Security audit

Popcorn CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for using Popcorn generation services, but it installs an unpinned external CLI and handles a plaintext API key, so users should review it before installing.

Install only if you trust the npm package publisher and are comfortable with Popcorn receiving generation prompts, task parameters, selected uploaded files, and related metadata. Use a limited API key where possible, avoid shared machines and CI logs, restrict access to ~/.popcorn-cli/config.json, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party CLI Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:105
Finding: API Key Exposed Through Command Arguments and Plaintext Configuration Storage
Content: View full analysis
``` ```text ~/.popcorn-cli/config.json ``` ```json { "apiKey": "" } ``` The documentation states that the API key is saved as a plaintext secret in this configuration file and supplied to backend requests through the `X-API-Key` header. ### Technical Analysis The configuration workflow accepts the API key as a command-line argument and persists it in plaintext under the user's home directory. Command-line secrets may be exposed through: - Shell history. - Process listings or process inspection facilities while the command is running. - Terminal recording and command telemetry. - CI logs or agent tool-call logs that capture invoked commands. Plaintext configuration storage additionally allows any local process or user with read access to the file to recover the credential. The documentation recommends restricting access but does not indicate that secure file permissions are programmatically enforced. It also does not establish that operating-system credential storage is used. ### Attack Path 1. A user or agent invokes `popcorn-cli config set-key `. 2. The API key is captured in shell history, process arguments, execution telemetry, or an agent log; alternatively, it is written to `~/.popcorn-cli/config.json`. 3. A local user, compromised process, log reader, or other actor with access to the user's files obtains the key. 4. The attacker uses the stolen key to authenticate to the Popcorn backend. 5. The attacker performs operations permitted to that key, potentially including querying tenant models and tasks, submitting generation requests, managing folders, uploading resources, or retrieving associated metadata and res ...[truncated 725 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The section explicitly mandates how the agent should speak to users in Chinese, including required phrasing and translations, but does not provide any user opt-in or alternative locale handling. This is a natural-language locale policy issue because it constrains user-facing responses to a specific language without choice or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing description and default prompt are written entirely in Chinese, which imposes a language choice in the skill's natural-language interface. The file does not indicate that the skill is region-specific or that users can opt into another language, so this appears to violate the language/locale policy criteria.
Content: No source excerpt is available for this finding.