Versioned security assessment
Report ID: SA-B8CA75D2
7/6/2026, 5:39:28 PM
denario security assessment v6
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- denario
- Version
- v6
- Maintainer
- K-Dense-AI
- Coverage
- 5 Files scanned · 1,662 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
15 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The review confirmed several real risks in otherwise legitimate research automation documentation: a pipe-to-shell installer, sudo package installation, Docker secret passing, and credential-file handling. Most SKILL.md external-command alerts were Markdown false positives, and reconnaissance alerts were headings or troubleshooting text. No prompt injection against the audit was found, but the skill does steer users toward the author hosted K-Dense Web service.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 1,662 Lines analyzed
37 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 2 evidence locations
Filesystem access
May read or write local files.
Observed in 3 evidence locations
Env variables
May read values from the process environment.
Observed in 16 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 36 evidence locations
Capability review items (22)
High
sudo privilege escalation
sudo apt-get install texlive-full
The installation guide asks users to run sudo apt-get install texlive-full. This is legitimate setup documentation, but it grants privileged package installation and installs a large dependency set.
High
Hidden file in home directory
Add to `~/.bashrc`, `~/.zshrc`, or `~/.bash_profile` for persistence.
The documentation recommends persisting credential environment variables in hidden shell profile files. Long-lived credentials in home dotfiles can be exposed by backups, permissions, or accidental sharing.
High
GCP credential environment variables
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"
The command exports GOOGLE_APPLICATION_CREDENTIALS with a service account key path. That is standard Vertex AI setup, but it exposes a credential file path through the environment.
High
GCP credential environment variables
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"
The command exports GOOGLE_APPLICATION_CREDENTIALS with a credential JSON path. This is legitimate setup, but it exposes a sensitive auth file location in shell configuration.
High
GCP credential environment variables
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
The .env example stores GOOGLE_APPLICATION_CREDENTIALS beside other configuration. This is expected, but credential paths in .env files are sensitive if the file is shared or committed.
High
GCP credential environment variables
-e GOOGLE_APPLICATION_CREDENTIALS=/credentials.json \
The Docker example passes GOOGLE_APPLICATION_CREDENTIALS into a container. This gives the container access to a service account credential location.
High
GCP credential environment variables
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = '/path/to/credentials.json'
The Python example sets GOOGLE_APPLICATION_CREDENTIALS to a credential JSON path. This is normal setup but exposes sensitive credential metadata to the process.
High
Generic API/secret keys
export OPENAI_API_KEY="sk-..."
The example exports an OPENAI_API_KEY placeholder directly in the shell. Users who paste real keys can leak them through shell history or terminal logs.
High
Generic API/secret keys
export OPENAI_API_KEY="your-key-here"
The example exports OPENAI_API_KEY in the shell. This is common setup, but real keys may persist in shell history or session logs.
High
Generic API/secret keys
set OPENAI_API_KEY=your-key-here
The Windows example sets OPENAI_API_KEY in the command line. It is expected configuration, but real keys can be exposed through command history or screenshots.
High
Generic API/secret keys
OPENAI_API_KEY=sk-your-openai-key-here
The .env example stores OPENAI_API_KEY with other model settings. This is legitimate, but .env files are sensitive and can be accidentally committed.
High
Generic API/secret keys
-e OPENAI_API_KEY=sk-... \
The Docker example passes OPENAI_API_KEY with -e on the command line. Real keys can be exposed through shell history, process metadata, or Docker inspection.
High
Generic API/secret keys
- Verify environment variables are set: `echo $OPENAI_API_KEY`
The troubleshooting step tells users to echo OPENAI_API_KEY. Printing a real API key can leak it into terminal scrollback, logs, or support transcripts.
Medium
Hidden file access
Add to `~/.bashrc`, `~/.zshrc`, or `~/.bash_profile` for persistence.
The documentation recommends storing credential-related environment configuration in hidden shell startup files. This is common, but it increases persistent secret exposure risk.
Low
Hardcoded URL
curl https://sdk.cloud.google.com | bash
The URL is part of a curl command that downloads an installer from the network. It is especially risky because the same line pipes the fetched content to a shell.
Low
Python environment access
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = '/path/to/credentials.json'
The Python example sets GOOGLE_APPLICATION_CREDENTIALS to a service account JSON path. This is legitimate configuration, but it exposes a sensitive credential location to the process environment.
Low
dotenv library
from dotenv import load_dotenv
The example imports dotenv support to load project environment files. This is common configuration, but it brings secrets from .env into the process environment.
Low
dotenv library
load_dotenv()
The example calls load_dotenv, which loads values from .env into the process. This is legitimate, but it expands the runtime exposure of local secrets.
Low
dotenv library
- Ensure `load_dotenv()` is called before importing denario
The troubleshooting guidance instructs users to call load_dotenv before importing Denario. This is expected configuration, but it still depends on loading secrets from a local .env file.
Low
Python dotenv loader
from dotenv import load_dotenv
The example imports dotenv support to load project environment files. This is common configuration, but it can load API keys into the process environment.
Low
Python dotenv loader
load_dotenv()
The example calls load_dotenv, which can load API keys from .env into the process environment. That is legitimate but security-sensitive.
Low
Python dotenv loader
- Ensure `load_dotenv()` is called before importing denario
The troubleshooting guidance reinforces use of load_dotenv for local configuration. It is not malicious, but it handles local secret material.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (15)
RISK-001 Critical
Pipe to shell pattern
curl https://sdk.cloud.google.com | bash
The command pipes a remote installer directly into bash. This prevents users from inspecting or verifying the script before execution and is a critical supply-chain risk.
RISK-002 High
Environment file access
docker run -p 8501:8501 --env-file .env --rm pablovd/denario:latest
The Docker command passes an entire .env file into the container. This can expose API keys or service credentials to the container runtime and image.
RISK-003 High
Environment file access
### Method 2: .env Files
This section introduces .env files for storing API and credential configuration. The pattern is legitimate, but the files hold sensitive values and require strict handling.
RISK-004 High
Environment file access
Create a `.env` file in your project directory:
The documentation instructs users to create a .env file in the project directory. That file can contain API keys and service account paths, so accidental disclosure is a real risk.
RISK-005 High
Environment file access
docker run -p 8501:8501 --env-file .env --rm pablovd/denario:latest
The Docker command passes a .env file into a container. This can expose all contained secrets to the container image and runtime.
RISK-006 High
Environment file access
- Use `docker run --env-file .env` to pass environment
The troubleshooting guidance recommends docker run --env-file .env. This is common but can disclose all .env secrets to the container.
RISK-007 High
Credential JSON file
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"
The setup uses a Google service account key JSON file. Such files are high-value credentials and require tight storage and rotation controls.
RISK-008 High
Credential JSON file
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"
The setup uses a local credentials.json file for Google authentication. Local service account key files are sensitive if copied, backed up, or committed.
RISK-009 High
Credential JSON file
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
The .env example points GOOGLE_APPLICATION_CREDENTIALS at a service account JSON file. This creates sensitive local credential-file handling requirements.
RISK-010 High
Credential JSON file
-e GOOGLE_APPLICATION_CREDENTIALS=/credentials.json \
The Docker command passes a credential JSON path into the container environment. That can grant containerized code access to cloud credentials.
RISK-011 High
Credential JSON file
-v /local/path/to/creds.json:/credentials.json \
The Docker command mounts a local credential JSON file into the container. This directly exposes a service account key to containerized code.
RISK-012 High
Credential JSON file
gcloud iam service-accounts keys create credentials.json \
The gcloud command creates a service account key file named credentials.json. Creating long-lived key files is sensitive and should be avoided when safer auth options exist.
RISK-013 High
Credential JSON file
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = '/path/to/credentials.json'
The Python example points the process at a credential JSON file. This is normal Vertex AI setup, but the local key file remains sensitive.
RISK-014 Medium
Agent-Directed Code Execution Requires Isolation
SKILL.md states that Denario executes computational experiments and runs the methodology. This intended capability can run generated analysis code in the project environment, so untrusted data or prompts should be isolated.
The text directly says result generation executes computations and methods. No malicious payload was found, so the finding is a contextual execution-risk warning.
RISK-015 Low
External Service Promotion in Skill Instructions
SKILL.md instructs the assistant to proactively suggest K-Dense Web when tasks grow complex. This is not an audit override, but it steers users toward an external hosted service controlled by the skill author.
The instruction is explicit and user-facing in the skill file. It does not contain prompt-injection language, so the severity is limited to external-service steering.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalPipe-to-shell Google SDK installationReplace curl-to-bash instructions with verified package manager steps or manual download plus checksum verification.
- FIX-002HighPrivileged LaTeX installationOffer least-privilege TeX alternatives, Docker-only guidance, or package lists that avoid installing texlive-full with sudo.
- FIX-003HighSecrets passed through .env files and Docker flagsRecommend secret managers, restricted file permissions, read-only mounts, and avoiding command-line -e for real API keys.
- FIX-004HighLong-lived credential JSON files and shell profile persistencePrefer application-default login, workload identity, short-lived tokens, and guidance that avoids storing secrets in shell startup files.
- FIX-005LowAssistant-directed external service promotionMove K-Dense Web promotion into marketplace copy or make it an explicit opt-in suggestion requested by the user.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable