Filesorter By Ext

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a simple file sorter, but it needs review because it can move files unexpectedly and has a flaw that can move them outside the chosen folder.

Install only if you are comfortable with a tool that reorganizes files in place. Run it first on a test folder, avoid shared or untrusted directories, check for existing extension-named symlinks such as pdf or jpg, and keep backups of important files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: tool.py:20

Finding

Destination Symlink Allows Files to Be Moved Outside the Selected Directory

Content

View full analysis

Vulnerability Details

File Location: tool.py, lines 20–36
Vulnerability Type: Symlink following and time-of-check to time-of-use race
Risk Level: Medium

python

if item.is_file():
    ext = item.suffix[1:].lower() or "no_ext"
    extensions.add(ext)
    target_dir = directory / ext
    target_dir.mkdir(exist_ok=True)
    target_path = target_dir / item.name

    # Handle filename conflicts
    counter = 1
    while target_path.exists():
        name_stem = item.stem
        name_suffix = item.suffix
        target_path = target_dir / f"{name_stem}_{counter}{name_suffix}"
        counter += 1

    shutil.move(str(item), str(target_path))

Technical Analysis

The extension-based destination is constructed beneath the selected directory, but the code does not verify that target_dir is a genuine directory rather than a symbolic link. When an existing symbolic link resolves to a directory, target_dir.mkdir(exist_ok=True) can accept it because the path is considered an existing directory after following the link.

Consequently, shutil.move() follows the symbolic link and places the source file in the link's target, which may be outside the directory the user selected. The destination existence check and subsequent move are also separate filesystem operations, creating a time-of-check to time-of-use window. An attacker with concurrent write access to the selected directory could replace a destination directory or path after validation or collision checking but before the move.

Attack Path

1. An attacker obtains write access to a directory that the victim will organize, such as a shared directory.
2. The attacker creates an extension-named symbolic link, for example pdf, pointing to an attacker-chosen directory outside the selected directory.
3. The victim places a file such as confidential.pdf in the directory and runs the sorting tool.
4. The tool derives pdf as the ext ...[truncated 954 chars]

Remediation

View remediation

Remediation Suggestions

• Reject a destination when target_dir.is_symlink() is true.
• Resolve every destination and verify that it remains beneath the resolved source directory before moving a file.
• Apply containment checks using Path.relative_to() rather than string-prefix comparisons.
• Revalidate the destination immediately before each move.
• Where supported, use descriptor-relative filesystem operations and flags that prohibit symbolic-link traversal to reduce race conditions.
• Avoid processing directories writable by untrusted users, particularly when the tool runs with elevated privileges.
• Refuse symbolic links as source entries unless following them is an explicitly documented requirement.
• Add tests covering pre-existing destination symlinks, symlink replacement during processing, filename-collision races, and destinations outside the selected directory.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises convenience but does not clearly warn that it will modify the filesystem by moving files into newly created folders. A user may run it in the wrong directory or on important data without understanding the side effects, causing confusion, workflow disruption, or unintended file reorganization.

Content

No source excerpt is available for this finding.