graph-build

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.9.19

Overview

This skill builds a local code graph and writes disclosed workspace files, with some operational cautions but no evidence of deception, exfiltration, or destructive behavior.

Install only if you want a local SQLite graph index created inside the repository. Before first use, confirm the target directory and prefer quoted or argument-array command execution so unusual path names cannot be interpreted as shell syntax.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Unquoted Path Parameters May Enable Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–35
Vulnerability Type: Command injection through unsafe shell command construction
Risk Level: Medium

Vulnerable Code:

bash

python3 ${CLAUDE_PLUGIN_ROOT}/scripts/graph_build.py <dir>

bash

python3 ${CLAUDE_PLUGIN_ROOT}/scripts/graph_build.py <dir> --incremental

Technical Analysis

The documented commands interpolate both the environment-derived CLAUDE_PLUGIN_ROOT value and a user-specified directory into shell command lines without quoting or validation. Paths containing whitespace may break argument boundaries, while shell metacharacters in a substituted directory value could be interpreted as additional shell syntax.

Exploitation depends on an agent replacing the <dir> placeholder with untrusted text and passing the resulting command through a shell. A manipulated CLAUDE_PLUGIN_ROOT could also redirect execution to an unintended local script. The referenced graph_build.py is external to the audited project and therefore could not be reviewed within the available scope.

Attack Path

1. An attacker supplies a crafted directory value containing shell metacharacters and an additional command.
2. The agent substitutes that value directly for the documented <dir> placeholder.
3. The agent executes the constructed command through a command shell.
4. The shell interprets the injected syntax rather than treating the complete value as a single path argument.
5. The attacker-controlled command executes with the same operating-system privileges as the agent process.

Alternatively, an attacker who can manipulate CLAUDE_PLUGIN_ROOT may cause Python to execute a different local scripts/graph_build.py file.

Impact Assessment

Successful exploitation could permit arbitrary local command execution with the privileges of the process invoking the skill. This may expose or modify files access ...[truncated 262 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct commands by concatenating or interpolating untrusted strings into shell command text.

• Invoke the process through an argument-array API without a shell, such as Python subprocess.run([...], shell=False, check=True).

• Resolve the target directory to a canonical path and verify that it exists and is a directory before execution.

• Resolve and validate CLAUDE_PLUGIN_ROOT, and verify that scripts/graph_build.py is the expected trusted file.

• If a shell command must be documented, quote both paths and use an end-of-options delimiter supported by the script:

  bash

  python3 "${CLAUDE_PLUGIN_ROOT}/scripts/graph_build.py" -- "$dir"
  

• Ensure graph_build.py supports -- and independently validates the target path.

• Avoid accepting raw shell expressions as directory input and reject control characters or malformed path values.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger 'setting up the graph before search or blast-radius analysis' is broad enough that an agent could invoke this skill automatically in many exploratory workflows, causing it to run a Python script and write artifacts into the workspace without a tightly scoped user request. Because the skill performs file-system writes and repository analysis, ambiguous activation boundaries increase the chance of unintended execution and surprise side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to build .gauntlet/graph.db and auto-create .gauntlet/.gitignore, but it does not prominently warn that it will modify the repository workspace. In agent contexts, undisclosed writes are dangerous because users may expect read-only analysis and may not realize the skill creates persistent files during routine code inspection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.