Fzf Fuzzy Finder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:59 AM UTC
• Version: 1.0.0

Overview

The skill is an fzf guide, but it includes copyable commands that can delete files, kill processes, remove Docker/Kubernetes resources, or execute shell history without confirmation.

Review this skill as a set of shell snippets, not just documentation. Avoid installing the persistent aliases verbatim, especially fh, fkill, file deletion, Docker removal, and Kubernetes deletion examples. If you use the skill, replace destructive pipelines with preview, dry-run, explicit confirmation, context checks, and safe argument handling before running them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Destructive Commands Consume Unvalidated Interactive Selections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:61-63, SKILL.md:184-186, and SKILL.md:199-201
Vulnerability Type: Unsafe argument handling in destructive command pipelines
Risk Level: Medium

Vulnerable Code

bash

# Delete selected files
fzf -m | xargs rm

bash

# Remove selected images
docker images | fzf -m | awk '{print $3}' | xargs docker rmi

bash

# Delete pods
kubectl get pods | fzf -m | awk '{print $1}' | xargs kubectl delete pod

Technical Analysis

These examples pass interactively selected text directly to destructive commands without robust argument boundaries, target validation, or confirmation.

The file deletion pipeline uses newline-delimited output and allows xargs to reinterpret whitespace, quotes, backslashes, and option-like values. Consequently, a selected filename may be divided into multiple arguments or interpreted as an rm option.

The Docker and Kubernetes examples parse human-readable tables with awk. Human-oriented output is not a stable machine-readable interface and includes a header row. A user can select the header or an unintended resource. The Kubernetes command also does not present or validate the active context and namespace before deletion.

Attack Path

1. An attacker or untrusted repository introduces a filename containing whitespace, newlines, quotes, or an option-like prefix.
2. The user runs the documented multi-selection deletion workflow.
3. The crafted filename is selected in fzf.
4. xargs reparses the selection rather than preserving it as one filename.
5. rm receives unintended operands or options and deletes files other than the target the user expected.

For Docker or Kubernetes, an operator may select an unintended row or run the command under an unexpected context or namespace. The parsed value is then passed directly to docker rmi or kubectl delete pod without an additional verification step. ...[truncated 465 chars]

Remediation

View remediation

Remediation Suggestions

• Preserve filename boundaries with NUL-delimited processing, such as find ... -print0, fzf --read0 --print0, and xargs -0 -r.
• Place -- before file operands so option-like filenames cannot be interpreted as command options.
• Add a confirmation stage that displays the exact resolved targets before deletion.
• Use machine-readable Docker output, for example docker images --format, and explicitly exclude headers.
• Use structured Kubernetes output such as kubectl get pods -o name.
• Display and validate the Kubernetes context and namespace before executing deletion.
• Prefer non-destructive previews or dry-run operations where available.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:220

Finding

Shell History Alias Executes Selected Text Through sh -c

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:220-222
Vulnerability Type: Arbitrary shell command execution
Risk Level: High

Vulnerable Code

bash

# Fuzzy history search (Ctrl+R is built-in)
alias fh='history | fzf | awk "{print \$2}" | xargs -I {} sh -c "{}"'

Technical Analysis

The alias routes text derived from shell history into sh -c, which treats the resulting value as shell program text. This is an explicit command-execution sink with no review or confirmation between selection and execution.

The use of awk "{print \$2}" is also semantically unsafe. It extracts only the second whitespace-delimited field rather than reliably removing the history number and retaining the complete selected command. The command executed by sh -c can therefore differ from the full history entry displayed to the user.

Passing the extracted text through xargs introduces another parsing layer involving whitespace, quotes, and backslashes. These transformations make the final command difficult for the user to predict.

Attack Path

1. A dangerous command enters the user's shell history, such as through copied instructions, a previous troubleshooting session, or other attacker-influenced terminal activity.
2. The user invokes the fh alias and selects the apparently relevant history entry.
3. awk extracts only the second field, potentially changing the displayed command.
4. xargs performs additional argument parsing and substitutes the result into the shell command.
5. sh -c executes the resulting text immediately under the user's account.

Impact Assessment

The selected text can execute any command permitted to the current user, including reading or modifying files, launching programs, deleting data, or invoking authenticated command-line tools. If used in a privileged shell, the command receives those elevated privileges. The alias does not itself bypass operating-system access con ...[truncated 76 chars]

Remediation

View remediation

Remediation Suggestions

• Remove sh -c and do not automatically execute selected history content.
• Insert the complete selected entry into the interactive command line so the user can review and edit it before pressing Enter.
• Use the shell's native history-search capability, such as the documented fzf Ctrl+R integration.
• If history identifiers must be removed, use a method that preserves the complete command after the identifier rather than selecting a single whitespace-delimited field.
• Avoid passing command text through xargs, which adds an unnecessary parsing layer.
• Require explicit confirmation before executing any recovered history command.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:224

Finding

Selected Filenames Are Reparsed as Editor Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:224-225
Vulnerability Type: Unsafe filename and command argument handling
Risk Level: Medium

Vulnerable Code

bash

# Find and edit
alias fe='fd --type f | fzf --preview "bat --color=always --style=numbers {}" | xargs -r $EDITOR'

Technical Analysis

The pipeline transfers filenames using newline-delimited text and then allows xargs to parse the selected value. Filenames containing whitespace, newlines, quotes, or backslashes may not remain a single argument. A selected filename can therefore resolve to multiple unintended editor operands.

The command also expands $EDITOR without validating how it is structured and does not place an end-of-options delimiter before the selected filename. Depending on the editor and the exact filename produced by fd, an option-like value may be interpreted as an editor option rather than as a file.

Attack Path

1. An attacker adds a crafted filename to a repository or other directory searched by fd.
2. The user selects that filename through the documented fzf alias.
3. The filename is emitted as newline-delimited text.
4. xargs reparses whitespace and quoting characters and constructs the editor invocation.
5. The editor receives split operands or, where applicable, interprets an option-like value as a command-line option.
6. The user may open or modify a different file than intended, or trigger editor-specific option behavior.

Impact Assessment

Exploitation is limited to the privileges of the user running the alias. It may cause unintended files to be opened or modified and can expose editor-specific option injection behavior. The precise consequences depend on the configured editor and supported command-line options; no independent privilege escalation is demonstrated.

Remediation

View remediation

Remediation Suggestions

• Use NUL-delimited filename processing throughout, for example fd -0, fzf --read0 --print0, and xargs -0 -r.
• Add -- before selected filename operands when supported by the configured editor.
• Validate the editor command instead of directly treating an arbitrary environment-variable value as part of an invocation.
• Prefer a shell function over an alias so the selected filename can be stored safely, checked for emptiness, displayed for confirmation, and passed as one quoted argument.
• Document that filenames from untrusted repositories must be treated as untrusted input.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

fzf -m | xargs rm chains an interactive selector directly into file deletion with no quoting hardening, dry run, or confirmation. Although intended as a convenience example, this pattern is dangerous because mistaken selection, unusual filenames, or blind copy-paste can lead to irreversible deletion of multiple files.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

fzf | xargs -I {} cp {} /destination/

Delete selected files

fzf -m | xargs rm

text

### Directory navigation

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The instruction to add sourcing lines to shell startup files establishes persistence across future terminal sessions. In this skill the sourced files are legitimate fzf integration scripts, so context lowers suspicion, but persistence mechanisms are still sensitive because a bad path, later file replacement, or unreviewed agent output could affect every shell session.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Shell integration

bash

# After installing, add to ~/.bashrc or ~/.zshrc:
# source /path/to/fzf/shell/completion.bash
# source /path/to/fzf/shell/key-bindings.bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes destructive command examples such as deleting files and force-killing processes without any adjacent warning, confirmation step, or safer variant. In an agent-skill context, users may copy these snippets directly, increasing the chance of accidental data loss or service disruption from broad or unintended selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill instructs users to modify ~/.bashrc or ~/.zshrc, which creates persistent changes to the shell environment, but it does not warn that the change is long-lived or should be reviewed first. While not directly exploitable on its own, persistence-oriented instructions can normalize editing startup files without backup or validation, which is risky in agent-generated workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.