Security audit

Bigdata

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local data-workflow logger, but its headline overstates processing capabilities and it stores raw plaintext entries without clear retention or permission controls.

Review this before installing if you might record dataset names, SQL, schemas, paths, customer information, or secrets. It appears local-only and not malicious, but it keeps raw plaintext history under ~/.local/share/bigdata and does not clearly limit retention or enforce private file permissions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:6
Finding: Potentially Sensitive Log Files Are Created Without Restrictive Permissions
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` Representative command-specific log creation: ```bash else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/ingest.log" local total=$(wc -l < "$DATA_DIR/ingest.log") echo " [Bigdata] ingest: $input" echo " Saved. Total ingest entries: $total" ``` ### Technical Analysis The script creates its data directory and log files without explicitly applying restrictive permissions. Their resulting modes therefore depend entirely on the invoking process's `umask`. With a common `022` umask, the directory may be created as mode `0755` and log files as mode `0644`, allowing other local users to traverse the directory and read its contents. The Skill is designed to record queries, schemas, pipeline definitions, dataset names, profiling results, and arbitrary user-supplied text. These records may contain sensitive business information, internal infrastructure details, file paths, or accidentally supplied credentials. The files are also deliberately stored in plaintext. The same weakness affects `history.log` and all command-specific logs created through append redirection. ### Attack Path 1. A user invokes a logging command such as `bigdata query`, `bigdata schema`, or `bigdata pipeline` with sensitive operational information. 2. The script creates `~/.local/share/bigdata` and its log files using permissions inherited from the user's current `umask`. 3. Under a permissive `umask`, the directory and files become readable by other accounts on the same h ...[truncated 794 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:153
Finding: Unescaped Multiline Input Permits Audit-Log Entry Injection
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` A representative command branch writes the same untrusted input directly to a command-specific log: ```bash else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/ingest.log" local total=$(wc -l < "$DATA_DIR/ingest.log") echo " [Bigdata] ingest: $input" echo " Saved. Total ingest entries: $total" _log "ingest" "$input" ``` ### Technical Analysis Command arguments are concatenated into `input` and appended directly to line-oriented log files. The script neither rejects control characters nor escapes newlines and the `|` field delimiter. An attacker who can influence a command argument can include newline characters followed by text resembling a legitimate timestamped record. The shell quoting prevents command substitution from being re-evaluated, so this issue does not by itself provide shell-command execution. However, embedded newlines are preserved in the value and interpreted as separate records by later line-based operations. The injected lines affect entry counts, search results, recent-activity output, exports, and any human or automated process that treats each line as an authentic audit event. Because the Skill describes these logs as audit trails, failure to preserve record boundaries directly undermines their integrity. ### Attack Path 1. An attacker controls or influences text passed to a data command. 2. The attacker supplies an argument containing a newl ...[truncated 1291 chars]
Remediation: View remediation
&2 return 1 fi } ``` 2. Replace `echo` with `printf` so output behavior is consistent and values beginning with implementation-specific options are not interpreted unexpectedly: ```bash printf '%s|%s\n' "$ts" "$input" >> "$DATA_DIR/ingest.log" printf '%s %s: %s\n' "$(date '+%m-%d %H:%M')" "$type" "$input" \ >> "$DATA_DIR/history.log" ``` 3. Escape or encode the `|` delimiter if it remains part of the storage format. Prefer a structured format with a reliable serializer, such as JSON Lines, where control characters and quotes are correctly escaped. 4. Centralize record creation in one validated logging function rather than duplicating vulnerable append operations across all command branches. 5. Treat existing logs as potentially malformed. During migration, parse them defensively, limit record lengths, and do not assume every physical line represents an authentic event. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill metadata and description promise large-file splitting, parallel processing, and streaming batch analysis, but the documented behavior is actually a local plaintext activity logger that persists user-supplied data in ~/.local/share/bigdata across many commands. This mismatch can mislead users and downstream agents into providing sensitive dataset names, queries, schema details, or workflow notes under the assumption of ephemeral processing, creating an unexpected privacy and data-retention risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata advertises large-file splitting, parallel processing, and streaming analysis, but the implementation mainly stores arbitrary user inputs in per-command log files under a persistent local directory. This mismatch is dangerous because users may provide sensitive dataset names, queries, filters, or pipeline details expecting data processing, while the tool silently retains those inputs instead, creating an unexpected privacy and trust boundary violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The help text claims export <fmt> produces formatted output, but the first export) branch in the dispatcher captures the command and logs the provided argument instead of calling _export. Because a second export) case later is unreachable, users intending to export data may unknowingly persist potentially sensitive parameters to disk rather than performing the requested operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code persistently writes raw user-provided input to $HOME/.local/share/bigdata/*.log and history.log without warning, sanitization, retention controls, or access protections. In the context of a data-processing skill, users are likely to pass sensitive dataset identifiers, queries, paths, or business data, so silent long-term local logging increases the risk of privacy leakage and unintended disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.