Security audit

Rank Tracker

Security checks for vulnerabilities and agentic risk

Overview

This rank-tracking skill is mostly coherent, but it documents terminal ledger commands using user-supplied placeholders without clear safety boundaries.

Review this skill before installing if your agent host can run terminal commands. It appears intended for legitimate rank tracking, but users should only run the ledger workflow with validated domains and structured command arguments, not by pasting untrusted values into a shell command.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:49
Finding: Potential Shell Command Injection Through Unquoted User-Controlled Arguments
Content: View full analysis
--source rank --data '{"": , ...}'`, then `ledger.py diff --source rank` for the change since the last check and `ledger.py trend --source rank --field ""` for the series. ``` ### Technical Analysis The command template inserts the user-supplied `` value into a shell command without quoting or validation: ```sh python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/ledger.py" record --source rank ``` If an agent or host constructs and executes this command as a shell string, shell metacharacters in the domain can terminate or extend the intended command. The JSON supplied to `--data` may present a similar risk if user-controlled keywords are interpolated into the single-quoted payload without robust JSON and shell escaping. The later `diff` and `trend` examples also use an unquoted domain placeholder. The trend command quotes ``, but ordinary double quoting does not make shell-string construction safe if interpolation or evaluation occurs incorrectly. The package declares only `WebFetch` as an allowed tool and does not bundle `ledger.py`, so exploitation requires a compatible host to expose shell execution and follow this documented command despite that declared restriction. This limits direct exploitability but does not remove the unsafe command-construction guidance. ### Attack Path 1. An attacker supplies a crafted domain or keyword as rank-tracking input. 2. The agent substitutes that value into the documented ledger ...[truncated 1451 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The display name, summary, and description embed Chinese text alongside English, but the skill does not explain whether bilingual output is optional, user-selected, or required for a specific regional context. Under the policy rule, forcing or presuming a language/locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.