stash-cli
Configures and manages CipherStash EQL for PostgreSQL databases, facilitating project setup and encryption schema management.
Install this skill
Security score
The stash-cli skill was audited on Jul 27, 2026 and we found 19 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
Access to hidden dotfiles in home directory
| 3 | description: Drive CipherStash setup and encryption migrations through the `stash` CLI — `init`, `plan`, `impl`, `status`, `auth login`, `eql install/upgrade/status`, `db validate`, `encrypt backfill/ |
Access to hidden dotfiles in home directory
| 68 | `auth login` runs an OAuth 2.0 device-code flow: pick a region, approve in a browser, then the device is bound to the workspace's default keyset. Credentials and a development key are written to the ` |
Access to hidden dotfiles in home directory
| 99 | never inspect `~/.cipherstash` (see "Never read these"). |
Access to hidden dotfiles in home directory
| 111 | - `~/.cipherstash/secretkey.json` — the development key |
Access to hidden dotfiles in home directory
| 112 | - `~/.cipherstash/auth.json` — OAuth token and JWTs |
Access to hidden dotfiles in home directory
| 113 | - anything under `~/.cipherstash/workspaces/` |
Access to hidden dotfiles in home directory
| 165 | generated locally and stored in `~/.cipherstash/telemetry.json`, not derived |
Access to hidden dotfiles in home directory
| 179 | | `npx stash telemetry disable` | Persists opt-out to `~/.cipherstash/telemetry.json` | |
Access to hidden dotfiles in home directory
| 183 | apply). State lives in `~/.cipherstash/telemetry.json` — a non-secret file |
Access to hidden dotfiles in home directory
| 541 | `~/.cipherstash` (Supabase Edge Functions run in a container; Workers have |
Access to .env file
| 114 | - value-bearing env files — `.env`, `.env.local`, `.env.production`, … — and any credentials file |
Access to .env file
| 116 | `.env.example` is the exception: it holds placeholders, not values, and you are expected to edit it. |
Access to .env file
| 118 | Referring to env key *names* (`CS_WORKSPACE_CRN`, `CS_CLIENT_ID`, `CS_CLIENT_KEY`, `CS_CLIENT_ACCESS_KEY`, `DATABASE_URL`) in code and docs is fine. Their *values* are not. New keys go into `.env.exam |
Access to .env file
| 150 | 2. `DATABASE_URL` environment variable (including `.env*` files, loaded automatically) |
Access to .env file
| 157 | The resolved URL is returned in memory only. It is never written to disk or into `process.env`. |
Access to .env file
| 194 | databaseUrl: process.env.DATABASE_URL!, |
Access to .env file
| 500 | stash env --name my-app-prod --write # write .env.production.local (mode 0600) |
Access to .env file
| 501 | stash env --name staging --write .env.staging.local # custom target path |
Access to .env file
| 525 | > prod.env` and pipes into dotenv consumers are safe. |