Smart File Manager

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.2.0

Overview

This file-organizing skill is purpose-aligned overall, but it can broadly reorganize and delete workspace files without enough validation, confirmation, or recovery safeguards.

Review before installing. This skill may be acceptable only in a controlled workspace where users expect automated file organization, but it should not be used on important or shared files unless it adds explicit confirmation, safe filename validation, no-clobber behavior, checked moves, and non-recursive cleanup after verifying nothing remains to preserve.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/move.sh:7

Finding

Unvalidated Destination Filename Allows File Overwrite and Path Manipulation

Content

View full analysis

Vulnerability Details

File Location: scripts/move.sh, lines 7–10 and 33–37
Vulnerability Type: Unvalidated path construction and unsafe file overwrite
Risk Level: Medium

Vulnerable Code

bash

SOURCE="$1"
TYPE="$2"
DESC="$3"
DATE="$4"

EXT="${SOURCE##*.}"
FILENAME="input-${DESC}-${DATE}.${EXT}"

cp "$SOURCE" "$TARGET_DIR/$FILENAME"

Technical Analysis

The destination filename is constructed directly from the attacker-controlled DESC and DATE arguments and from an extension derived from the supplied source path. These values are not normalized or restricted to safe filename characters.

Path separators, traversal components, control characters, and other special filename content are not rejected. If suitable intermediate directories already exist, crafted components can cause the resolved destination to differ from the expected single file directly beneath TARGET_DIR.

The script also invokes cp without checking whether the destination already exists or is a symbolic link. By default, this can overwrite an existing destination file and can follow a destination symbolic link to another file writable by the account executing the script.

Attack Path

1. An attacker predicts the destination name generated from the description, date, and source extension.
2. The attacker creates an existing file or symbolic link at that destination, or prepares intermediate directories that make crafted path components meaningful.
3. The attacker invokes the script with the crafted arguments, or causes an automated agent to invoke it while processing attacker-controlled file metadata.
4. The script constructs the destination without validating its canonical location.
5. cp follows the resulting path and overwrites the existing destination or the writable target of a symbolic link.

Exploitation is limited by the filesystem permissions of the account running the script and by the attacker's ...[truncated 599 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict DESC and DATE to an explicit allowlist:
   • Permit only ASCII letters, digits, hyphens, and underscores in descriptions.
   • Require dates to match a strict format such as ^[0-9]{8}$.
   • Reject /, \, .., control characters, and empty normalized values.
2. Derive the extension from the source basename and validate it against the selected file category.
3. Resolve and validate the final destination path, confirming that it remains directly beneath the expected TARGET_DIR.
4. Reject existing destination files rather than overwriting them. Use collision-resistant names or a no-clobber operation.
5. Check destination components with lstat or equivalent logic and reject symbolic links.
6. Enable strict shell error handling, such as set -euo pipefail, and verify that the copy completed before reporting success.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fix-nested.sh:10

Finding

Repair Script Unconditionally Deletes Files That Were Not Successfully Moved

Content

View full analysis

Vulnerability Details

File Location: scripts/fix-nested.sh, lines 10–40
Vulnerability Type: Unsafe recursive deletion and unchecked file operations
Risk Level: Medium

Vulnerable Code

bash

if [ -d "/workspace/my_outputs/output" ]; then
  if [ -d "/workspace/my_outputs/output/images" ]; then
    mv /workspace/my_outputs/output/images/* /workspace/my_outputs/images/ 2>/dev/null
  fi

  if [ -d "/workspace/my_outputs/output/videos" ]; then
    mv /workspace/my_outputs/output/videos/* /workspace/my_outputs/videos/ 2>/dev/null
  fi

  if [ -d "/workspace/my_outputs/output/pdfs" ]; then
    mv /workspace/my_outputs/output/pdfs/* /workspace/my_outputs/pdfs/ 2>/dev/null
  fi

  if [ -d "/workspace/my_outputs/output/excels" ]; then
    mv /workspace/my_outputs/output/excels/* /workspace/my_outputs/excels/ 2>/dev/null
  fi

  if [ -d "/workspace/my_outputs/output/others" ]; then
    mv /workspace/my_outputs/output/others/* /workspace/my_outputs/others/ 2>/dev/null
  fi

  rm -rf /workspace/my_outputs/output

Technical Analysis

The script only attempts to move non-hidden entries matched by * from five recognized subdirectories. Shell globbing with * does not include dotfiles. The script also does not process unexpected directories or the documented docxs category.

Errors from every mv operation are redirected to /dev/null, and their exit status is not checked. A move can therefore fail because of permissions, destination conflicts, missing matches, filesystem errors, or other conditions without stopping cleanup.

Regardless of whether every entry was moved successfully, the script executes:

bash

rm -rf /workspace/my_outputs/output

This recursively deletes all remaining content. Destination collisions can also cause existing files to be replaced, depending on the type and state of the destination entry.

Attack Path

1. A file is placed under `/workspa ...[truncated 1242 chars]

Remediation

View remediation

Remediation Suggestions

1. Enable strict failure handling with set -euo pipefail.
2. Do not suppress move errors. Check the result of every move and abort cleanup on any failure.
3. Process all documented categories, including docxs.
4. Handle dotfiles and other entries safely, preferably by enumerating entries with find rather than relying on *.
5. Define an explicit policy for unexpected files and directories instead of deleting them.
6. Reject destination collisions or generate unique destination names; do not silently replace existing output.
7. Verify that the nested source tree is empty after all moves.
8. Replace recursive deletion with rmdir, which succeeds only when directories are empty.
9. Record every moved, skipped, conflicting, and failed entry so that cleanup is auditable and recoverable.
10. Consider moving the nested directory to a quarantine or backup location before cleanup to permit recovery.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: a328734b5007a5b3276f64e1587b44bb
    PropagateID: a328734b5007a5b3276f64e1587b44bb
    ReservedCode1: 30440220097325f36c3096543fea438ba8e670e7e12a496068e24a6cdc33b75e55790cd00220152b7e3ad95780a869ed0409640ac5419fbd49072353e06274d19c8a9ad5b42c
    ReservedCode2: 30440220657fcd1b19a8870603dcbf7bcff4a5c5ec66387e1a9cdc5a42cfe754861abbc4022015be90ab701870a998c5c6b7252d8bfde5bde8318d6ecc5bbf7fbaef09a670c5
description: |
    文件整理与归档 skill。管理用户输入文件和我生成的输出文件的存储、命名、分类。
    适用于：用户发送图片/视频/PDF等文件给你处理，或你生成文件给用户。
    触发：任何文件存档操作前。
license: MIT
metadata:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

The script performs recursive deletion with rm -rf on an absolute path after moving files, without validating that the path is the intended nested directory or ensuring it is empty. In a file-management skill, this is more sensitive because it operates on user and generated files; if the directory structure is unexpected, symlinked, or the move partially fails, the command can irreversibly delete data.

Content

Scanner excerpt · scripts/fix-nested.sh (reported line 40)May include surrounding context.

sh

fi
  
  # 删除空嵌套目录
  rm -rf /workspace/my_outputs/output
  echo "✅ 删除嵌套目录"
else
  echo "✅ 无嵌套目录问题"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

The script performs recursive deletion with rm -rf on an absolute path after moving files, without validating that the path is the intended nested directory or ensuring it is empty. In a file-management skill, this is more sensitive because it operates on user and generated files; if the directory structure is unexpected, symlinked, or the move partially fails, the command can irreversibly delete data.

Content

Scanner excerpt · scripts/fix-nested.sh (reported line 40)May include surrounding context.

sh

fi
  
  # 删除空嵌套目录
  rm -rf /workspace/my_outputs/output
  echo "✅ 删除嵌套目录"
else
  echo "✅ 无嵌套目录问题"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs moving and renaming files but does not require an explicit warning or consent checkpoint before modifying user-provided files. That creates a real integrity risk: an agent following the skill could alter file locations or names unexpectedly, making files harder to find, breaking references, or changing evidence/provenance in workflows that depend on original filenames.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition '任何文件存档操作前' is overly broad, so the skill may activate for nearly any file-related workflow and push automatic file-moving/renaming behavior in contexts where the user did not explicitly request archival changes. In a file-management skill, broad invocation increases the chance of unintended modifications to user files or outputs, especially when paired with mandatory operational language and shell script usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script moves files out of nested directories and then deletes /workspace/my_outputs/output with rm -rf, which can affect user data if the directory contents are not as expected. Although there are success messages after actions complete, there is no prior user-facing warning, confirmation prompt, or comment explaining the destructive risk of moving and deleting filesystem contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language comments and user-facing usage/help output are entirely in Chinese, including the primary description and error guidance. This imposes a specific language on users without opt-in or documented justification, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script's comments and all user-facing messages are written in Chinese, including the status and failure output. For a general-purpose verification script, that imposes a specific language on users without offering a language choice or documenting that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and user-facing echo messages are written in Chinese, which imposes a specific language on users without any opt-in or justification. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script executes verify.sh as a subprocess, which is a safety-relevant operation under the code-file criteria. There is no comment or user-facing disclosure about what verify.sh will do, so users cannot tell whether additional filesystem or system actions will occur.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The header comment at L03 states '移动文件到正确位置' and the usage implies a move operation, but the actual file operation at L37 uses cp rather than mv. This is an active contradiction between the documented intent and the code's behavior, not merely omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.