Security audit

File Sync

Security checks for vulnerabilities and agentic risk

Overview

This file-sync skill does what it claims, but its bundled sync script can be tricked into reading, copying, or moving files outside the chosen folders.

Review this skill carefully before installing. It is not trying to hide what it does, but it should only be used on folders you fully trust and control; avoid syncing attacker-controlled USB drives or shared folders until path validation and symlink rejection are added.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sync.py:181
Finding: Unvalidated State Paths Permit Filesystem Access Outside Synchronization Roots
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sync.py:78
Finding: Symbolic-Link Following Permits Reads and Writes Outside Synchronization Roots
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync.py:62
Finding: Collision-Broken MD5 Is Used for File Integrity and Conflict Decisions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The section says move_to_trash is triggered 'only when both sides delete', but the very code snippet immediately below shows move_to_trash being called when only one side deleted and the other side is unchanged. This is an active contradiction in the file's own behavioral documentation, not merely an omission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains user- and maintainer-facing natural-language comments entirely in Chinese, including the behavioral description and sync rules. Under the policy rule, forcing a specific language without opt-in or justification is a locale/language policy concern.
Content: No source excerpt is available for this finding.