SOP Writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its script can write to any path the running process is allowed to access, which creates an avoidable file-overwrite risk.

Review before installing or running. Use only trusted output filenames in a controlled workspace, and avoid absolute paths or ../ traversal. The script should be hardened to restrict output to a dedicated directory and avoid silently overwriting existing files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:59

Finding

Unrestricted Output Path Allows Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 59 and 78-79
Vulnerability Type: User-controlled path traversal and arbitrary file overwrite
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--output", "-o", default="sop.txt", help="Output file")

python

with open(args.output, 'w') as f:
    f.write(sop)

Technical Analysis

The command-line --output argument is passed directly to open() in write mode without path validation or confinement to an approved workspace. The application accepts absolute paths and relative traversal sequences such as ../.

Because mode 'w' creates a file when it does not exist and truncates an existing file before writing, an attacker who can control the invocation arguments can create or overwrite any file writable by the process. This behavior also conflicts with the controls identified in SKILL.md, which call for rejecting ../ traversal and restricting output to the workspace.

The issue does not independently elevate operating-system privileges. Its reach is limited to files accessible under the account and sandbox permissions used to run the Skill.

Attack Path

1. An attacker gains control over, or influences, the command-line arguments supplied to the Skill.

2. The attacker provides an absolute path or traversal path, for example:

   bash

   python3 scripts/main.py \
     --name "Test" \
     --scope "Test scope" \
     --responsibility "Operator" \
     --output "../../target-file"
   

3. The script passes ../../target-file directly to open(args.output, 'w').

4. The operating system resolves the path outside the intended working directory.

5. If the process has write permission, the target is created or its existing contents are truncated and replaced with the generated SOP.

Impact Assessment

Successful exploitation permits file creation or destructive overwrite with the privileges of the process running the Skill. Potential con ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

• Define a fixed, trusted output directory controlled by the application.
• Resolve the requested path with pathlib.Path.resolve() and verify that the resulting path remains under the trusted directory.
• Reject absolute paths, .. traversal, and paths resolving through symlinks outside the permitted directory.
• If subdirectories are unnecessary, accept only a filename and reject directory separators.
• Prevent unintended replacement by opening files in exclusive creation mode ('x') or requiring explicit overwrite confirmation.
• Run the Skill with least-privilege filesystem permissions and sandbox-level write restrictions.
• Specify an encoding explicitly, such as encoding="utf-8".
• Add tests covering absolute paths, traversal paths, symlink escapes, and attempts to overwrite existing files.

A possible hardened approach is:

python

from pathlib import Path

OUTPUT_DIR = (Path.cwd() / "output").resolve()
OUTPUT_DIR.mkdir(parents=True, exist_ok=True)

requested_name = Path(args.output)
if requested_name.is_absolute():
    raise ValueError("Absolute output paths are not allowed")

output_path = (OUTPUT_DIR / requested_name).resolve()
if OUTPUT_DIR not in output_path.parents:
    raise ValueError("Output path must remain inside the output directory")

with output_path.open("x", encoding="utf-8") as f:
    f.write(sop)

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises file write behavior and local script execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent or runtime may permit broader file operations than intended, increasing the risk of unintended writes, overwrite of workspace content, or abuse through prompt-driven file output. The context makes this more concerning because the skill is intended to generate documents and explicitly mentions reading input files and writing output files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.