Insurance

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:57 AM UTC
• Version: 2.2.0

Overview

This skill appears intended to organize insurance records locally, but it stores sensitive policy and claim details in plaintext files without enforcing private file permissions or clearly controlling backup retention.

Review this before installing if you would store real policy numbers, insured names, premiums, coverage limits, deductibles, or claim details. It does not appear to send data over the network, but you should only use it in a private workspace and be aware that records and corruption backups may remain as readable local JSON files unless you manage permissions and deletion yourself.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/storage.py:14

Finding

Sensitive Insurance Records Stored with Implicit Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/lib/storage.py:14-15, 31, 35-36, 42-44
Vulnerability Type: Plaintext sensitive-data storage with insufficiently enforced access controls
Risk Level: Medium

The storage implementation creates the insurance directory and writes JSON records without explicitly enforcing owner-only permissions:

python

def ensure_dir() -> None:
    os.makedirs(INSURANCE_DIR, exist_ok=True)

python

with open(filepath, "r", encoding="utf-8") as f:
    return json.load(f)

python

corrupt_backup = f"{filepath}.corrupt.{timestamp}.bak"
shutil.copy(filepath, corrupt_backup)

python

def save_json(filename: str, data: dict) -> None:
    ensure_dir()
    filepath = _path(filename)
    with open(filepath, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)

The affected files can contain policy numbers, insured names, premiums, coverage limits, deductibles, notes, claim descriptions, claim statuses, and incident dates, as populated by scripts/add_policy.py:64-78 and scripts/log_claim.py:34-42.

Technical Analysis

The records are stored as unencrypted JSON. Directory and file permissions depend on the process umask and pre-existing workspace permissions rather than being explicitly restricted to the owning user. Reopening an existing file with open(..., "w") does not correct an already permissive mode.

When malformed JSON is detected, shutil.copy creates another plaintext copy. This expands the sensitive-data footprint and provides no explicit retention or secure-deletion control. The write operation is also non-atomic, meaning interruption can leave a partially written file and trigger creation of further backup copies on a later read.

This issue is relevant when the workspace is shared, the process runs with a permissive umask, existing files have broad permissions, or another local process executes under an identity able to access the workspace.

A

...[truncated 1298 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the insurance directory with owner-only permissions and repair permissions when it already exists:

   python

   os.makedirs(INSURANCE_DIR, mode=0o700, exist_ok=True)
   os.chmod(INSURANCE_DIR, 0o700)
   

2. Create files with mode 0600, avoiding reliance on the process umask. Use os.open with explicit flags and permissions, then wrap the descriptor with os.fdopen.

3. Replace direct truncating writes with atomic persistence:

   • Securely create a temporary file inside INSURANCE_DIR.
   • Set its mode to 0600.
   • Write and flush the JSON.
   • Call os.fsync.
   • Atomically replace the destination with os.replace.
   • Clean up the temporary file on failure.

4. Explicitly set corruption-backup files to mode 0600. Define a retention limit and provide a user-controlled deletion mechanism so stale sensitive copies do not accumulate indefinitely.

5. Check that WORKSPACE_ROOT and INSURANCE_DIR are not symlinks or unexpectedly owned/writable by other users before storing records.

6. Consider encryption at rest with a user-managed key when the threat model includes other privileged local processes, backups, or offline disk access. Filesystem permissions alone do not protect against administrators or compromise of the owning account.

7. Add tests that run under permissive umasks and verify that the directory remains 0700 and all records, backups, and temporary files remain 0600.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes local file storage and script-based workflows but does not declare an explicit tool scope such as allowed-tools or permissions. That creates a policy gap: an agent may infer broader file/environment access than intended, increasing the risk of unintended reads, writes, or environment access beyond the insurance data directory.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

- ✅ Highlight missing or untracked policy categories in the user's stored records
- ❌ **NEVER provide insurance advice**
- ❌ **NEVER recommend specific coverage amounts**
- ❌ **NEVER tell the user what insurance they should buy**
- ❌ **NEVER replace** a licensed insurance agent, broker, or attorney
- ❌ **NEVER facilitate policy purchases**

Static analysis

No suspicious patterns detected.