skillboss

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs reading the API key from ./skillboss/config.json and to add it into a project's .env (and shows Authorization: Bearer ${SKILLBOSS_API_KEY} usage), which requires the agent to access and potentially output secret values verbatim (e.g., copying the apiKey), creating an exfiltration risk.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repo contains multiple intentional-in-behavior patterns that enable elevated/backdoor access and remote code replacement: a hard-coded SkillBoss API key in config.json, an explicit "admin bypass" (USER_EMAIL) that skips purchase checks, and updater/installer scripts that fetch and install code from the vendor using that API key (supply-chain / remote code execution vector) — together these create high-risk backdoor and supply-chain abuse opportunities.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime “scrape/search” workflow can fetch public web pages (outsider-authored free text) via user-supplied --url/--urls or --query, and that fetched page text is then passed into the agent’s LLM context through the scraping/extraction provider responses.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the provided skill content and the pre-filtered potential match.

Findings:

• The project's config.json (near the end of the document) contains a high-entropy API key in the "apiKey" field: it begins with "sk-gAAAAABpgoOjXEXc..." (this is the same value shown in the <potential_matches> section). This is a literal, long, random-looking API key stored in config.json — not a placeholder — and therefore qualifies as a real secret that should be removed/rotated and moved to a secure store (env vars, vault).
• Other tokens/examples in the doc are placeholders or low-entropy examples (e.g., REMOTION_MAPBOX_TOKEN==pk.your-mapbox-access-token, "your-api-hub-key", etc.) and are ignored per the rules.

Conclusion: there is an actual hardcoded API key present in config.json and it must be treated as a secret.

---

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly contains Stripe payment integration and commands/APIs to accept and manage payments. It includes a stripe-connect command to onboard Stripe Express, a Payment Architecture that routes transactions through shopping.heybossai.com to Stripe (handling webhooks, subscriptions, refunds), and APIs/dashboard endpoints to create products (price, billingType, etc.). These are specific payment gateway operations (subscriptions, one-time payments, refunds), so the skill provides direct financial execution capability.