Security audit

Elite CLI Tools

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only CLI reference skill with broad but disclosed shell/file examples and no hidden execution mechanism.

Before installing, be aware this skill may encourage the agent to use powerful shell commands. Review commands before approving deletion, in-place rewrites, global configuration changes, or network fetches, especially outside version-controlled projects.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

External Transmission

Medium

Category: Data Exfiltration
Content: Flatten JSON: ```bash curl -s https://api.github.com/users/octocat | gron ``` Filter flattened JSON:
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: Flatten JSON: ```bash curl -s https://api.github.com/users/octocat | gron ``` Filter flattened JSON:
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example shows recursive deletion using fdfind piped to rm without any warning, dry-run step, or safer alternative. In an agent-assisted environment, such patterns can be copied directly and cause irreversible data loss if the match pattern is broader than intended or executed in the wrong directory.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The sd examples present in-place modification as routine without warning about overwriting files or recommending backups and previews. This can lead to silent corruption or widespread unintended edits, especially when reused across multiple files by an agent or user.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The ast-grep rewrite example performs in-place source changes across a directory without warning about bulk modification risk. Structural rewrites can affect many files at once, so omission of review and rollback guidance raises the chance of large-scale accidental code damage.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation expands a local CLI tooling skill into remote network-fetching workflows by showing direct URL retrieval and processing. In an agent context, this broadens the effective capability surface from local shell/file operations to external data access, which can enable unintended outbound requests, data retrieval from untrusted sources, or use in data exfiltration chains.

External Transmission

Medium

Category: Data Exfiltration
Content: gron data.json # Flatten from URL gron https://api.github.com/users/octocat # Flatten from stdin curl -s https://api.example.com | gron
Confidence: 87% confidence
Finding: This example includes direct transmission to an external domain, demonstrating outbound access that is not central to the skill’s declared local tooling purpose. In agent settings, such examples can legitimize external communications and be repurposed to contact attacker-controlled hosts or retrieve untrusted data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The yq documentation repeatedly uses in-place config edits without warning that configuration files are being modified directly. In configuration contexts, accidental changes can break deployments, alter security settings, or overwrite sensitive operational state.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The html2text examples explicitly demonstrate retrieving remote web content with curl, which is outside the stated local shell/file tooling focus. In an agent skill, documenting remote retrieval normalizes external access and increases the chance the skill is used to fetch untrusted content or send requests beyond the user’s expectations.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The integration workflow includes a remote API fetch pipeline even though the skill is described as shell operations, directory traversal, and file manipulation. That unjustified network capability materially changes the risk profile because an agent could contact arbitrary external services under the guise of normal tooling usage.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The example shows `yq ... -i config.yaml`, which edits a file in place, but the surrounding markdown provides no warning that the command will modify the user's file contents. For markdown files, safety-relevant behaviors affecting user data should be disclosed so readers understand the command is not read-only.

Description-Behavior Mismatch

Low

Confidence: 82% confidence
Finding: The manifest emphasizes minimizing token usage for shell commands, directory traversal, and file manipulation with listed tools, but does not mention handling environment variables. The yq section explicitly promotes environment variable substitution and demonstrates injecting DB_HOST into config editing, which is a broader capability than the stated description communicates.

Missing User Warnings

Low

Confidence: 74% confidence
Finding: The example sets `diff.external` with `git config --global`, which changes user-wide Git behavior, but the markdown does not mention that it affects all repositories for the current user. While not destructive, it alters persistent tooling configuration and should be disclosed clearly.

Context-Inappropriate Capability

Low

Confidence: 78% confidence
Finding: The manifest justification centers on efficient shell command execution, traversing directories, and manipulating files with reduced token usage. The 'System Analysis' workflow teaches process monitoring and CPU-based inspection via ps and jc, which is a broader operational capability not clearly justified by the stated file/shell-manipulation purpose.

Static analysis

No suspicious patterns detected.