iBlipper Expressive Typography - Remember reading is automatic!

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:49 AM UTC
• Version: 1.0.1

Overview

The skill mostly generates animation links, but its helper script can run unintended local code when given a crafted message, so it needs review before installation.

Use the markdown/link-generation instructions with caution, and avoid running the included shell script on untrusted or externally supplied message text until its encoder is fixed to pass the message as data rather than embedding it in Python source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/iblipper.sh:75

Finding

Arbitrary Python Code Execution Through Unsafe Message Encoding

Content

View full analysis

Vulnerability Details

File Location: scripts/iblipper.sh, lines 75–80
Vulnerability Type: Python code injection
Risk Level: High

Vulnerable Code

bash

# URL encode the message (spaces as +, special chars encoded)
encode_text() {
    local text="$1"
    python3 -c "import urllib.parse; print(urllib.parse.quote_plus('''$text'''))"
}

ENCODED_TEXT=$(encode_text "$MESSAGE")

Technical Analysis

The script interpolates the attacker-controlled MESSAGE value directly into Python source code supplied to python3 -c. Although the shell variable is quoted, shell quoting does not make the resulting Python program safe.

A message containing a triple-quote terminator and additional Python statements can escape the intended string literal. Those statements are then interpreted by Python rather than treated as text to URL-encode. Python provides access to operating-system functionality through modules such as os and subprocess, so successful injection can result in arbitrary local command execution.

The vulnerability is reachable through the script's primary documented interface because the first positional argument is assigned to MESSAGE without restricting its content.

Attack Path

1. An attacker convinces a user or agent to generate an animation URL for a specially crafted message.
2. The crafted message contains Python syntax designed to terminate the '''...''' string literal.
3. The script assigns that content to MESSAGE.
4. encode_text embeds the message directly in the source passed to python3 -c.
5. Python parses the injected statements as executable code.
6. The injected code runs with the operating-system privileges and environment of the user invoking the Skill.

No elevated privilege is required to trigger the flaw; exploitation only requires control over, or influence on, the message passed to the script.

Impact Assessment

Successful exploitation perm ...[truncated 639 chars]

Remediation

View remediation

Remediation Suggestions

Pass the message to Python as an argument or through standard input so it is handled exclusively as data:

bash

encode_text() {
    python3 -c 'import sys, urllib.parse; print(urllib.parse.quote_plus(sys.argv[1]))' "$1"
}

Additional hardening measures:

1. Avoid interpolating any untrusted value into source code, shell commands, or interpreter expressions.
2. Validate EMOTION against the documented allowlist before adding it to the URL.
3. URL-encode every user-controlled URL parameter rather than encoding only the message.
4. Escape Markdown-special characters in MESSAGE when producing Markdown links.
5. Add regression tests using quotes, triple quotes, newlines, Markdown delimiters, URL delimiters, and interpreter-like payloads.
6. Run the script with the minimum filesystem, credential, and network access required for URL generation.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to generate and use external URLs and even open them in a browser, which is a network-capable behavior, but it declares no explicit tool scope or allowed-tools restrictions. This creates a permission mismatch: downstream systems or reviewers cannot clearly tell that the skill is intended to access external web content, increasing the risk of unintended network use and reducing policy enforcement clarity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.