Versioned security assessment
Report ID: SA-C8087C39
7/8/2026, 2:02:20 AM
modal security assessment v9
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- modal
- Version
- v9
- Maintainer
- davila7
- Source
- github.com/davila7/claude-code-templates/tree/main/cli-tool/components/skills/scientific/modal
- Coverage
- 13 Files scanned · 3,131 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
3 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static findings are documentation examples or Markdown fences rather than executable skill code. Confirmed risks involve credential setup, secret-backed environment variables, copying local cloud credentials, shell-based subprocess use, and Modal CLI commands that change local or cloud state. No prompt injection or overt malicious exfiltration intent was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
13 Files scanned · 3,131 Lines analyzed
38 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 1 evidence location
Network access
May connect to external services.
Observed in 11 evidence locations
Filesystem access
May read or write local files.
Observed in 12 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 83 evidence locations
Capability review items (35)
High
Generic API/secret keys
headers={"Authorization": f"Bearer {os.environ['API_KEY']}"}
The example sends an environment-provided API key in an outbound request header. It is not malicious, but it is real secret handling with external network exposure.
High
Hidden file in home directory
This creates credentials in `~/.modal.toml`. Alternatively, set environment variables:
The setup instructions create persistent Modal credentials in ~/.modal.toml. This is legitimate authentication, but creating hidden credential files must require explicit user consent.
High
Hidden file access
"/user/erikbern/.aws",
The example adds a local .aws directory into an image. Copying local cloud credential material into a remote container is a real credential exposure risk.
High
Hidden file access
remote_path="/root/.aws"
The example maps copied AWS credentials to /root/.aws in the container. This can expose durable cloud credentials to the remote runtime.
High
Generic API/secret keys
api_key = os.environ["API_KEY"]
The scheduled job reads an API key for use with an external data fetch. This is legitimate but should be treated as high-sensitivity secret handling.
High
Generic API/secret keys
data = fetch_external_data(api_key)
The API key is passed into an external data fetch helper. The helper implementation is not shown, so this remains a real credential-handling risk.
High
AWS credential environment variables
# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY automatically used
The example relies on AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the runtime environment. These are high-value cloud credentials.
High
Generic API/secret keys
secret_key = os.environ["MY_PASSWORD"]
The snippet reads a password-like secret from an environment variable. This is valid Modal Secret usage, but it is real secret exposure surface.
High
Generic API/secret keys
secret = modal.Secret.from_dict({"API_KEY": "secret-value"})
The example uses a literal API_KEY value in source. Even as a placeholder, this teaches a hardcoded secret pattern that should be avoided.
High
Generic API/secret keys
api_key = os.environ["API_KEY"]
The example accesses API_KEY from the environment. This is expected secret usage but remains sensitive credential handling.
High
Python subprocess.Popen
subprocess.Popen("python -m http.server -d / 8000", shell=True)
The example uses subprocess.Popen with shell=True to start a web server. The command is fixed, but shell=True increases command execution risk and should be avoided when possible.
High
Ruby/shell backtick execution
```bash
The command example creates a Modal secret from CLI arguments containing token-like values. Passing secrets on command lines can expose them through shell history or process metadata.
High
Hidden file in home directory
This creates a token stored in `~/.modal.toml`. The token authenticates all Modal operations.
The skill states that authentication stores a token in ~/.modal.toml. This is normal Modal setup but creates a persistent hidden credential file.
Medium
Python environment access
headers={"Authorization": f"Bearer {os.environ['API_KEY']}"}
The example reads API_KEY from the environment and places it in an Authorization header. This is expected for secret-backed APIs, but mishandling would expose a credential.
Medium
Hidden file access
This creates credentials in `~/.modal.toml`. Alternatively, set environment variables:
The setup instructions identify ~/.modal.toml as the Modal credential store. This hidden credential file is sensitive even though the usage is documented setup.
Medium
Python environment access
api_key = os.environ["API_KEY"]
The scheduled job reads API_KEY from environment variables. This is common with Modal Secrets, but it is still secret access inside a recurring cloud task.
Medium
Python environment access
local_secret = modal.Secret.from_dict({"FOO": os.environ["LOCAL_FOO"]})
The example reads a local environment value to build a Modal Secret. This is legitimate, but it moves local secret material into cloud configuration.
Medium
Python environment access
print(os.environ["FOO"])
The example prints an environment value inside a secret-backed function. If the variable contains a secret, this pattern can leak it to logs.
Medium
Python environment access
secret_key = os.environ["MY_PASSWORD"]
The example reads MY_PASSWORD from the environment. This is intended Modal Secret usage, but it handles password material directly.
Medium
Python environment access
api_key = os.environ["API_KEY"]
The example reads API_KEY from a secret-backed environment variable. This is legitimate but remains direct access to sensitive credential material.
Medium
Python environment access
password=os.environ["PGPASSWORD"],
The example reads PGPASSWORD from the environment for a database connection. This is direct password handling and should be treated carefully.
Medium
dotenv library
@app.function(secrets=[modal.Secret.from_dotenv()])
The example loads a dotenv file into a Modal Secret. Dotenv files often hold local credentials, so this requires explicit review before use.
Medium
Python file write/append
with open("/xyz.txt", "w") as f:
The snippet is labeled WRONG and shows writing to local container disk instead of a volume. It is included as an anti-pattern, but the filesystem write risk is real if copied without context.
Medium
Python environment access
if token.credentials != os.environ["AUTH_TOKEN"]:
The endpoint compares bearer credentials against AUTH_TOKEN from the environment. This is legitimate authentication, but it directly handles a secret token.
Medium
Ruby/shell backtick execution
```bash
The Markdown block instructs users to run package installation and Modal authentication commands. These are legitimate setup steps, but they execute local commands and create credentials.
Medium
Ruby/shell backtick execution
Run with: `modal run script.py`
The skill instructs running modal run script.py. This triggers cloud execution of user code and should not be auto-executed without approval.
Medium
Ruby/shell backtick execution
Run with: `modal run script.py`
The skill repeats the modal run script.py execution instruction. It is expected Modal usage but still launches external cloud execution.
Medium
Ruby/shell backtick execution
```bash
The command example deploys a Modal application. Deployment changes external cloud state and should require explicit user confirmation.
Medium
Hidden file access
This creates a token stored in `~/.modal.toml`. The token authenticates all Modal operations.
The skill names ~/.modal.toml as the credential location. Hidden credential files are sensitive and should not be read, copied, or modified without user consent.
Medium
Python environment access
token = os.environ["HF_TOKEN"]
The example reads HF_TOKEN from the environment. It is legitimate Modal Secret usage but handles a private model access token.
Low
Python HTTP libraries
response = requests.get(
The example performs an outbound HTTP request from a scheduled cloud function. This is legitimate Modal usage, but it introduces network egress that should be reviewed before production use.
Low
Python environment access
print(os.environ["USERNAME"])
The example prints an environment value loaded from a dotenv-backed secret. USERNAME may be low sensitivity, but printing secret-derived variables is risky.
Low
Python environment access
host=os.environ["PGHOST"],
The example reads database connection settings from environment variables. Host values are lower sensitivity, but they are part of a credential bundle.
Low
Python environment access
port=os.environ["PGPORT"],
The example reads the database port from the environment. This is low sensitivity by itself, but appears in a database credential pattern.
Low
Python environment access
user=os.environ["PGUSER"],
The example reads a database username from the environment. Usernames can be sensitive when combined with connection details.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (3)
RISK-001 High
Environment file access
From .env file:
The section introduces loading secrets from a .env file. That file commonly contains credentials and can be accidentally uploaded to cloud secrets.
RISK-002 High
Local Cloud Credentials Copied Into Container Image
The image documentation shows adding a local .aws directory and mapping it to /root/.aws in a remote container. This can transfer durable AWS credentials into cloud build or runtime environments.
The cited snippet explicitly copies a local .aws directory into a container path. The file context confirms this is credential material, not a generic cache.
RISK-003 High
Secret Values Shown In CLI Commands
The documentation demonstrates creating secrets with token-like values in shell commands. Real users copying this pattern may expose secrets through shell history or process metadata.
The cited command examples include KEY=value and API_TOKEN-style arguments. This is a common leakage path even when the documentation uses placeholder values.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighCredential directories are copied into container images.Remove examples that add local .aws directories. Use Modal Secrets or cloud identity features instead.
- FIX-002HighSecret values appear in CLI command examples.Use placeholder names only and recommend secure secret input methods that avoid shell history and process listings.
- FIX-003HighThe web server example uses subprocess.Popen with shell=True.Show an argument-list invocation without shell=True or use a framework-native server launch pattern.
- FIX-004MediumModal setup and deployment commands can create credentials or change cloud state.State that agents must request explicit approval before running modal token, modal run, modal deploy, or package installation commands.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable