Security audit

Tar

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent tar archive utility, but its bundled script has unsafe tar handling that can turn crafted inputs into filesystem overwrite or command-execution risk.

Review before installing. Use this only with archives and file arguments you trust, avoid untrusted tar files, avoid filenames beginning with dashes, and extract only into a disposable directory until the script adds explicit option terminators and archive-entry validation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:48
Finding: Unsafe Archive Extraction May Write Outside the Intended Destination
Content: View full analysis
[output-dir]}" local outdir="${2:-.}" [ ! -f "$archive" ] && die "File not found: $archive" local compress="" case "$archive" in *.tar.gz|*.tgz) compress="z" ;; *.tar.bz2|*.tbz2) compress="j" ;; *.tar.xz|*.txz) compress="J" ;; *.tar) compress="" ;; esac mkdir -p "$outdir" tar -x${compress}vf "$archive" -C "$outdir" 2>&1 | while IFS= read -r line; do echo " - $line" done ``` ### Technical Analysis The extraction command processes every archive entry without first validating member names or symbolic and hard-link targets. A malicious archive may contain absolute paths, parent-directory traversal components such as `../`, or links that redirect subsequent writes outside the selected output directory. Some `tar` implementations and versions provide partial default protections, but the script does not explicitly enforce or verify those protections. It therefore treats implementation-dependent behavior as a security boundary and provides no post-extraction containment check. ### Attack Path 1. An attacker constructs an archive containing traversal paths, absolute paths, or entries associated with unsafe symbolic or hard links. 2. The attacker convinces a user or agent to process the archive with: ```bash scripts/script.sh extract malicious.tar output ``` 3. `cmd_extract` creates the destination and passes the unvalidated archive directly to `tar`. 4. If the installed `tar` implementation accepts the crafted entries or link behavior, extraction writes outside `output`. 5. Files accessible to the process can be created or overwritten. ### Impact Assessment Successful exploitation can create o ...[truncated 564 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:29
Finding: Tar Option Injection in Archive Creation
Content: View full analysis
&1 | while IFS= read -r line; do echo " + $line" done ``` ### Technical Analysis The user-controlled file arguments in `"$@"` are passed to `tar` without an option terminator. Arguments beginning with `-` can consequently be interpreted as `tar` options rather than filenames. On GNU tar, dangerous option combinations can include checkpoint-related actions that invoke a shell command while an archive is being processed. Quoting `"$@"` prevents shell word splitting but does not prevent the invoked program from interpreting individual arguments as options. ### Attack Path 1. An attacker controls or influences the file arguments supplied to the `create` command. 2. The attacker supplies option-shaped operands, including GNU tar options capable of defining and triggering a checkpoint action. 3. The script forwards those operands directly to `tar`: ```bash scripts/script.sh create output.tar ``` 4. GNU tar interprets the operands as options instead of file paths. 5. The attacker-selected checkpoint action executes under the identity of the Skill process. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the user invoking the Skill. The attacker could read or modify files available to that account, execute local programs, alter generated archives, or access credentials exposed to the process. This issue does not independently elevate the process beyond its existing operating-system privileges, but it converts control over archive operands into code execution within that privilege boundary. ]]>
Remediation: View remediation
` with validated relative paths. - Test specifically with filenames beginning with `-`. - Ensure the archive output operand is also handled safely according to the supported `tar` implementation. - Run the Skill with least privilege so that any residual command-execution flaw has limited impact. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:101
Finding: Tar Option Injection When Appending to an Archive
Content: View full analysis
&1 | while IFS= read -r line; do echo " + $line" done ``` ### Technical Analysis The `add` operation forwards user-controlled file arguments to `tar` without using `--` to mark the end of options. An argument beginning with `-` may therefore be parsed as a tar option rather than as a file to append. On GNU tar, an attacker may combine option-shaped arguments with features such as checkpoint actions. Shell quoting does not mitigate this issue because the vulnerability occurs during argument interpretation by `tar`, after Bash has invoked it. ### Attack Path 1. An attacker supplies or influences arguments passed to the `add` command. 2. A valid uncompressed `.tar` archive is selected to satisfy the function's preliminary checks. 3. The attacker includes GNU tar option-shaped arguments capable of registering and triggering a command action. 4. The script invokes: ```bash scripts/script.sh add existing.tar ``` 5. `tar` interprets the malicious operands as options. 6. The attacker-selected command executes with the privileges of the invoking process. ### Impact Assessment Successful exploitation enables arbitrary command execution as the user running the Skill. It can compromise files, credentials, environment data, and processes accessible to that account, in addition to modifying the selected archive. The vulnerability does not directly bypass operating-system privilege controls. Its scope is determined by the privileges and environment of the invoking process. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description uses broad activation language such as 'Use when scanning contents, monitoring sizes, reporting results, alerting corruption,' which can cause an agent to invoke the skill in loosely related situations without clear preconditions. This increases the chance of unnecessary handling of archives and indirect exposure to risky operations like extraction or filesystem inspection, even though the file itself does not contain overtly malicious instructions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents an extract command that writes archive contents to disk but provides no warning about the risks of unpacking untrusted archives, such as path traversal, overwriting files, symlink abuse, or unexpected disk usage. In an agent setting, omission of these safety constraints can lead to unsafe extraction behavior being treated as routine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The extract command writes archive contents directly to disk without any warning, validation, or safety checks for untrusted tar contents. In this skill context, that is materially risky because tar archives can contain path traversal entries, absolute paths, symlinks, or other unexpected filesystem content, so using this on untrusted input can overwrite files or place attacker-controlled files in sensitive locations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.