Regexr

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:59 AM UTC
• Version: 2.0.0

Overview

This package is presented as a regex helper, but its shipped script is primarily a local input history, search, and export tool with weak controls around sensitive text.

Review before installing. Do not use this skill with secrets, production samples, customer data, tokens, or proprietary snippets unless it is changed to disable logging by default, protect files with owner-only permissions, and implement the promised regex functionality. Treat exports from ~/.local/share/regexr as potentially sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:6

Finding

Persistent Storage of User Input Without Restrictive Permissions

Content

View full analysis

> "$DATA_DIR/history.log"; } ``` A representative command stores the supplied input in both a command-specific log and the shared history log: ```bash check) shift if [ $# -eq 0 ]; then echo "Recent check entries:" tail -20 "$DATA_DIR/check.log" 2>/dev/null || echo " No entries yet. Use: regexr check " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check.log" local total=$(wc -l < "$DATA_DIR/check.log") echo " [Regexr] check: $input" echo " Saved. Total check entries: $total" _log "check" "$input" fi ;; ``` The same storage pattern is repeated for `validate`, `generate`, `format`, `lint`, `explain`, `convert`, `template`, `diff`, `preview`, `fix`, and `report`. ### Technical Analysis The script persistently records arbitrary user-provided patterns, descriptions, and sample text under `~/.local/share/regexr`. It does not set a restrictive `umask`, explicitly create the data directory with mode `0700`, or create log files with mode `0600`. Consequently, access permissions depend entirely on the invoking environment. With a common `022` umask, a newly created directory can be mode `0755` and newly created log files can be mode `0644`, making the records readable by other local users. Each submitted value is also duplicated: once in its command-specific log and once in `history.log`. Inputs to regex-oriented tools may contain proprietary source fragments, identifiers, test records, credentials used as test data, o ...[truncated 1102 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/script.sh:109

Finding

Search-Term Option Injection in grep Invocation

Content

View full analysis

}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The user-controlled `term` is quoted, which prevents shell word splitting and shell command injection. However, it is passed to `grep` before an option terminator. A value beginning with `-` can therefore be interpreted as a `grep` option rather than as the intended search pattern. For example, values corresponding to valid `grep` options can alter matching behavior, consume the following argument as option data, produce errors, or cause `grep` to read from standard input instead of searching the intended file. The `2>/dev/null || true` construction suppresses relevant errors and makes such manipulation less visible. This is not arbitrary shell execution because the input remains quoted and is not evaluated by a shell. It is nevertheless an option-injection flaw affecting the reliability and predictability of the search operation. ### Attack Path 1. An attacker or untrusted caller invokes `regexr search` with a dash-prefixed term. 2. `_search` passes that value to `grep` without using `--`. 3. `grep` interprets the value as an option rather than as the search expression. 4. Depending on the supplied option, search behavior is modified, the log-file argument may be consumed as option data, or the process may wait for standard input. 5. Errors are suppressed, reducing operator visibility into the manipulated behavior. ### Impact Assessment The primary impact is l ...[truncated 423 chars]

Remediation

View remediation

/dev/null || true) ``` If the command is intended to search for literal text rather than accept regular expressions, use fixed-string mode: ```bash local m m=$(grep -iF -- "$term" "$f" 2>/dev/null || true) ``` Additionally: 1. Document whether searches use regex or literal semantics. 2. Do not suppress all diagnostic output during development and testing. 3. Add regression tests for terms such as `-f`, `--help`, `-e`, empty input, and ordinary dash-prefixed literal strings. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill presents itself as a regex utility, but the documented behavior includes broad persistent logging, history/search/export features, and claims of regex analysis capabilities without showing any concrete implementation. This mismatch is dangerous because users may disclose sensitive patterns or sample text under the assumption they are using a focused local validator, while the tool actually stores and repurposes that data beyond the narrow stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation materially differs from the stated purpose: instead of performing regex creation, testing, or validation, it mostly acts as a generic input logger with history, search, and export capabilities. That mismatch is dangerous because users may provide sensitive patterns, sample data, or secrets under the assumption they are using a transient regex helper, while the tool silently persists and exposes that data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states that user inputs are logged persistently to per-command files and a unified history, but it does not clearly warn that regex patterns and sample text may contain secrets, tokens, emails, or proprietary data that will be written to disk. In a tool specifically used to test real-world text and patterns, silent persistence materially increases the risk of local data exposure, accidental retention, and later exfiltration via export/search features.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill context encourages users to input example text, code-review snippets, and regexes for preview, explain, lint, and convert workflows, while elsewhere documenting persistent history/logging. That combination makes session persistence materially more dangerous because the stored content is likely to include sensitive sample data, internal validation rules, or security-related patterns from real codebases.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

## When to Use

1. **Building and testing regex patterns** — use `generate` to create patterns from descriptions, `check` to verify correctness, and `preview` to test against sample data
2. **Learning and understanding regex** — use `explain` to break down complex patterns into plain-language descriptions, perfect for code reviews or onboarding
3. **Linting and fixing regex in codebases** — run `lint` to catch performance and safety issues (catastrophic backtracking, unanchored patterns), then `fix` to auto-correct them
4. **Converting regex across languages** — use `convert` to translate patterns between JavaScript, Python, PCRE, and other flavors when porting code

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Across logging, recent, status, search, and export features, the tool persistently stores and re-displays all user inputs in plain text. In this skill's context, that broad retention and disclosure behavior is especially risky because it turns a simple developer utility into a local data collection mechanism that can expose sensitive samples to other local users, backup systems, or accidental sharing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Persistent tracking, cross-log search, and bulk export are not necessary for a regex helper and increase the data exposure surface. In the skill context, this is more dangerous because users are likely to input test strings that may contain tokens, emails, identifiers, or other sensitive content, which the script then aggregates and makes easy to retrieve.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The export function copies accumulated log contents into new artifacts, increasing the number of plaintext copies of potentially sensitive user input. Without an explicit warning, users may unintentionally package and share historical data that they did not realize had been retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes user-provided input directly to persistent local logs without notifying the user or obtaining consent. This creates a confidentiality risk because regex test data often includes real samples copied from production data, and those values remain stored in plain text for later disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Several command descriptions and changelog entries are written in Chinese while the rest of the skill documentation is in English. This imposes mixed-language behavior without an explicit user opt-in or documented locale constraint, which can violate language/locale consistency expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.