Auto Cleaning Disk

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

This disk-cleaning skill is not exfiltrating data, but it can delete more local data than its safety promises disclose.

Review before installing. This skill can permanently delete local files from broad cache, temp, log, browser-profile, trash, and Windows update-cache locations. It should not be run in Auto Mode or with administrator/root privileges unless the targets are narrowed, file-age checks are enforced, and a dry-run preview plus explicit confirmation are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clean_linux.py:31

Finding

Documented File-Age Safety Restriction Is Not Enforced

Content

View full analysis

Remediation

View remediation

= MIN_AGE_SECONDS except OSError: return False ``` 2. Evaluate each file independently. Do not recursively remove a directory merely because the directory itself appears old. 3. Remove a directory only after all eligible descendants have been processed and the directory is empty. 4. Resolve and validate every configured root against an immutable allowlist before deletion. 5. Use `lstat()` or equivalent non-following operations when handling symlinks. 6. Default to skipping a candidate whenever its age, type, resolved location, or ownership cannot be verified. 7. Add automated tests covering newly created files, mixed-age directory trees, symlinks, permission failures, and elevated execution. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clean_windows.py:76

Finding

Windows Firefox Profiles Directory Is Recursively Deleted as Browser Cache

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clean_linux.py:31

Finding

Suppressed Deletion Errors Produce False Cleanup Success and Space-Freed Reports

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:19

Finding

Invalid Mode Input Defaults to Destructive Auto Mode

Content

View full analysis

") confirm = (mode.strip() == "2") clean_linux(confirm=confirm) ``` Standalone macOS launcher: ```python if __name__ == "__main__": mode = input("Mode chunein:\n1. Auto (khud se)\n2. Confirm (har step pe poochna)\n> ") confirm = (mode.strip() == "2") clean_mac(confirm=confirm) ``` Standalone Windows launcher: ```python if __name__ == "__main__": mode = input("Mode chunein:\n1. Auto (khud se)\n2. Confirm (har step pe poochna)\n> ") confirm = (mode.strip() == "2") clean_windows(confirm=confirm) ``` ### Technical Analysis Confirmation is enabled only when the input is exactly `2`. Every other input—including an empty response, typographical error, malformed value, or unexpected automated input—is interpreted as Auto Mode. This is a fail-open design for an irreversible operation. Safe interaction design requires an explicit choice before destructive actions and should default to confirmation or cancellation when input is missing or invalid. ### Attack Path 1. The cleaner prompts the user to enter `1` or `2`. 2. The user presses Enter without entering a value, types an invalid value, or an automation wrapper supplies unexpected input. 3. The expression `mode == "2"` evaluates to false. 4. `confirm=False` is passed to the se ...[truncated 596 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding indicates the skill claims safe, cross-platform behavior while the underlying implementation may perform Windows-specific broad directory deletions such as browser profile paths or update download folders. That is risky because it can remove user-relevant state or destabilize system/update behavior while presenting itself as a harmless junk cleaner.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This finding indicates the skill claims safe, cross-platform behavior while the underlying implementation may perform Windows-specific broad directory deletions such as browser profile paths or update download folders. That is risky because it can remove user-relevant state or destabilize system/update behavior while presenting itself as a harmless junk cleaner.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring claims the tool never deletes important user files, but the implementation recursively removes contents from broad directories without validating that they contain only disposable cache or temp data. In a disk-cleaning skill, users are likely to trust safety claims and run it automatically, which increases the chance of destructive data loss beyond the advertised scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The Firefox path points to the entire Profiles directory, and clean_folder recursively deletes all child files and folders. That can erase browser profiles, including history, cookies, extensions, local settings, and possibly user-saved session/state data, far exceeding a safe cache cleanup operation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes OS detection and execution of platform-specific cleaning scripts, which implies file and shell-like destructive capabilities, yet it declares no explicit tool scope or permission boundaries. For a disk-cleaning skill, missing scope controls are dangerous because the agent may run with broader-than-necessary authority while performing deletion operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger language is broad enough to activate on many ordinary performance or storage complaints, increasing the chance that a destructive cleanup workflow runs when the user did not clearly request file deletion. In the context of a disk-cleaning skill, accidental activation is materially dangerous because the resulting actions are irreversible or hard to recover from.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Mixing explicit requests with inferred system-state phrases creates ambiguous activation boundaries, so the skill may initiate cleanup based on contextual guesses rather than informed user consent. Because the skill can delete files and caches, this ambiguity makes unintended data loss more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The procedure includes destructive deletion steps and only conditions prompting on an optional 'Confirm Mode' rather than making user confirmation the default. In a disk-cleaning skill, this creates a real risk of unintended data loss if the agent runs automatically, especially because broad paths like /tmp, /var/tmp, and ~/.cache can contain active-session or application state files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes a cleaning skill but does not define when it should be invoked, what exact user phrases should trigger it, or any exclusion examples. In a skill catalog or agent setting, the lack of explicit trigger boundaries can cause unintended activation for general disk-space or cleanup requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill's prompts switch to Hindi for the cleaning-mode instructions and input request, which imposes a specific language on users without opt-in. This is a natural-language policy issue because the file provides no alternative language selection or justification for a Hindi-only interface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script's interactive text includes Hindi-only prompts such as "clean karein?" and later uses Hindi-only mode-selection text. This imposes a specific language on all users without opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code labels the section as 'Log Files' but actually deletes the user's cache directory. This mismatch is dangerous because it undermines informed consent: a user approving log cleanup may unintentionally authorize deletion of broader cached application data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script deletes the entire ~/.cache directory while presenting the action as part of safe disk cleaning. This exceeds the stated scope of removing temp files, browser cache, trash, and log files, and can remove unrelated application state or offline data that users would not reasonably expect to lose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script asks users to choose a mode using Hindi-only text ("Mode chunein", "khud se", "har step pe poochna") with no alternative locale or opt-in. Because this file is not documented as a Hindi-only regional tool, the fixed language is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring promises safe cleanup without deleting important files, but the implementation performs broad deletion of whole directory contents, including caches, trash, and logs, with no allowlist of file types or protections for active application data. This mismatch is dangerous because users and higher-level agents may trust the safety claim and trigger destructive actions they would not otherwise approve.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Recursively cleaning broad log paths, especially /var/log, exceeds normal junk-file cleanup and can delete system and service logs needed for diagnostics, auditing, and incident response. In a disk-cleaning skill, this is more dangerous because users expect low-risk maintenance, not removal of potentially important system records across privileged locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script offers an automatic mode that proceeds with destructive deletions without per-action warning or informed consent, despite the skill description saying the user should be asked whether to run automatically or with confirmation. This creates a realistic risk of accidental data loss because users may select or trigger auto mode without understanding that entire directory contents will be deleted.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/clean_windows.py (reported line 90)May include surrounding context.

python

if confirm:
        ans = input("  Recycle Bin empty karein? [y/n]: ")
        if ans.lower() == 'y':
            subprocess.run(["PowerShell", "-Command", "Clear-RecycleBin -Force"], 
                         capture_output=True)
            print("  ✅ Recycle Bin empty!")
    else:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/clean_windows.py (reported line 94)May include surrounding context.

python

if confirm:
        ans = input("  Recycle Bin empty karein? [y/n]: ")
        if ans.lower() == 'y':
            subprocess.run(["PowerShell", "-Command", "Clear-RecycleBin -Force"], 
                         capture_output=True)
            print("  ✅ Recycle Bin empty!")
    else:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In auto mode, the script empties the Recycle Bin without a separate confirmation, permanently removing the user's recovery option for accidentally deleted files. The skill metadata specifically says to ask whether to run automatically or with confirmation, but this particular destructive step is still more dangerous in context because it destroys a safety net users may expect to keep.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Deleting Windows SoftwareDistribution\Download goes beyond routine temp/cache/log cleanup and can interfere with Windows Update state or troubleshooting workflows. While not typically arbitrary user data, it is system-managed content whose removal may have operational side effects the user did not clearly consent to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The procedure includes destructive actions such as deleting all files in multiple system and user cache locations and emptying the Recycle Bin, but it does not require an explicit warning that data may be permanently removed when automatic mode is used. In a disk-cleaning skill, users may expect safe cleanup, yet some listed paths (for example browser profiles/cache trees, Windows logs, and SoftwareDistribution downloads) can affect application state, troubleshooting data, or pending updates if cleared indiscriminately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The confirmation prompt is written in Hindi ('clean karein?') with no language selection or fallback, which imposes a specific language on users. This is a natural-language policy issue because the script does not offer any locale choice or document that it is intended only for Hindi-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The main mode-selection prompt uses Hindi phrases such as 'Mode chunein' and 'khud se' without giving the user a choice of language. This creates a locale/language policy concern because the interface assumes one language rather than allowing opt-in or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script's interactive prompts and status messages are written in Hindi/Urdu transliteration, such as 'clean karein?' and 'Mode chunein', with no option for another language. This creates a language policy issue because the skill imposes a locale on all users without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.