lambda-labs

A secret, credential, or private key read by the shell flows into a network command (curl/wget/nc), exfiltrating it off-host. The data reaches the network through a variable, a pipe, a redirection, or a process substitution. Never pipe secrets to a remote endpoint; if the upload is intentional, send a non-sensitive derived value over an authenticated, audited channel instead.

taint source (line 1): $LAMBDA_API_KEY → sink: curl -u $LAMBDA_API_KEY: \

A secret, credential, or private key read by the shell flows into a network command (curl/wget/nc), exfiltrating it off-host. The data reaches the network through a variable, a pipe, a redirection, or a process substitution. Never pipe secrets to a remote endpoint; if the upload is intentional, send a non-sensitive derived value over an authenticated, audited channel instead.

taint source (line 1): $LAMBDA_API_KEY → sink: curl -u $LAMBDA_API_KEY: \

A secret, credential, or private key read by the shell flows into a network command (curl/wget/nc), exfiltrating it off-host. The data reaches the network through a variable, a pipe, a redirection, or a process substitution. Never pipe secrets to a remote endpoint; if the upload is intentional, send a non-sensitive derived value over an authenticated, audited channel instead.

taint source (line 1): $LAMBDA_API_KEY → sink: curl -u $LAMBDA_API_KEY: \

The documentation provides examples using environment variables for API keys in shell commands, which risks leaking credentials into shell history files.

curl -u $LAMBDA_API_KEY: https://cloud.lambdalabs.com/api/v1/instance-types

The documentation encourages users to store API keys in environment variables and provides shell commands that use these variables in plain text, increasing the risk of accidental exposure in shell history or logs. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

curl -u $LAMBDA_API_KEY: https://cloud.lambdalabs.com/api/v1/instance-types

SSH authorized_keys injection — attempts to add persistent SSH access

echo 'ssh-rsa AAAA...' >> ~/.ssh/authorized_keys

NER model detected organization in skill content (confidence: 0.52)

C***

NER model detected organization in skill content (confidence: 0.53)

T*******

NER model detected organization in skill content (confidence: 0.57)

P******

NER model detected organization in skill content (confidence: 0.63)

c*

NER model detected organization in skill content (confidence: 0.76)

O********

NER model detected organization in skill content (confidence: 0.78)

T*********

NER model detected organization in skill content (confidence: 0.84)

L**********

NER model detected organization in skill content (confidence: 0.98)

N***

NER model detected organization in skill content (confidence: 0.99)

M**

NER model detected organization in skill content (confidence: 0.58)

S*

NER model detected organization in skill content (confidence: 0.64)

G*

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

SKILL.md links to "references/advanced-usage.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Advanced Usage](references/advanced-usage.md)

SKILL.md links to "references/troubleshooting.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Troubleshooting](references/troubleshooting.md)