Skip to content
skillsafebeta
← Report library
Purpose / Development

Replicas Agent Skill Security Audit

What the author says it does (original text)

Guide for background coding agents running inside Replicas cloud workspaces

Independent security check

Do not install or run it yet

Files checked
10
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

CI executes an unpinned npx package with a global installation

Source references: 3
What we found

The validation workflow runs npx skills on pushes and pull requests, but the command pins neither the npm package version nor its integrity and uses a non-interactive global installation. When no matching local package exists, npx can resolve and execute package code from the registry.

Why this matters

If the current skills package release, resolution result, or dependency chain is compromised, third-party code could execute on the GitHub Actions runner and access checkout contents, job environment data, and permissions available to its GitHub token.

This workflow runs `npx skills add` on pushes and pull requests without pinning an npm package version or integrity value, using `--global -y`. If the runner resolves the package from a registry, package entry points or install scripts can execute with the CI job's authority. Impact depends on GitHub permissions, event type, and available secrets. Users can require an exact version or digest, disabled lifecycle scripts, and minimal workflow permissions.

.github/workflows/validate-skill.yml:3In the instructionsOpen original file
on:  push:    branches: [main]  pull_request:    branches: [main]
Show 2 other places
.github/workflows/validate-skill.yml:15In the instructionsOpen original file
      - uses: actions/setup-node@v4        with:          node-version: "20"      - name: Install skill        run: npx skills add . --all --global -y
.github/workflows/validate-skill.yml:19In the instructionsOpen original file
      - name: Install skill        run: npx skills add . --all --global -y
Medium risk

The preview restart procedure may terminate a service belonging to another task

Source references: 3
What we found

The guide requires services to persist as detached background processes and instructs the agent to stop an existing process on the same port before restarting, without requiring ownership verification or approval.

Why this matters

If another task, user, or important service owns the port, the agent could interrupt it and make a preview, development environment, or other workload unavailable. The replacement process also persists until workspace shutdown.

What this evidence establishes

The guide does say to stop a “prior detached process” on the same port before restarting, but gives no termination command, matching method, or authorization rule. “Prior” may mean only an earlier instance launched for the same task, so the evidence does not establish that unrelated services would be killed. A port-only implementation could still disrupt another task; users can require stopping only a verified PID launched by the current task.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/PREVIEWS.md:5In the instructionsOpen original file
## Running Services for PreviewServices must run as detached background processes so they survive after your command session ends. Do not leave them attached to a foreground terminal.
Show 2 other places
references/PREVIEWS.md:18In the instructionsOpen original file
After starting a service:1. Verify the process is running: `pgrep -af 'yarn dev'`2. Check logs for readiness: `tail -f /tmp/app.log`3. Confirm it's actually serving: `curl -s http://localhost:3000` (or appropriate health check)4. Only create the preview after the service is healthyIf a prior detached process exists on the same port, stop it before restarting.
references/PREVIEWS.md:7In the instructionsOpen original file
Services must run as detached background processes so they survive after your command session ends. Do not leave them attached to a foreground terminal.Some potential methods:```bash# Start a detached service with loggingsetsid -f bash -lc 'cd /path/to/app && exec yarn dev >> /tmp/app.log 2>&1'# For daemons like Dockernohup dockerd > /tmp/dockerd.log 2>&1 &```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

A configurable gateway URL receives the workspace engine secret

Source references: 4
What we found

The guide sends REPLICAS_ENGINE_SECRET as a Bearer credential to the address selected by the MONOLITH_URL environment variable, without requiring hostname validation or a fixed trusted endpoint.

Why this matters

If repository startup code, environment configuration, or a supply-chain component misconfigures or alters that variable, the request sends the workspace engine secret to that address. Its recipient may then be able to invoke Replicas gateway capabilities allowed by the secret.

The Google examples send the workspace engine secret as a Bearer credential to the host selected by `$MONOLITH_URL`. If that variable is misconfigured or altered by someone with access, the secret would be sent there. Users can ask whether the platform locks this variable and enforces HTTPS and an allowlisted host. The source says the agent does not receive the Google token itself, so the direct exposure is the engine secret and its gateway authority.

references/GOOGLE.md:7In the instructionsOpen original file
The integration is configured at the org or user level by the Replicas admin. From inside a workspace you don't have a Google access token directly; instead you call the monolith's `/v1/gdrive/*` endpoints, authenticated with your workspace's engine secret. The monolith refreshes the org's (or user's) Google access token and proxies the call.
Show 3 other places
references/GOOGLE.md:11In the instructionsOpen original file
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \  -H "X-Workspace-Id: $WORKSPACE_ID"```
references/GOOGLE.md:20In the instructionsOpen original file
Standard auth headers used by every call below:```Authorization: Bearer $REPLICAS_ENGINE_SECRETX-Workspace-Id: $WORKSPACE_ID```
references/GOOGLE.md:12In the instructionsOpen original file
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \  -H "X-Workspace-Id: $WORKSPACE_ID"```
Medium risk

Generated or externally shared media is copied to additional hosting services

Source references: 3
What we found

The guide requires agent-produced media to be uploaded to Replicas before it is even analyzed, and anything destined for Slack, Linear, or GitHub must also be uploaded to Replicas. GitHub screenshots are additionally directed to Imgur or another external host.

Why this matters

Screenshots and recordings may contain source code, customer data, tokens, notifications, or other on-screen information. Copies across Replicas, the destination platform, and an image host expand access, retention, and deletion complexity.

The guide requires agent-produced media to be uploaded to Replicas before analysis and requires media intended for external sharing to be copied there as well. GitHub images must additionally use Imgur or another host. This increases the number of stored copies and accessible links, potentially exposing code, personal data, or credentials visible in captures. It does not authorize automatic upload of unrelated user files, but users can require item-by-item approval, redaction, and no third-party image hosting.

references/MEDIA.md:11In the instructionsOpen original file
Upload to Replicas in these cases — and **only** these cases:1. **Media you produce.** Any screenshot, screen recording, generated diagram, or audio clip you create that the user might want to see. Upload before doing anything else with the file (analyzing, deleting, sending elsewhere). This applies even when you're also sending the file to Slack, Linear, GitHub, etc.2. **Files the user explicitly asks you to upload.** If the user sends or points at a file (image, video, audio) and asks you to upload it, run `replicas media upload`. Otherwise leave it alone — files in the workspace the user did not ask about should not be auto-uploaded as media.3. **Anything you plan to share externally (Slack, Linear, GitHub, etc.).** Upload to Replicas *in addition to* the platform's native upload. Never as a replacement.If none of these apply, don't upload.
Show 2 other places
references/MEDIA.md:63In the instructionsOpen original file
### On external platforms (Slack, Linear, GitHub, etc.)Do **both** of these — neither alone is sufficient:1. Upload the raw bytes via that platform's own upload API (Slack `files.upload`, Linear attachments, Imgur for GitHub PR/issue images, etc.) so the recipient actually sees the media.2. Include a `[View in Replicas](<deep-link>)` hyperlink — use the per-file deep link the CLI printed for that file (`...?mode=media&media=<media-id>`), so the recipient lands directly on that specific item.
references/GITHUB.md:117In the instructionsOpen original file
GitHub does NOT have a public API for uploading images to PRs/issues. When you need to include images:- Do NOT use placeholder image URLs- Do NOT commit screenshots as files to the repository- Upload images to Imgur (or another external host) and use the returned URLs in your PR markdown- If you were triggered from Slack, also upload the images to the Slack thread so the user can see them directly
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
High risk

Backend, API, and potentially database previews may be exposed without authentication

Source references: 4
What we found

The Skill supports public preview URLs for local services and explicitly recommends omitting preview authentication for backends and APIs. Its stated preview scope also includes databases.

Why this matters

If the service lacks strong authentication of its own, internet users could read data, invoke administrative endpoints, or trigger state-changing operations. Browser cross-origin requirements do not protect a public endpoint.

The Skill can turn web-app, API, and database ports into public URLs, and explicitly recommends leaving backend/API previews unauthenticated for cross-origin access. If such a service contains sensitive data, administrative endpoints, or trusts localhost, outsiders could reach it after a preview is created. This applies only when the agent creates a preview. Users can require authentication by default, restrict eligible ports, and verify application-level authorization before exposure.

SKILL.md:14In the instructionsOpen original file
### PreviewsExpose locally running services (web apps, APIs, databases) as public preview URLs so humans can interact with them directly.
Show 3 other places
references/PREVIEWS.md:28In the instructionsOpen original file
```bash# Expose a local port as a public URLreplicas preview create <port># Expose a port with authentication (requires Replicas login to access)replicas preview create <port> --authenticated
references/PREVIEWS.md:48In the instructionsOpen original file
**When NOT to use `--authenticated`:**- Backend APIs and other services that are called by frontend code. The frontend runs in the user's browser under a different origin, so it cannot forward the Replicas auth cookie to the backend. Making backends authenticated will cause cross-service requests to fail with 401 errors.**Rule of thumb:** Make frontend previews authenticated, leave backend/API previews unauthenticated.
SKILL.md:15In the instructionsOpen original file
### PreviewsExpose locally running services (web apps, APIs, databases) as public preview URLs so humans can interact with them directly.
Medium risk

Pre-authenticated external-account capabilities include high-impact changes without an additional confirmation gate

Source references: 6
What we found

The Skill supplies direct methods to merge and approve GitHub pull requests, change Linear issue state, and perform any Slack Web API operation. Although the overview associates these with relevant tasks, the references do not require target verification or fresh confirmation for high-impact actions.

Why this matters

An ambiguous task, incorrectly parsed link, or misleading instruction in externally retrieved content could cause real account changes in the wrong repository, issue, or channel.

The references show how pre-authenticated access can merge or approve PRs, change Linear issue state, and perform other Slack Web API operations. These are operational instructions, not warnings. Although the overview ties them to relevant tasks, it does not require target verification or fresh confirmation before merging, approving, changing state, or broad Slack actions. A misunderstood request could alter code, workflows, or communications. Users can restrict token scopes and require explicit confirmation of account, repository, item, channel, and action.

references/GITHUB.md:34In the instructionsOpen original file
# Merge a PRgh pr merge 123```
Show 5 other places
references/GITHUB.md:110In the instructionsOpen original file
# Submit a reviewgh pr review 123 --approvegh pr review 123 --request-changes --body "Changes needed"```
references/LINEAR.md:33In the instructionsOpen original file
### Updating Issue State```bashcurl -s -X POST https://api.linear.app/graphql \  -H "Authorization: Bearer $LINEAR_ACCESS_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "query": "mutation { issueUpdate(id: \"ISSUE_UUID\", input: { stateId: \"STATE_UUID\" }) { success issue { identifier state { name } } } }"  }'```
references/SLACK.md:64In the instructionsOpen original file
### Other OperationsYou can list channels, read channel history, add reactions, and perform any other operation supported by the Slack Web API using the same authentication pattern.
references/GITHUB.md:31In the instructionsOpen original file
# Review/check PR statusgh pr checks 123# Merge a PRgh pr merge 123```
references/GITHUB.md:107In the instructionsOpen original file
# View PR review commentsgh api repos/owner/repo/pulls/123/reviews# Submit a reviewgh pr review 123 --approvegh pr review 123 --request-changes --body "Changes needed"```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill guides an agent in a Replicas cloud workspace to use pre-authenticated CLIs, environment tokens, and a gateway for previews, Slack, Linear, GitHub, Google Workspace, Docker, media, and Replicas configuration.

View source
SKILL.md:8In the instructionsOpen original file
You are a background coding agent running inside a Replicas cloud workspace (a remote VM). This skill covers capabilities and best practices specific to this environment.## CapabilitiesThis skill provides detailed guides for the following capabilities. **Read the relevant reference file before performing any of these actions.**
SKILL.md:86In the instructionsOpen original file
### Replicas (in-workspace CLI)Take action *with* Replicas itself — manage automations, environments (variables, files), repos, and `replicas.json` config — using the pre-installed, pre-authenticated `replicas` CLI.**Reference:** `references/REPLICAS.md`

The Slack, Linear, and GitHub integrations can read data and make external changes, such as posting messages, commenting, changing issue state, and approving or merging pull requests; actual reach depends on the preconfigured tokens.

View source
references/SLACK.md:32In the instructionsOpen original file
### Sending a Message```bashcurl -s -X POST "https://slack.com/api/chat.postMessage" \  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "channel": "CHANNEL_ID",    "text": "Your message here",    "thread_ts": "OPTIONAL_THREAD_TS"  }'```Omit `thread_ts` to post a new message to the channel. Include it to reply in a thread.
references/LINEAR.md:33In the instructionsOpen original file
### Updating Issue State```bashcurl -s -X POST https://api.linear.app/graphql \  -H "Authorization: Bearer $LINEAR_ACCESS_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "query": "mutation { issueUpdate(id: \"ISSUE_UUID\", input: { stateId: \"STATE_UUID\" }) { success issue { identifier state { name } } } }"  }'```
references/GITHUB.md:31In the instructionsOpen original file
# Review/check PR statusgh pr checks 123# Merge a PRgh pr merge 123```
references/GITHUB.md:110In the instructionsOpen original file
# Submit a reviewgh pr review 123 --approvegh pr review 123 --request-changes --body "Changes needed"```

The Google integration is proxied through the Replicas gateway and claims to use the drive.file scope, limiting it to files the integration created or was granted access to; the guide also provides methods to share, edit, and delete those files.

View source
references/GOOGLE.md:33In the instructionsOpen original file
## Important constraint: drive.file scopeThe integration uses the **sensitive-tier `drive.file` scope**. That means Replicas can only read and edit Google files **it created itself**. It **cannot**:- Read or edit a user's pre-existing Google Docs, Sheets, or Forms — even ones that were shared with the connected Google account.- List or search the user's broader Drive.- Touch any file that was not created via these gateway endpoints.If the user asks you to edit an existing doc that Replicas didn't create, tell them this constraint and offer to create a new doc that mirrors what they want.
references/GOOGLE.md:188In the instructionsOpen original file
## Drive operations (only on Replicas-created files)### Share a file with a person```bashcurl -s -X POST "$MONOLITH_URL/v1/gdrive/files/$FILE_ID/permissions" "${GDRIVE_AUTH[@]}" \  -H "Content-Type: application/json" \  -d '{    "type": "user",    "role": "writer",    "emailAddress": "alice@example.com",    "sendNotificationEmail": true  }'```Roles: `reader`, `commenter`, `writer`. Types: `user`, `group`, `domain`, `anyone`.
references/GOOGLE.md:238In the instructionsOpen original file
### Delete a file```bashcurl -s -X DELETE "$MONOLITH_URL/v1/gdrive/files/$FILE_ID" "${GDRIVE_AUTH[@]}"```

The repository's GitHub Actions workflow runs on pushes and pull requests and globally installs this Skill through npx.

View source
.github/workflows/validate-skill.yml:3In the instructionsOpen original file
on:  push:    branches: [main]  pull_request:    branches: [main]
.github/workflows/validate-skill.yml:19In the instructionsOpen original file
      - name: Install skill        run: npx skills add . --all --global -y
Start here · InstructionsSKILL.md
replicas-agent
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 8
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records10 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/DOCKER.mdFull text included
  • references/GITHUB.mdFull text included
  • references/GOOGLE.mdFull text included
  • references/LINEAR.mdFull text included
  • references/MEDIA.mdFull text included
  • references/PREVIEWS.mdFull text included
  • references/REPLICAS.mdFull text included
  • references/SLACK.mdFull text included
  • .github/workflows/validate-skill.ymlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • .github/workflows/validate-skill.ymlSupporting file
  • SKILL.mdInstructions
  • references/DOCKER.mdSupporting file
  • references/GITHUB.mdSupporting file
  • references/GOOGLE.mdSupporting file
  • references/LINEAR.mdSupporting file
  • references/MEDIA.mdSupporting file
  • references/PREVIEWS.mdSupporting file
  • references/REPLICAS.mdSupporting file
  • references/SLACK.mdSupporting file

Operations mentioned in code and instructions

Install extra software packages
.github/workflows/validate-skill.yml:20In the instructionsOpen original file
      - name: Install skill        run: npx skills add . --all --global -y
Connect to websites
SKILL.md:97In the instructionsOpen original file
For *questions about how Replicas works* (concepts, pricing, what a feature does), check https://docs.replicas.dev first and only fall back to this skill when the user is asking you to take an action.
references/GOOGLE.md:12In the instructionsOpen original file
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \
references/GOOGLE.md:18In the instructionsOpen original file
- If `hasCredentials` is `true`: you're good to go.- If `hasCredentials` is `false`: Google has not been connected for this org. Ask the user to go to **Settings → Integrations → Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google operations until it's connected.
Run commands
references/DOCKER.md:7In the instructionsOpen original file
```bashsudo service docker start
references/DOCKER.md:13In the instructionsOpen original file
```bashdocker info
references/DOCKER.md:21In the instructionsOpen original file
- **Check before starting.** If you are unsure whether the daemon is already running, check first to avoid an unnecessary restart:  ```bash  docker info > /dev/null 2>&1 || sudo service docker start
Read keys or account settings
references/GOOGLE.md:12In the instructionsOpen original file
```bashcurl -s -X GET "$MONOLITH_URL/v1/gdrive/credentials" \  -H "Authorization: Bearer $REPLICAS_ENGINE_SECRET" \
references/GOOGLE.md:17In the instructionsOpen original file
- If `hasCredentials` is `true`: you're good to go.- If `hasCredentials` is `false`: Google has not been connected for this org. Ask the user to go to **Settings → Integrations → Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google o …
references/GOOGLE.md:18In the instructionsOpen original file
- If `hasCredentials` is `true`: you're good to go.- If `hasCredentials` is `false`: Google has not been connected for this org. Ask the user to go to **Settings → Integrations → Google** in the [Replicas dashboard](https://replicas.dev) and connect a Google account. Do not attempt Google operations until it's connected.
Lines read
1,041
File checksum (to compare versions)
5db54e57aa696b694f450d9eaa5e1a9883de139f25fe10b49b86de9bed47c029