T09 · Insecure Skill Coding Practices
Error
- Location
scripts/black_fortress.py:263- Finding
Missing Kernel Trace Is Treated as a Successful Security Check
- Content
View full analysis
- Remediation
View remediation
Security audit
Black Fortress
Security checks for vulnerabilities and agentic risk
Overview
This is a local sandboxing skill with a coherent security purpose, but its implementation materially undercuts several protections it claims users can rely on.
Install only for review or experimentation, not as a final approval gate for untrusted skills. Run it on a disposable, isolated machine; do not grant optional root/Firecracker access unless you have reviewed and fixed the sandbox gaps; pin and verify container images; and treat any approval report as advisory rather than proof of safety.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/black_fortress.py:171- Finding
Sandbox Executes Original Source Instead of the Neutralized Copy
- Content
View full analysis
LayerResult: """Layer 1: Obfuscate all source code to kill semantic injection.""" start = time.time() obfuscated_dir = os.path.join(work_dir, "obfuscated") os.makedirs(obfuscated_dir, exist_ok=True) result = run_script("deterministic_obfuscator.py", [source_dir, obfuscated_dir]) ``` ```python result = run_script("microvm_orchestrator.py", [ "--mode", "docker", "--source", source_dir, "--timeout", str(timeout), "--output", sandbox_result_file ], timeout=timeout + 30) ``` ```python source_abs = os.path.abspath(source_dir) for candidate in ["__main__.py", "main.py", "app.py"]: if os.path.exists(os.path.join(source_abs, candidate)): entry_point = candidate break cmd = [ DOCKER_BIN, "run", "--rm", "--network=none", "--memory", memory_limit, "--cpus", cpu_limit, "--read-only", "--tmpfs", "/tmp:rw,noexec,nosuid,size=100m", "-v", f"{source_abs}:/sandbox/source:ro", "-v", f"{output_dir}:/sandbox/output:rw", "--name", container_name, ] cmd.extend([SANDBOX_IMAGE, "python", f"/sandbox/source/{entry_point}"]) ``` ### Technical Analysis Layer 1 writes transformed Python files into `work_dir/obfuscated`. Layer 2 nevertheless receives the original `source_dir`, mounts that directory into the container, and executes its entry point. Consequently, the neutralized code is never used as the sandbox execution target. The implementation contradicts the documented pipeline in which neutralization precedes and governs execution. Any transformations intended to remove comments, long strings, logging calls, or semantic identifiers have no effect on the actual runtime behavior. ### Att ...[truncated 777 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/microvm_orchestrator.py:55- Finding
Sandbox Outputs Are Destroyed Before Entropy and Format Validation
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/microvm_orchestrator.py:89- Finding
Raw Untrusted Standard Output Bypasses Postmortem Sanitization
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/babel_output_filter.py:101- Finding
Output Filter Copies Unknown and Potentially Active File Types
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/seccomp-profile.json:1- Finding
Sandbox Policy Omits Documented Process, Timing, and Storage Restrictions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (48)
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The README explicitly documents that earlier versions used
os.environ.copy()when spawning sub-processes, which would forward the entire host environment into sandbox tooling. In a system designed to inspect untrusted code, that is dangerous because secrets such as cloud keys, API tokens, and credentials can be exposed to child processes and then stolen via logs, files, or other side channels if containment is imperfect.- Content
md ### Host Environment Isolation (v1.1.6) **The Problem:** Before v1.1.5, `black_fortress.py` used `os.environ.copy()` to build the subprocess environment. This leaked **all** host environment variables — including `AWS_SECRET_ACCESS_KEY`, `OPENAI_API_KEY`, `GITHUB_TOKEN`, and any other secrets — to every sub-script the orchestrator spawned. **The Fix:** `_build_safe_env()` now constructs a minimal whitelist-only environment:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A static analysis/reporting CLI is not equivalent to a five-layer pre-installation sandbox. Conflating the two can cause operators to rely on source inspection where actual isolation, kernel verification, and controlled rendering are required.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
md ### Host Environment Isolation (v1.1.6) **The Problem:** Before v1.1.5, `black_fortress.py` used `os.environ.copy()` to build the subprocess environment. This leaked **all** host environment variables — including `AWS_SECRET_ACCESS_KEY`, `OPENAI_API_KEY`, `GITHUB_TOKEN`, and any other secrets — to every sub-script the orchestrator spawned. **The Fix:** `_build_safe_env()` now constructs a minimal whitelist-only environment:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Fix:** `behavioral_audit.py` now explicitly checks for missing/empty traces and emits:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Fix:** `behavioral_audit.py` now explicitly checks for missing/empty traces and emits:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
After fresh install, the credential helper may not be in PATH. Fix:
bash mkdir -p ~/.docker echo '{"credsStore":"osxkeychain"}' > ~/.docker/config.jsonDocker Desktop Startup Delay
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
After fresh install, the credential helper may not be in PATH. Fix:
bash mkdir -p ~/.docker echo '{"credsStore":"osxkeychain"}' > ~/.docker/config.jsonDocker Desktop Startup Delay
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The differential test is security-significant because it claims to detect sandbox evasion by comparing Docker and Firecracker behavior, but the Firecracker path never runs the supplied source_dir at all. That creates a false assurance mechanism: evasive or malicious code could pass or fail based on incomparable executions, undermining a core defense in a sandboxing skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The seccomp profile is effectively permissive because it sets defaultAction to SCMP_ACT_ALLOW and only blocks a small set of network-related syscalls. That falls far short of a meaningful sandbox: many dangerous syscalls remain available, including process execution, filesystem manipulation, privilege-related operations, namespace abuse, and other kernel attack surface, so the claimed multi-layer confinement is not actually enforced by this profile.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and demonstrates capabilities to read/write files, inspect environment variables, invoke shell commands, and use Docker/network-related functionality, yet declares no explicit tool scope or permission boundaries. In an agent skill, this creates an authorization ambiguity where reviewers and runtimes cannot easily constrain dangerous operations, increasing the chance of overbroad execution.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation claims timing instructions like
rdtsc/rdtscpare blocked via seccomp, but the shown profile only blocks network-related syscalls. This discrepancy can lead users to overestimate side-channel resistance and rely on protections that are not actually enforced.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill describes automatic deletion of sandbox filesystems and artifacts without clearly scoping what paths are affected or warning users about data-loss boundaries. In operational use, destructive cleanup logic can remove unintended data if path handling is wrong or misunderstood.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Credential Helper
After fresh install, the credential helper may not be in PATH. Fix:
bash mkdir -p ~/.docker echo '{"credsStore":"osxkeychain"}' > ~/.docker/config.json
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstring promises JSON schema validation and metadata stripping for all files, but the implementation simply copies most non-raster files unchanged. In a security boundary component, this mismatch is dangerous because operators may rely on protections that do not actually exist, allowing malicious content or sensitive metadata to pass through the 'trusted output' layer.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The pass-through path uses shutil.copy2, which preserves file metadata, directly contradicting the claim that metadata is stripped for all files. In this sandboxing context, preserved metadata can carry hidden data or leak information, undermining the skill's stated purpose of producing sanitized, trusted outputs.
- Content
Static analysis
No suspicious patterns detected.