Security audit

Boilerplates

Security checks for vulnerabilities and agentic risk

Overview

This skill looks like a small local CLI, but it stores user-supplied data and command history on disk without clearly disclosing that behavior.

Review before installing. Avoid entering secrets or sensitive project details into this tool unless you are comfortable with them being retained in local plaintext files, and prefer a version that documents its storage behavior and narrows the command set to actual boilerplate management.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Persistent Plaintext Logging of User-Supplied Arguments
Content: View full analysis
> "$DATA_DIR/history.log"; } cmd_run() { echo " Running: $1" _log "run" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: ready" _log "status" "${1:-}" } cmd_init() { echo " Initialized in $DATA_DIR" _log "init" "${1:-}" } cmd_list() { [ -f "$DB" ] && cat "$DB" || echo " (empty)" _log "list" "${1:-}" } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } cmd_info() { echo " Version: $VERSION | Data: $DATA_DIR" _log "info" "${1:-}" } ``` ### Technical Analysis The script persistently writes command activity and the first user-supplied argument to `history.log`. The `add` command also writes all supplied arguments to `data.log`. Neither the logging mechanism nor the persistent storage of command arguments is disclosed in `SKILL.md`, which instead states that results are written to standard output. The script does not establish a restrictive `umask` or explicitly assign secure permissions to the data directory and files. Consequently, actual permissions depend on the invoking process's environment. Under a common `umask` of `022`, newly created files may be readable by other local users. Although no credential col ...[truncated 1228 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:37
Finding: Missing Argument Validation and Unsafe Grep Option Handling
Content: View full analysis
/dev/null || echo " Not found: $1" _log "search" "${1:-}" } case "${1:-help}" in run) shift; cmd_run "$@" ;; config) shift; cmd_config "$@" ;; status) shift; cmd_status "$@" ;; init) shift; cmd_init "$@" ;; list) shift; cmd_list "$@" ;; add) shift; cmd_add "$@" ;; remove) shift; cmd_remove "$@" ;; search) shift; cmd_search "$@" ;; export) shift; cmd_export "$@" ;; info) shift; cmd_info "$@" ;; help|-h) show_help ;; version|-v) echo "boilerplates v$VERSION" ;; *) echo "Unknown: $1"; show_help; exit 1 ;; esac ``` ### Technical Analysis The script enables `set -u`, but several command handlers dereference `$1` without first confirming that an argument was supplied. Calling `run`, `remove`, or `search` without an additional argument therefore terminates execution with an unbound-variable error instead of producing a controlled usage message. The search handler also passes the user-controlled search value directly to `grep` without an end-of-options delimiter: ```bash grep -i "$1" "$DB" ``` Quoting prevents shell word splitting and shell command injection, but it does not stop `grep` from interpreting a value beginning with `-` as an option. An option-like search value can consequently alter `grep` behavior or trigger an error. This is not shell command injection because the input is not evaluated as shell syntax. The confirmed risk is limited to option injection, inconsistent results, and command failure. ### Attack Path #### Missing argument failure 1. A caller invokes: ```bash boilerplates search ``` 2. T ...[truncated 1027 chars]
Remediation: View remediation
&2 return 2 fi } cmd_search() { require_arg "$@" || return grep -i -- "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } ``` 2. Add `--` before user-controlled operands passed to utilities that support it: ```bash grep -i -- "$1" "$DB" ``` 3. Apply equivalent validation to `cmd_run` and `cmd_remove`. 4. Return documented, stable exit codes for missing arguments, absent data, and search misses. 5. Add regression tests for empty arguments and values such as `-v`, `--help`, spaces, wildcard characters, and multiline input. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description suggests a passive repository of personal templates and configurations. The code instead behaves as an active shell application with its own command dispatcher, persistent storage under the user's local data directory, entry database, search/export functions, and history logging. While the name 'boilerplates' loosely aligns with templates, the implemented behavior is materially different from a simple template collection and introduces undeclared capabilities for local data management and logging.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The command list is broad and underspecified, giving an agent little guidance on what each trigger is allowed to do or what boundaries apply. In an agent setting, vague commands like 'run' or 'status' can enable unsafe interpretation, overbroad execution, or invocation of behavior beyond the user's likely intent.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The phrase 'Run any command' explicitly signals unrestricted command dispatch with arbitrary arguments. In an agent-integrated skill, this can act as an open-ended execution surface that increases the risk of misuse, prompt-driven abuse, or unexpected access to sensitive local or external resources.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
## Usage Run any command: `boilerplates <command> [args]` --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a personal collection of templates and configurations for boilerplates, implying storage or retrieval of boilerplate assets. Instead, the script exposes generic commands like run, status, add, remove, search, and export, stores arbitrary entries in a data log, and maintains command history, which is materially broader and different from managing template files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Both the file header comment and help text explicitly describe the tool as 'Multi-purpose,' while the manifest frames the skill as a personal template collection for boilerplates and related configurations. This is an active intent mismatch between documentation and the declared skill purpose, not merely missing detail.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.