sprites

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds an explicit real API key and shows Bearer-token examples for API calls, which encourages the agent to include secret values verbatim in generated commands or requests.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High risk: the content contains a plaintext "Real API key" (an exposed hardcoded credential that functions as a direct backdoor) and provides explicit workflows for remote command execution (Exec/WebSocket), filesystem writes/reads, and TCP proxying — capabilities that, when combined with the leaked token, enable unauthorized remote code execution, persistent access, data exfiltration, and network pivoting.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly uses the Sprites HTTP/WebSocket API (e.g., https://api.sprites.dev/v1 and wss://api.sprites.dev/v1/sprites/{name}/exec) at runtime to write files and execute commands inside sprites, so those external endpoints can directly execute remote code for the agent.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The prompt contains a direct, high-entropy literal value: "7a4b2ef1a7b209016ce2670b6b01fc3066a3553bfae0b0745aaf44266dba724c". This is a long, random-looking hex string (not a placeholder or truncated value) and meets the definition of a secret (likely an API key). I ignored non-secrets such as the environment variable reference ($SPRITE_TOKEN) and the descriptive "shared_api_key via AM_SERVER_API_KEYS" (these are names/labels, not values). Because the hex string is present verbatim in the docs, it should be treated as an exposed credential and revoked/rotated.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent to run commands and modify files/services on Sprites (e.g. using the Exec/Filesystem APIs, running systemctl restart, editing configs, creating/deleting sprites), which are privileged operations that change the persistent system state of the microVMs (and it even includes a real API key), so it pushes the agent to perform state-changing actions.