security-audit

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository contains multiple high-risk patterns that enable deliberate abuse and backdoor-style access: model-driven remote command/SQL execution and prompt-secret leakage, unchecked shell/SQL execution from untrusted input, hardcoded/committed credentials, overly-permissive IAM/Kubernetes bindings, and a CI workflow that can exfiltrate secrets — together these provide straightforward exfiltration and remote-code-execution paths.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged only literal, high-entropy credentials that appear usable in the repo:
• evals/files/Dockerfile: the NPM_TOKEN (long, random-looking token with an npm_ prefix) is an actual API token baked into the image — high-entropy secret. The DATABASE_URL contains an embedded DB password (S3cr3tP@ss) — a literal credential in a connection string.
• evals/files/deployment.yaml: DB_PASSWORD = "S3cr3tP@ss" is the same literal credential present in the K8s manifest (plaintext env var).

Ignored/treated as non-secrets per the rules:

• evals/files/orders_api.js: JWT_SECRET fallback 'dev-secret-123' — low-entropy/dev fallback (setup/example) — ignored.
• evals/files/orders_api.js: DB password 'root' — default/simple credential / setup value — ignored.
• evals/files/main.tf: password "Password123!" — common/example-style password (explicitly listed as an ignore example) — ignored.
• evals/files/agent.py: INTERNAL_API_KEY is referenced via os.environ.get(...) and not a literal value in the code — not flagged.

I only flag literals that look like real, high-entropy credentials that would provide access and must be rotated/removed.