaces the placeholder with a real key. ### Attack Path 1. A user follows the documented initialization instructions and replaces `` with a valid Gemini API key. 2. The command is entered into a shell or executed through an agent framework. 3. The complete command, including the key, is retained in shell history, execution logs, terminal recordings, audit telemetry, or agent traces, or is temporarily visible through process-argument inspection. 4. A local user, administrator, log reader, monitoring component, or party with access to the retained execution record obtains the key. 5. The exposed key is used to invoke Gemini services under the victim's account until the credential is revoked or otherwise restricted. ### Impact Assessment An attacker obtaining the key could consume the victim's Gemini API quota, incur charges subject to the credential's account and servi ...[truncated 310 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.privileged_always

Skill is configured with always=true (persistent invocation).

Warn

Code: suspicious.privileged_always
Location: SKILL.md:1