Security audit

Dispute Letter

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it bundles a mismatched utility that can persist user-entered dispute details in local plaintext logs without clear disclosure.

Review this package before installing, especially scripts/script.sh. Avoid putting personal, financial, housing, employment, account, or legal details into the add/search utility unless you are comfortable with them being retained locally under the configured dispute-letter data directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: scripts/dispute.sh:186
Finding: Hard-Coded Promotional Content Injected into Skill and Command Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Undisclosed Persistent Plaintext Storage of User-Supplied Data and Activity
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } ``` ```bash cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory immediately at startup and provides a generic `add` command that writes arbitrary user input to `data.log`. It also logs command activity and selected arguments to `history.log`. The project documentation primarily describes output being written to standard output and does not clearly disclose this generic database and activity-logging behavior. In the context of dispute letters, user input may contain names, addresses, account details, employment information, housing disputes, financial data, or other sensitive material. Neither the database nor the history file is created with an explicit restrictive mode. Their effective permissions depend on the invoking process's `umask` and the permissions of the configured directory. The `DISPUTE_LETTER_DIR` environment variable also permits storage in an arbitrary caller-selected path without validation. This is not a privilege-escalation mechanism: the script can only write where the invoking user already has permission. However, it creates an avoidable confidentiality and retention risk within that user's accessible filesystem. ### Attack Path 1. A user invokes `scripts/script.sh`; the script imm ...[truncated 1150 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger terms "投诉信、纠纷、维权" are very broad and can match many ordinary user requests unrelated to this specific skill, causing overbroad invocation or routing. In an agent ecosystem, overly generic triggers can hijack user intent, surface the wrong skill, and lead to inappropriate handling of potentially sensitive legal or dispute-related interactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill is primarily presented in Chinese without indicating language selection or user opt-in, which can cause accidental activation or confusing behavior for users operating in another language context. While this is not directly code-execution dangerous, it increases the chance of misrouting, misunderstanding, and reduced transparency about what the skill does.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level comment names the tool 'dispute-letter', implying functionality related to generating or managing dispute letters, but the documented interface describes a generic 'Multi-purpose utility tool' with commands like add, list, search, and export. The implemented code matches the generic data-log utility behavior rather than dispute-letter-specific behavior, creating an active contradiction between the code documentation/name and what the script actually does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code appends activity details to history.log, and elsewhere stores entries in data.log, creating persistent records of user input. Although some commands print status messages, the help text and surrounding code do not clearly disclose that command arguments and added entries are being logged to disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.