Security audit

Yamlcheck

Security checks for vulnerabilities and agentic risk

Overview

YAMLCheck is a coherent local YAML utility, with minor dependency and terminal-output hygiene issues but no evidence of hidden, destructive, persistent, or exfiltrating behavior.

This skill is reasonable to install for local YAML work. Review files before running key previews on sensitive configs, and prefer installing PyYAML from a trusted, pinned dependency source rather than copying the unpinned pip command into a privileged shell.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

Location: SKILL.md:25
Finding: Unpinned Third-Party Dependency Installation Recommendation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:20
Finding: Terminal Escape-Sequence Injection Through Attacker-Controlled Filenames
Content: View full analysis
&2; } die() { error "$@"; exit 1; } ``` Attacker-controlled file arguments are included in messages passed to `info`, including: ```bash info "Validating YAML (PyYAML): ${CYAN}$1${NC}" info "Validating YAML (basic checks): ${CYAN}$1${NC}" info "Converting YAML to JSON: ${CYAN}$1${NC}" info "Linting YAML: ${CYAN}$1${NC}" info "Top-level keys in: ${CYAN}$1${NC}" ``` For example, `scripts/script.sh:70-73` contains: ```bash cmd_validate_pyyaml() { need_file "$1" info "Validating YAML (PyYAML): ${CYAN}$1${NC}" python3 -c " ``` ### Technical Analysis The command-line filename is attacker-controllable and is interpolated into a message that is ultimately printed using `echo -e`. The `-e` option interprets backslash escapes in the entire message, including those originating from the filename. A filename can contain backslashes and most control-oriented character sequences. An attacker can therefore create or distribute a YAML file whose name contains text such as `\e[` or `\033[`. When the victim passes that filename to YAMLCheck, `echo -e` converts the encoded sequence into an ESC byte and sends it to the terminal. This is not shell command injection: the filename remains quoted when it is used as a file argument, and the shell does not reevaluate its contents as commands. The vulnerability is limited to terminal-output interpretati ...[truncated 1346 chars]
Remediation: View remediation
&2 } ``` 3. Never use `%b` for filenames, user arguments, parsed YAML values, or other untrusted strings. 4. For clearer argument boundaries, implement helpers that accept a single message argument and invoke them with `"$1"`-safe formatting. 5. Consider displaying filenames in shell-escaped form: ```bash printf -v safe_path '%q' "$1" info "Validating YAML: $safe_path" ``` 6. Add regression tests using filenames containing backslashes, newlines, and terminal escape notation to verify that the bytes are displayed literally rather than interpreted. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Most of the implementation aligns with the declared purpose: it validates YAML syntax, lints YAML/style issues, and converts YAML to JSON. It does not access unexpected external resources or perform unrelated actions. However, the script also exposes an additional keys command that enumerates top-level keys and previews values, which is a functional capability not mentioned in the description. This is a minor but real description-behavior mismatch because the code does more than the declared YAML validation/lint/format-conversion scope.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes the skill as validating YAML syntax, linting configs, and converting YAML to JSON. The script also exposes a 'keys' command that enumerates top-level keys and previews values, which is a separate file-inspection capability not mentioned in the stated description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.