Mentorship Meeting Agenda

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:46 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but its output option can overwrite arbitrary writable files if given an unsafe path.

Review this before installing or using it in automated workflows. It appears to be a simple local agenda generator, not malware, but use --output only with a safe workspace-relative filename and avoid running it with elevated privileges until the script validates output paths and refuses accidental overwrites.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:62

Finding

Unrestricted Output Path Allows Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 62-79
Vulnerability Type: Unrestricted file write and file overwrite
Risk Level: Medium

Vulnerable Code:

python

parser.add_argument("--output", "-o", help="Output file")

args = parser.parse_args()

generator = MentorshipAgenda()

topics = None
if args.topics:
    topics = [t.strip() for t in args.topics.split(",")]

agenda = generator.generate_agenda(args.student, args.phase, topics)
print(agenda)

if args.output:
    with open(args.output, 'w') as f:
        f.write(agenda)
    print(f"\nSaved to: {args.output}")

Technical Analysis

The --output argument is passed directly to open() without path validation, canonicalization, workspace confinement, symlink checks, or overwrite protection. Python's open(..., 'w') operation creates the target file if it does not exist and truncates it if it already exists.

Consequently, the argument can contain an absolute path or a traversal path such as ../../target-file. The operating system will resolve that path using the current working directory and the invoking process's permissions. This behavior contradicts the security expectations in SKILL.md, which identify traversal validation and workspace-restricted output as required controls.

Attack Path

1. An attacker influences the --output value passed to the Skill, directly or through an automated agent workflow.
2. The attacker supplies an absolute path or directory-traversal path that identifies an existing writable file.
3. The agent invokes scripts/main.py with the crafted argument.
4. The program passes the path directly to open(args.output, 'w').
5. The target file is truncated and replaced with generated agenda content.

Example:

bash

python scripts/main.py \
  --student "Alice" \
  --phase early \
  --output "../../writable-target"

A symlink placed at the selected ...[truncated 622 chars]

Remediation

View remediation

Remediation Suggestions

• Define a trusted output directory inside the workspace and resolve all requested output paths relative to it.
• Reject absolute paths and any canonicalized path that falls outside the approved directory.
• Use pathlib.Path.resolve() followed by a containment check against the resolved workspace directory.
• Reject symlinks or securely verify that the final destination and its parent components do not redirect outside the approved directory.
• Avoid silently truncating existing files. Use exclusive creation mode ("x") by default or require explicit overwrite authorization.
• Run the Skill with least-privilege filesystem permissions.

Example hardening pattern:

python

from pathlib import Path

output_root = Path.cwd().resolve()
requested = Path(args.output)

if requested.is_absolute():
    parser.error("Absolute output paths are not allowed")

destination = (output_root / requested).resolve()
if destination != output_root and output_root not in destination.parents:
    parser.error("Output path must remain inside the workspace")

if destination.exists() or destination.is_symlink():
    parser.error("Refusing to overwrite an existing file")

with destination.open("x", encoding="utf-8") as f:
    f.write(agenda)

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises script-based functionality that writes an output file, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability, because consumers cannot tell from metadata what file operations are intended, making accidental over-broad file access or unsafe execution more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.