Security findings 6
Credential access
highContextual risklow confidenceThe agent authenticates with the well-known default Harbor admin password Harbor12345 when --pass is omitted, sending that credential to whatever URL is passed as the first argument.
password =
vector:code
Counter-argument considered
The claim is accurate and I found no neutralizing mitigation: the --pass override and the usage string lower severity but disclosure does not lift the harm or undeclared gates, and the default credential flows concretely from main() into authenticated requests against the operator-supplied URL.
Credential access
highContextual riskmedium confidenceThe harbor_api_call helper in scripts/process.py sends Harbor basic-auth credentials over a TLS session with hostname and certificate verification disabled (ssl.CERT_NONE), allowing a network attacker impersonating the Harbor instance to intercept the credentials.
ctx.verify_mode = ssl.CERT_NONE
vector:code
Counter-argument considered
No carve-out or mitigation applies: the helper deliberately builds a non-verifying SSL context and sends Basic-auth Harbor credentials over it, a concrete source-to-sink chain (credentials header into urlopen with ctx) that contradicts the skill's declared hardening purpose and is declared nowhere.
Data exfiltration
highContextual riskmedium confidenceThe auditor script process.py disables TLS certificate verification (ssl.CERT_NONE) while sending the Harbor admin username and password as Basic auth on every API call, exposing the credentials to interception — an undeclared behavior that contradicts the skill's declared security-hardening purpose.
ctx.check_hostname = False
vector:code
Counter-argument considered
I could not refute: disabling hostname and certificate verification while attaching Basic auth on every call is a real credential-exposure chain in shipped, runnable code; agent.py's verify=True is in a different script and is no mitigation here, and nothing in the declared claims covers or justifies it.
Data exfiltration
highContextual risklow confidenceSKILL.md's documented Harbor configuration and validation commands instruct curl with -k (TLS verification disabled) while embedding admin:Harbor12345 Basic-auth credentials, an undeclared practice that contradicts the skill's TLS-hardening purpose.
curl -k -X PUT
vector:instruction
Counter-argument considered
I looked for a carve-out (security-education payload, declared core capability) and found none: this is operational instruction, not an attack demonstration, and no declared claim covers disabling TLS verification; the commands are concrete agent-run instructions carrying default admin credentials over unverified TLS.
Credential access
highContextual risklow confidenceSKILL.md instructs the agent to run repeated curl commands against the Harbor API with TLS verification disabled via -k and the default admin password admin:Harbor12345 inlined on the command line, exposing the credential to interception and to shell history/process listings.
-H
vector:instruction
Counter-argument considered
The refutation candidates all fail: the placeholder hostname does not neutralize the taught pattern, in-artifact usage of a default password is not a declared core capability, and the skill gives no mitigation; the commands are concrete, reachable instructions that transmit the default admin credential on the command line with -k.
Supply chain
mediumContextual risklow confidenceSKILL.md instructs installing the Harbor Helm chart from the official helm.getharbor.io repository without pinning a chart version, so deployment pulls unpinned remote chart code (the install purpose is declared, the unpinned versioning is not).
helm install harbor harbor/harbor -f harbor-values.yaml -n harbor --create-namespace
vector:instruction
Counter-argument considered
Attempted refutation on the declared-core-capability carve-out fails: while installing Harbor is the declared purpose, the carve-out for official-registry installs is limited to pinned installs, and the instruction pulls the mutable chart with no --version pin, an undeclared supply-chain exposure in a directly executed skill instruction.
