Security audit

diskclean

Security checks for vulnerabilities and agentic risk

Overview

This disk-cleaning skill is mostly purpose-aligned, but its cleanup guardrails are weaker than advertised and could delete more than a user expects.

Install only if you are comfortable reviewing every dry-run item carefully before confirming cleanup. Do not rely on the advertised safe tier for logs, and avoid confirmed cleanup until path validation and age checks are fixed; manual deletion should be limited to clearly understood paths under your home directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: diskclean.sh:224
Finding: Log directories are marked safe without enforcing the documented age gate
Content: View full analysis
= 50 )); then emit_item "$logs_dir" "logs" "$size" "999" "safe" fi fi local crash_dir="${HOME}/Library/Logs/DiagnosticReports" if [[ -d "$crash_dir" ]]; then local size size=$(dir_size_mb "$crash_dir") if (( size >= 10 )); then emit_item "$crash_dir" "crash_reports" "$size" "999" "safe" fi fi local tmp_user="/private/tmp/claude-$(id -u)" ``` ### Technical Analysis The scanner assigns an artificial age of `999` days to the complete `~/Library/Logs` and `~/Library/Logs/DiagnosticReports` directories and marks them as `safe` based solely on their aggregate size. It does not inspect the actual modification time of any directory or file. This contradicts the documented 30-day age gate for logs and crash reports. During confirmed cleanup, safe directory entries are passed to `shutil.rmtree`, recursively deleting their entire contents. Consequently, recent and actively used logs can be removed even though the user is told that only items older than 30 days qualify. The two emitted paths also overlap: `DiagnosticReports` is contained within `Library/Logs`. This can produce duplicate cleanup records, misleading reclaimed-space totals, and a second deletion attempt after the parent directory has already been removed. ### Attack Path 1. `~/Library/Logs` grows to at least 50 MB, or `DiagnosticReports` grows to at least 10 MB. 2. The user or Agent runs `diskclean.sh scan`. 3. The scanner marks the entire directory as safe and reports an age of 999 days without checking actual timestamps. 4. The dry-run presents the directory as an age-qualified safe item. 5. R ...[truncated 882 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: diskclean.sh:355
Finding: Lexical path-prefix validation permits deletion outside the home directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes file-reading and file-deletion behavior but does not declare any explicit tool scope or permissions boundary. In a disk-cleaning skill, undeclared file access is especially sensitive because the agent is instructed to inspect the filesystem and potentially delete paths, increasing the risk of overbroad or unintended file operations if the runtime grants broader access than the user expects.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.