Security audit

Code Simplifier

Security checks for vulnerabilities and agentic risk

Overview

This code-refactoring skill is mostly purpose-aligned, but its automatic rewrite tool can corrupt user code and lacks clear safeguards.

Install only if you will use analysis and suggestions by default, review generated changes carefully, run tests, and avoid writing output over the original file. Treat --simplify as experimental. If following troubleshooting steps, use an isolated environment and pin package and Docker versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/troubleshooting.md:181
Finding: Unpinned Third-Party Package Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `references/troubleshooting.md`, lines 181, 194, 205, 215, 229, and 280 **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Medium ### Vulnerable Code ```bash pip install black pip install pylint pip install flake8 pip install mypy pip install codeclimate pip install pytest-cov ``` ### Technical Analysis The troubleshooting documentation instructs users or agents to install third-party packages from the currently configured Python package index without pinning reviewed versions, verifying package hashes, specifying a trusted index, or requiring an isolated environment. An unpinned installation resolves whichever package version and transitive dependencies are available at execution time. Consequently, the effective code installed can change after this Skill has been reviewed. Python package installation may execute package build logic, and installed packages execute code when subsequently invoked or imported. There is no evidence that the named packages are currently malicious. The vulnerability is the mutable and unverified dependency-resolution process, which exposes users to compromised releases, compromised transitive dependencies, or an attacker-controlled package index. ### Attack Path 1. A user or agent follows the troubleshooting instructions. 2. The installation runs against the environment's configured package index. 3. An attacker has compromised a named package, one of its dependencies, or the configured index. 4. Because versions and hashes are not constrained, pip resolves the attacker-controlled artifact. 5. Malicious build-time code may execute during installation, or malicious runtime code may execute when the tool is used. 6. The payload runs with the permissions of the user performing the installation. ### Impact Assessment Successful exploitation can execute arbitrary code with the invoking user's privileges. Depending on those privileges and th ...[truncated 620 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace ad hoc installation commands with a reviewed, version-locked dependency file. 2. Pin exact package and transitive dependency versions. 3. Generate and verify cryptographic hashes, for example with a hash-locked requirements file and `pip install --require-hashes`. 4. Use an explicitly trusted package index rather than silently inheriting arbitrary index configuration. 5. Install tools inside a dedicated virtual environment or disposable container. 6. Separate optional development tools from runtime dependencies. 7. Scan locked dependencies for known vulnerabilities and periodically review updates before changing pins. 8. Require explicit user approval before an agent installs external packages. Example hardened workflow: ```bash python -m venv .venv . .venv/bin/activate python -m pip install \ --require-hashes \ --index-url https://pypi.org/simple \ -r requirements-tools.txt ``` The referenced requirements file should contain reviewed exact versions and hashes for every direct and transitive dependency. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/code_simplifier.py:472
Finding: Semantically Unsafe Source Transformations Can Corrupt Output Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/code_simplifier.py`, lines 472–525; transformed output is written at lines 618–620 **Vulnerability Type**: Unsafe source-code rewriting and integrity loss **Risk Level**: Medium ### Vulnerable Code The early-return transformation inserts an unconditional return under the original positive condition and removes the nested condition: ```python def _apply_early_return_pattern(self, code: str) -> str: """Apply early return pattern to nested conditions.""" lines = code.split("\n") result = [] i = 0 while i < len(lines): line = lines[i] # Simple pattern matching for nested ifs if ( line.strip().startswith("if ") and i + 1 < len(lines) and lines[i + 1].strip().startswith("if ") ): # Check for nested pattern indent1 = len(line) - len(line.lstrip()) indent2 = len(lines[i + 1]) - len(lines[i + 1].lstrip()) if indent2 > indent1: # Found nested if, apply early return condition = line.strip()[3:-1] # Remove 'if ' and ':' result.append(line) result.append( f"{' ' * (indent1 + 4)}return None # Early return for failed condition" ) # Skip the nested if for now (simplified) i += 2 continue result.append(line) i += 1 return "\n".join(result) ``` The boolean transformation references the generated variable before assigning it and places the assignment inside the conditional body: ```python def _simplify_boolean_expressions(self, code: str) -> str: """Simplify complex boolean expressions.""" # Simple pattern: if a and b and c: pattern = r"(if\s+)(\w+)\s+and\s+(\w+)\s+and\s+(\w+)(\s*:)" def replace_match(match): prefix = match.group(1) vars = [match.group(2), match.group(3), mat ...[truncated 3606 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace regular-expression and line-based rewriting with AST-based transformations that preserve syntax and source structure. 2. Implement guard clauses by negating the original condition and preserving the complete nested body. 3. Insert generated boolean-variable assignments before their first use and at the correct indentation level. 4. Parse transformed output with `ast.parse()` before displaying or writing it. 5. Reject output that cannot be parsed, leaving the original file unchanged. 6. Add behavior-preservation tests for every supported rewrite, including nested blocks, `elif`, comments, multiline expressions, asynchronous functions, and class methods. 7. Write to a temporary file in the destination directory and atomically replace the target only after validation succeeds. 8. Refuse same-file input/output replacement by default, or require an explicit force flag and create a backup first. 9. Display a diff and require confirmation before modifying an existing file during interactive use. 10. Clearly label experimental transformations and keep analysis-only behavior as the safe default. 11. Run the project's test suite or a configured validation command before accepting transformed output. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The early-return rewrite injects `return None` immediately after an outer `if`, but the comment says it is for the failed condition even though the inserted return executes when the condition is true. This inverts behavior and can cause premature exits, skipped logic, and broken program behavior, making it a direct unsafe code transformation vulnerability in a refactoring tool.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises code-analysis and code-simplification workflows, including commands that read input files and write transformed output, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the skill be invoked with broader file read/write capabilities than intended, increasing the risk of unintended code modification or access to unrelated files.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger description is broad enough to match very common requests such as simplifying, refactoring, optimizing, or improving code quality. Over-broad activation can cause the skill to run in contexts the user did not intend, which is riskier here because the skill also describes automated code transformation and file-handling behavior.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: 整个技能描述和规范均以中文固定呈现，且未说明这是面向特定中文环境的受限技能，也没有提供用户可选择其他语言的机制。按政策，若技能在语言上施加强制约束，应提供用户选择或明确、合理的场景限定。

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly presents an automatic simplify mode and output-writing mode but does not warn that user code may be changed, nor does it instruct the user to review diffs or back up files first. This creates a tangible integrity risk: users may apply transformations that alter behavior, remove edge-case handling, or overwrite source code without adequate review.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file title and the full troubleshooting content are written in Chinese, and the document does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The simplify() method claims to simplify code based on prior analysis and generated suggestions, but when apply_changes=True it performs hard-coded source rewrites regardless of whether those rewrites were validated as applicable. In a code-modification skill, silent semantic changes are dangerous because they can corrupt user code, introduce logic bugs, or alter control flow while presenting the output as a safe simplification.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: This markdown file is written entirely in Chinese and the title explicitly labels it as best practices in Chinese, but there is no indication that the skill or reference is region-specific or that users may opt into another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: This code file contains natural-language content in Chinese, beginning with the comment at L009 and continuing in multiple comments/docstrings below, while other user-facing text is in English. Under the policy rule, forcing a specific language or mixed locale without user opt-in or documented justification can violate language/locale expectations for maintainers or users.

Static analysis

No suspicious patterns detected.