Versioned security assessment

Report ID: SA-3E4B6C31

7/9/2026, 8:57:52 AM

eightctl security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
eightctl
Version
v7
Maintainer
aiskillstore
Source
github.com/aiskillstore/marketplace/tree/main/skills/mylukin/eightctl/
Coverage
1 Files scanned · 51 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill intentionally directs the assistant to use the eightctl CLI for Eight Sleep pod operations, including temperature, alarms, schedules, audio, and base controls. Static findings for Markdown command examples are partly valid because they describe external command use, while the system reconnaissance and homepage URL findings are false positives. No prompt injection attempt was found, but the install metadata uses a mutable Go module target.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 51 Lines analyzed

11 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 10 evidence locations

Capability review items (10)
High
SKILL.md:31
Hidden file in home directory
- Config: `~/.config/eightctl/config.yaml`
The skill documents use of a hidden home-directory config path that may contain authentication material.
Medium
SKILL.md:27
Ruby/shell backtick execution
Use `eightctl` for Eight Sleep pod control. Requires auth.
The Markdown backticks are not Ruby execution, but the line explicitly instructs use of the external eightctl CLI.
Medium
SKILL.md:36
Ruby/shell backtick execution
- `eightctl status`
The line provides an external eightctl command that the assistant may run to check pod status.
Medium
SKILL.md:37
Ruby/shell backtick execution
- `eightctl on|off`
The line provides external eightctl commands that can change the pod power state.
Medium
SKILL.md:38
Ruby/shell backtick execution
- `eightctl temp 20`
The line provides an external eightctl command that can change the pod temperature.
Medium
SKILL.md:42
Ruby/shell backtick execution
- Alarms: `eightctl alarm list|create|dismiss`
The line provides external eightctl commands for alarm management.
Medium
SKILL.md:43
Ruby/shell backtick execution
- Schedules: `eightctl schedule list|create|update`
The line provides external eightctl commands for schedule management.
Medium
SKILL.md:44
Ruby/shell backtick execution
- Audio: `eightctl audio state|play|pause`
The line provides external eightctl commands for audio control.
Medium
SKILL.md:45
Ruby/shell backtick execution
- Base: `eightctl base info|angle`
The line provides external eightctl commands for base information and angle control.
Medium
SKILL.md:31
Hidden file access
- Config: `~/.config/eightctl/config.yaml`
The skill documents access to the eightctl config under the user's home configuration directory.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:14-18
Mutable Go Install Target
The install metadata uses github.com/steipete/eightctl/cmd/eightctl@latest, which can resolve to different code over time.
The metadata explicitly declares a Go module install using the latest target rather than a pinned version.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The install metadata uses a mutable Go module target.
    Pin the eightctl Go module to a reviewed version instead of using the latest target.
  2. FIX-002
    Medium
    The skill references credential-based authentication through config files and environment variables.
    Add guidance to avoid exposing passwords in shell history, logs, shared terminals, or process listings.
  3. FIX-003
    Medium
    The skill can change connected sleep device state.
    Keep the existing confirmation requirement before temperature, alarm, schedule, audio, or base changes.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable