check-agentkit-prod
Warn
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to execute
echo $SCALEKIT_CLIENT_SECRETin Step 2, which causes sensitive production credentials to be displayed in the clear within the agent's output history and session logs. - [DATA_EXFILTRATION]: In Step 2, the skill uses
curlto sendSCALEKIT_CLIENT_IDandSCALEKIT_CLIENT_SECRETas POST data to the address stored inSCALEKIT_ENVIRONMENT_URL. While intended for the vendor's API, this pattern transmits production secrets over the network and relies on a user-provided environment variable to define the destination. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
echo,curl,rg) to verify environment configurations, test API connectivity, and scan the local filesystem for hardcoded secrets.
Audit Metadata