T09 · Insecure Skill Coding Practices
Warning
- Location
scar_code_review.py:115- Finding
Untrusted Persistent Regular Expressions Can Cause Denial of Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Tetra Scar Code Review
Security checks for vulnerabilities and agentic risk
Overview
This is a local code-review helper with disclosed file reading and scar-record storage, with some implementation cautions but no evidence of hidden, destructive, or exfiltrating behavior.
Install only if you want a local Python code-review helper that reads files you point it at and stores review scars in a JSONL file. Treat scar files as trusted configuration, since their regex patterns are executed by Python's regex engine, and be cautious reviewing attacker-controlled code in an interactive terminal until output escaping is improved.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scar_code_review.py:529- Finding
Attacker-Controlled Terminal Escape Sequences Are Printed Without Sanitization
- Content
View full analysis
{f['code']}") ``` Scar-controlled data is also incorporated into output without terminal sanitization: ```python if re.search(pattern, diff_text, re.IGNORECASE | re.MULTILINE): blocks.append( f"scar {scar_id}: pattern matched '{pattern}' " f"— {scar.get('what_missed', '')[:60]}" ) ``` The resulting message is subsequently printed: ```python for b in blocks: print(f"BLOCKED: {b}") ``` Scar listing similarly prints persisted fields: ```python print(f" missed: {s.get('what_missed', '')[:80]}") print(f" pattern: {s.get('pattern', '')[:80]}") ``` ### Technical Analysis The CLI displays source lines, regex patterns, and scar descriptions that may originate from attacker-controlled files. String slicing limits character count but does not remove control characters. ANSI CSI sequences can change colors, reposition the cursor, clear content, or visually forge output. OSC sequences supported by some terminal emulators can modify window titles, create deceptive hyperlinks, or interact with clipboard facilities. The precise effect depends on terminal configuration. Displaying finding context is legitimate for the Skill's declared purpose. However, emitting raw terminal control characters is unnecessary and violates safe handling expectations for untrusted code and metadata. ### Attack Path 1. An attacker commits a source file containing terminal control characters on a line likely to trigger a finding, or places such characters in a scar's `pattern` or `what_missed` field. 2. A reviewer runs `review`, `check-diff`, or `list-scars` in an interactive terminal. 3. The CLI interpolates the attacker-controlled value into a formatted string. 4. `print()` writes ...[truncated 922 chars]- Remediation
View remediation
Vulnerability Patterns
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 75% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
python assert any("XSS" in f["message"] for f in findings) def test_dangerously_set(self): lines = ['<div dangerouslySetInnerHTML={{__html: data}} />'] findings = _check_security(lines) assert any("XSS" in f["message"] for f in findings)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python assert any("eval" in f["message"].lower() for f in findings) def test_subprocess_shell(self): lines = ['subprocess.run(cmd, shell=True)'] findings = _check_security(lines) assert any("eval" in f["message"].lower() or "shell" in f["message"].lower() for f in findings)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill exposes code execution capabilities through Python-based review workflows and explicitly supports reading files, writing scar records, and processing diffs, yet it declares no tool scope restrictions. Without explicit permissions or allowed-tools boundaries, an agent may grant broader access than necessary, increasing the blast radius if the skill is misused or prompt-injected into operating on sensitive files or invoking shell/network functionality.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file performs a file-creation and append operation on the scar database JSONL file. Although the function docstring explains that a scar is recorded, there is no inline warning, confirmation, or user-facing disclosure near the write operation itself, and this operation modifies local user data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring and implementation explicitly restrict keyword extraction to English words and Japanese characters only. This is a natural-language policy concern because it bakes in language handling assumptions without offering the user any opt-in, configuration, or explanation for excluding other languages.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python class TestCLI: def test_cli_review(self): src = _write_temp_file('password = "hunter2"\n') result = subprocess.run( [sys.executable, str(Path(__file__).parent / "scar_code_review.py"), "review", src], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python script = str(Path(__file__).parent / "scar_code_review.py") # Record result = subprocess.run( [sys.executable, script, "--scar-file", scar_file, "record-miss", "--what-missed", "test miss", "--pattern", "test.*pattern", "--severity", "high"],
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python assert "SCAR RECORDED" in result.stdout # List result = subprocess.run( [sys.executable, script, "--scar-file", scar_file, "list-scars"], capture_output=True, text=True, )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def test_cli_no_command(self): script = str(Path(__file__).parent / "scar_code_review.py") result = subprocess.run( [sys.executable, script], capture_output=True, text=True, )