Sop Architect

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:35 AM UTC
• Version: 1.1.0

Overview

The skill is a simple SOP generator, but its bundled script can overwrite Markdown files outside the stated SOPs folder when given a crafted task name.

Review this before installing or using it with untrusted task names. The skill itself is purpose-aligned, but the script should reject slashes, backslashes, .. components, and existing destinations before it is safe to run broadly.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_sop.sh:4

Finding

Path Traversal Allows File Creation or Overwrite Outside the SOP Output Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_sop.sh, lines 4-9
Vulnerability Type: Path traversal and unsafe file overwrite
Risk Level: Medium

Vulnerable Code

bash

TASK_NAME=$1
shift
mkdir -p SOPs
FILE="SOPs/${TASK_NAME// /_}.md"

echo "# SOP: $TASK_NAME" > "$FILE"

Technical Analysis

The script uses the first command-line argument to construct an output path. Its only sanitization replaces spaces with underscores; directory separators, .. path components, and other filesystem-significant input remain unchanged.

For example, a task name of ../README produces the path:

text

SOPs/../README.md

This resolves to README.md outside the intended SOPs/ directory. The > redirection creates the destination or truncates it if it already exists. The script also does not reject symbolic-link destinations, so filesystem links may redirect the write to another location.

Quoting "$FILE" prevents shell word splitting and command substitution during path use, but it does not prevent path traversal because traversal is handled by filesystem path resolution.

Attack Path

1. An attacker or untrusted caller controls the task-name argument supplied to generate_sop.sh.
2. The attacker supplies a traversal-bearing name, such as ../README.
3. The script constructs SOPs/../README.md.
4. Filesystem path resolution places the destination outside SOPs/.
5. The redirection operator creates or truncates the destination file.
6. The script writes attacker-controlled task and workflow-step content into that file.

Exploitation is limited to locations writable by the account executing the script and normally to filenames ending in .md. Existing symbolic links may expand the effective write target.

Impact Assessment

Successful exploitation allows creation or overwrite of writable Markdown files outside the documented output directory. This can corrupt pro ...[truncated 410 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject task names containing /, \, .., control characters, or an empty value.
2. Convert task names to a strict filename slug using an allowlist such as [A-Za-z0-9_-].
3. Resolve the output directory and destination parent to canonical paths, then verify that the destination remains beneath the canonical SOPs/ directory.
4. Refuse symbolic-link destinations and consider checking each relevant path component.
5. Avoid silently truncating existing files. Use an exclusive creation mechanism or require explicit authorization before overwriting.
6. Return a nonzero status when validation or safe file creation fails.

Example validation approach:

bash

set -euo pipefail

TASK_NAME=${1-}
[[ -n "$TASK_NAME" ]] || {
  printf 'Error: task name is required\n' >&2
  exit 1
}

[[ "$TASK_NAME" != *"/"* &&
   "$TASK_NAME" != *"\\"* &&
   "$TASK_NAME" != *".."* ]] || {
  printf 'Error: invalid task name\n' >&2
  exit 1
}

SAFE_NAME=$(printf '%s' "$TASK_NAME" |
  sed 's/[^A-Za-z0-9_-]/_/g')

mkdir -p -- SOPs
FILE="SOPs/${SAFE_NAME}.md"

[[ ! -e "$FILE" && ! -L "$FILE" ]] || {
  printf 'Error: destination already exists\n' >&2
  exit 1
}

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code creates a directory and writes a new SOP file, overwriting any existing file with the same generated name. While the behavior is simple, there is no confirmation prompt or explicit warning in comments/docstrings that running the script will modify files on disk.

Content

No source excerpt is available for this finding.