T09 · Insecure Skill Coding Practices
Error
- Location
scripts/batch_rename.py:174- Finding
User-Controlled Rename Values Permit Files to Be Moved Outside the Target Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
batch-rename
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent batch file renamer, but its bundled script can move files outside the chosen folder and performs real bulk renames without strong containment.
Install only if you are comfortable with a bulk file-renaming tool that can change many filenames at once. Before use, require a preview of every old and new path, avoid recursive runs unless necessary, and do not allow rename patterns containing path separators, absolute paths, or parent-directory components such as '..'.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to perform filesystem-modifying actions via a rename script, but it does not declare any explicit tool scope or permission boundaries. In practice this can enable broader-than-expected file read/write access, making accidental or unintended renames more likely if the agent is invoked in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger text includes open-ended language such as 'or similar requests,' which can cause the skill to activate on ambiguous prompts. Because this skill performs destructive file-renaming operations, unintended invocation increases the risk of accidental bulk changes to user files.
- Content