Skill

credentials

skill:smol-machines/smolvm#credentials

Gives a workload in a smolvm machine an API key or token it can use but never read, by binding the credential to named HTTPS hosts so the guest holds only a placeholder and the host substitutes the value on the way out, then proves on the host that the value never entered the machine. Use when an agent or untrusted code inside a machine has to call an API with your key; when deciding between a credential binding and --secret-env; when a request from a credentialed machine comes back 403 or 502 from smolvm itself; or when you need evidence that a key stayed out of a machine. Do not use it for a value the program must read and parse, such as a database URL, which is --secret-env, or for git and ssh keys, which is SSH agent forwarding.

SkillsMP

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 23:43 UTC at cd55588

findings

—

highest severity

threat classes

683

files scanned

209/212

checks satisfied

package advisories

Why this verdict

inconclusive: gap invalid_judge_finding
inconclusive: gap ledger_finding_without_valid_finding
inconclusive: gap no_dataflow_for_dynamic_code at docs/credentials/scripts/create-credentialed.sh
inconclusive: gap no_dataflow_for_dynamic_code at docs/credentials/scripts/verify-containment.sh
inconclusive: gap no_dataflow_for_dynamic_code at tests/mediated_egress_e2e.sh
inconclusive: gap no_dataflow_for_rust at crates/smolvm-credentials/src/ca.rs
inconclusive: gap no_dataflow_for_rust at crates/smolvm-credentials/src/intercept.rs
inconclusive: gap no_dataflow_for_rust at crates/smolvm-credentials/src/lib.rs
inconclusive: gap no_dataflow_for_rust at crates/smolvm-credentials/src/policy.rs
inconclusive: gap no_dataflow_for_rust at crates/smolvm-credentials/src/resolver.rs
inconclusive: gap no_dataflow_for_rust at crates/smolvm-protocol/src/intercept.rs
inconclusive: gap request_unanswered
inconclusive: judge runs incomplete or invalid
inconclusive: ledger 209/212 checks satisfied

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the open questions and coverage gaps below; 2 candidate findings were refuted on review.

Open questions 3

What the analysis could not settle from the code alone.

[file request docs/credentials/scripts/cleanup.sh] cleanup.sh's header says it deletes only machines recorded in its state file; does its body confirm deletion is limited to recorded names by default, and what exactly does --reap kill under this HOME?

Destructive action

[file request docs/credentials/scripts/cleanup.sh] Does cleanup.sh delete only machines recorded under the smolskill- prefix and avoid destroying or modifying anything else on the host?

Destructive action

[file request docs/credentials/scripts/cleanup.sh] Does cleanup.sh only delete the machines and temp state it created, with no broader file deletion or config modification?

Destructive action

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The skill's procedure directs the agent to run four local scripts (preflight.sh, create-credentialed.sh, verify-containment.sh, cleanup.sh) that read the host's API_TOKEN from the environment, but the scripts' contents are absent from the reviewed evidence, so undeclared handling of the credential value cannot be ruled out.

docs/credentials/SKILL.md:34-35

scripts/preflight.sh --var API_TOKEN --host api.example.com

Why it was refuted

The requested scripts are now served and dissolve the absence claim: preflight.sh only checks the variable's presence and never shows it or its length, create-credentialed.sh passes only the variable name (not the value) to --credential, verify-containment.sh pipes the value only to the declared guest grep and host record grep and sends it nowhere, and cleanup.sh never touches the value and deletes only machines it recorded -- exactly the handling the skill declares, so the feared undeclared credential handling does not exist.

Code execution

criticalRefutedlow confidence

The mediated-egress reference documentation instructs the reader to run the bundled script `bash tests/mediated_egress_e2e.sh`, which spins up VMs and local servers, signs a binary copy, and issues network calls — an execution step outside the credentials skill's declared task, though plausibly an honest repository test harness.

docs/mediated-egress.md:43-47

run the Bash VM test on a Linux KVM or Apple Silicon macOS host with an installed agent rootfs using `bash tests/mediated_egress_e2e.sh`

Why it was refuted

The run instruction is the artifact's own declared mandatory capability (D154), and the shipped script's visible body is a self-contained harness whose only rm -rf is guarded to its own mktemp directory, so the claim that this execution falls outside the declared task fails the undeclared and harm gates.