Security audit

Freezer Sample Locator

Security checks for vulnerabilities and agentic risk

Overview

This freezer inventory skill is mostly purpose-aligned, but its file export and integrity controls are weaker and broader than its documentation claims.

Review before installing in any shared or important lab workflow. Keep exports in a dedicated directory, do not open exported CSVs from untrusted sample data without spreadsheet protections, and avoid concurrent use until the path restrictions, validation, and atomic database writes are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:284
Finding: Arbitrary File Creation and Overwrite Through Unrestricted CSV Export Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:278
Finding: Spreadsheet Formula Injection in Exported CSV Records
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:178
Finding: Sample Updates Bypass Location Validation and Conflict Detection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:37
Finding: Non-Atomic and Unlocked Database Writes Permit Corruption and Lost Updates
Content: View full analysis
Dict[str, Any]: try: with open(self.data_file, 'r', encoding='utf-8') as f: return json.load(f) except (json.JSONDecodeError, FileNotFoundError): return {"samples": []} def _save_data(self, data: Dict[str, Any]): with open(self.data_file, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis Every mutating operation follows an unlocked read-modify-write pattern. `_save_data()` opens the live database with `'w'`, which truncates it before serialization completes. There is no inter-process lock, temporary file, durability synchronization, or atomic replacement. Two concurrent processes can read the same initial state, independently modify it, and then overwrite one another. A reader can also observe the file after truncation but before serialization is complete. If parsing fails, `_load_data()` silently returns an empty sample list, treating corruption as an empty database. A subsequent successful mutation may then overwrite the damaged database with a new dataset that omits all previous records. ### Attack Path 1. Two processes start mutating operations at approximately the same time. 2. Both processes read the same original JSON database. 3. Each process modifies its own in-memory copy. 4. The first process writes its copy. 5. The second process writes its stale copy afterward, discarding the first process's change. A corruption variant is also possible: 1. A write is interrupted after the destination has been truncated. 2. A later operation attempts to parse the incomplete JSON. 3. `_load_data()` catches the decoding error and returns an e ...[truncated 462 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises local script execution and file system access but does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance gap: consumers and enforcement layers cannot reliably constrain what files the skill may read or write, increasing the chance of overbroad file access if the implementation is later added or changed. The repeated self-attestations that access is 'controlled' and 'approved' without machine-enforceable restrictions make this more concerning, not less.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural language that presents the skill description in Chinese alongside English, and the CLI help/output throughout the file is predominantly Chinese. The file does not offer any language or locale selection or indicate that the language constraint is optional, which can violate language/locale policy for general-use skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file includes organizational metadata and user-facing labels in Chinese, such as the owner field and later classification text, without indicating that the skill is limited to Chinese-speaking users or offering an opt-in language choice. This can violate language/locale policy expectations for broadly reusable skills when the user is not given a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The classification line uses Chinese text ("Tool/Script型") as part of the skill description without offering the user a language preference or noting that the skill is region/language-specific. That creates a natural-language policy concern because the skill implicitly forces a specific language in user-visible content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.