Cross Platform Notifier

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.0

Overview

This notifier skill does what it claims, but its macOS, Windows, and WSL notification paths can turn crafted notification text into executed AppleScript or PowerShell code.

Review before installing. The skill is not deceptive and has no evidence of exfiltration or persistence, but it should only be used with trusted, fixed notification messages until the macOS, Windows, and WSL branches pass message/title values as data rather than concatenating them into AppleScript or PowerShell source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/notify.sh:9

Finding

AppleScript and PowerShell Injection Through Notification Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/notify.sh, lines 9–22
Vulnerability Type: Command injection caused by embedding untrusted arguments in interpreter source
Risk Level: High

Vulnerable Code

bash

if [[ "$OS" == "Darwin" ]]; then
    # macOS
    osascript -e "display alert \"${2:-Lobbie Notification}\" message \"${1:-Notification from lobbie!}\""
elif [[ "$OS" == "Linux" ]]; then
    # Check if we are in WSL
    if grep -qi "Microsoft" /proc/version 2>/dev/null; then
        # WSL: Call Windows powershell for the pop-up
        powershell.exe -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('${1:-Notification from lobbie!}', '${2:-Lobbie Notification}')"
    else
        # Native Linux: use notify-send
        notify-send "${2:-Lobbie Notification}" "${1:-Notification from lobbie!}"
    fi
elif [[ "$OS" == "Unknown" ]] || [[ "$OS" == "MSWindowsNT" ]]; then
    # Windows (via Git Bash/Cygwin/etc)
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms. MessageBox]::Show('${1:-Notification from lobbie!}', '${2:-Lobbie Notification}')"

Technical Analysis

The script inserts positional parameters $1 and $2 directly into source code evaluated by AppleScript or PowerShell.

On macOS, the arguments are placed inside AppleScript string literals in an osascript -e expression. An argument containing quotes and valid AppleScript syntax can terminate the intended literal and alter the program evaluated by osascript.

On Windows and WSL, the arguments are placed inside single-quoted PowerShell literals passed to -Command. A single quote in either argument can terminate the intended PowerShell string, after which additional PowerShell statements can be injected.

The Bash quoting around these expressions does not provide protection at the interpreter boundary. It only affects parsing by Bash; after parameter expansion, the resulting text is s ...[truncated 1744 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not concatenate notification content into AppleScript or PowerShell source code.
2. On macOS, pass the title and message as separate osascript arguments and retrieve them through an on run argv handler. Keep the AppleScript program fixed so argument content is handled only as data.
3. On Windows and WSL, use a fixed PowerShell script file or a fixed command that accepts properly bound parameters. Avoid constructing the value supplied to -Command from caller-controlled text.
4. If an external script file is used, invoke it with named or positional parameters and ensure that the message and title are passed as process arguments rather than parsed as PowerShell code.
5. Validate behavior with security regression tests containing single quotes, double quotes, backticks, semicolons, parentheses, newlines, Unicode characters, and interpreter-specific metacharacters.
6. Treat task output, repository content, filenames, logs, and generated Agent text as untrusted whenever they may be forwarded to this script.
7. Preserve the native Linux design of passing values as separately quoted arguments to notify-send.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep