Security audit

sem-integration

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed helper for using a semantic diff CLI, with some installation and cache-handling caveats but no hidden or purpose-mismatched behavior.

Install this only if you want agent guidance for sem-based semantic diffs. Before running the optional install commands, verify the sem-cli package or GitHub release yourself, preferably use a pinned version, and be aware that broad triggers may make the skill appear in unrelated git discussions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: modules/detection.md:23
Finding: Unverified Third-Party Executable Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:42
Finding: Predictable Shared Temporary Cache File
Content: View full analysis
/dev/null; then echo "1" | tee "$cache" else echo "0" | tee "$cache" fi } ``` ### Technical Analysis When `CLAUDE_CODE_TMPDIR` is unset, the cache uses the fixed path `/tmp/sem-available`. On multi-user systems, `/tmp` is normally shared and writable. The implementation: - Uses a predictable global filename. - Does not create a private directory for the current user or session. - Does not validate the cache file's owner, permissions, or file type. - Trusts any existing regular file at that path. - Writes through `tee` without explicit exclusive creation or symbolic-link protection. - Does not set restrictive permissions before writing. A local attacker may pre-create the cache with `0` or `1` to influence detection. A symbolic-link redirection may also be possible where operating-system protections and target permissions permit it. Modern systems may mitigate some cross-user symbolic-link attacks through protected-symlink settings, but the Skill itself does not enforce that protection. The documentation claims that the cache is per-session, but the `/tmp/sem-available` fallback is shared across sessions and users unless an isolated `CLAUDE_CODE_TMPDIR` is reliably supplied. ### Attack Path 1. The attacker has local access to the same host and can write to the shared temporary directory. 2. Before the victim invokes the Skill, the attacker creates `/tmp/sem-available` containing a chosen value, or creates a symbolic link at that path. 3. If a regular cache file is planted, `_sem_check` reads and trusts the attacker's value without executing `command -v sem`. 4. The attacker can t ...[truncated 744 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very broad terms such as "git," "foundation," and a long generic phrase about building skills that consume git diff output. In an agent skill system, overly broad triggers can cause this skill to activate in contexts where it was not intended, increasing the chance of unnecessary guidance, unexpected tool suggestions, or interference with more appropriate skills.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · modules/detection.md (reported line 16)May include surrounding context.
md
`$CLAUDE_CODE_TMPDIR/sem-available` 2. If cache exists, use cached value 3. If no cache, run `command -v sem` 4. Write result to cache ## Install-on-First-Use

Static analysis

No suspicious patterns detected.