Concept Explainer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:23 AM UTC
• Version: 0.1.0

Overview

The skill is a simple offline medical explainer, but it needs review because its optional file output can overwrite arbitrary writable files and the medical-use limits are under-disclosed.

Install only if you are comfortable running a local Python script that can write wherever its process has permission when --output is used. Prefer running it in a sandbox or workspace-only environment, avoid absolute paths or ../ paths, and treat the medical explanations as educational summaries rather than clinical advice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:125

Finding

Unrestricted Output Path Allows Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:125-129, 152-154
Vulnerability Type: Unrestricted file write / arbitrary file overwrite
Risk Level: Medium

Vulnerable Code

python

parser.add_argument(
    "--output", "-o",
    type=str,
    help="Output JSON file path (optional)"
)

python

if args.output:
    with open(args.output, 'w', encoding='utf-8') as f:
        f.write(output)
    print(f"Explanation saved to: {args.output}")

Technical Analysis

The --output argument accepts an arbitrary path and passes it directly to open() without canonicalization, workspace-boundary enforcement, file-type validation, or symlink protection.

Opening the supplied path in w mode creates the file if it does not exist and immediately truncates it if it already exists. Absolute paths, parent-directory traversal sequences, and paths resolving through symbolic links are not rejected.

This behavior conflicts with the security controls described in SKILL.md, which identify path-traversal validation and restricting output to the workspace as required safeguards.

The attacker cannot choose arbitrary file contents because the program writes generated JSON. Nevertheless, truncating and replacing a writable file is sufficient to corrupt configuration, application data, scripts, or other files accessible to the process.

Attack Path

1. An attacker gains control over or influences the command-line arguments used to invoke the Skill.
2. The attacker supplies an absolute path, a path containing parent-directory traversal, or a path that resolves through a symbolic link:

   bash

   python scripts/main.py \
     --concept thrombosis \
     --output ../../target-file
   

3. The program passes the path directly to open(..., 'w').
4. If the process has write permission, the target file is created or truncated.
5. The program replaces its contents with generated explanation JSON, potentially disrupting the affected applicatio ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a dedicated output directory and resolve both the directory and requested destination to canonical absolute paths.
2. Verify that the resolved destination remains beneath the approved output directory:

   python

   from pathlib import Path
   
   output_root = Path("output").resolve()
   output_root.mkdir(parents=True, exist_ok=True)
   
   destination = (output_root / args.output).resolve()
   if output_root not in destination.parents:
       raise ValueError("Output path must remain inside the output directory")
   

3. Reject absolute user-supplied paths and parent-directory traversal components.
4. Reject symbolic links and non-regular targets. Where supported, use no-follow operating-system flags to reduce time-of-check/time-of-use risks.
5. If overwriting is unnecessary, create files exclusively with mode x so existing files cannot be silently truncated.
6. If overwriting is required, write to a securely created temporary file in the same approved directory and atomically replace only an explicitly authorized destination.
7. Restrict the output extension to .json if other file types are not required.
8. Run the Skill with a least-privileged account whose write access is limited to the designated workspace.
9. Add tests covering absolute paths, ../ traversal, symlink targets, existing files, special files, and paths outside the approved output directory.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation describes file-writing capability via an --output path and local script execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and governance gap: a runtime or agent may permit broader file-write behavior than reviewers or users expect, increasing the chance of unsafe writes or misuse if the implementation is less restrictive than the documentation suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill explains medical concepts to patients and children, but the markdown lacks a clear warning that its content is informational only and not medical advice. In a medical context, users may over-trust simplified analogies and make health decisions based on incomplete or inaccurate explanations, which can lead to harmful outcomes even without any code exploit.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill focused on explaining medical concepts using analogies, which implies generating explanatory output. The code additionally supports writing that output to a user-specified file path via --output, which is a side effect beyond the stated explanatory behavior.

Content

No source excerpt is available for this finding.