T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:5- Finding
Operational Logs Are Created Without Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Cpu
Security checks for vulnerabilities and agentic risk
Overview
The skill is branded as CPU monitoring but actually behaves like a local operations journal that may retain and export sensitive notes.
Install only if you want a local operations journal, not an actual CPU monitor. Avoid recording secrets, tokens, customer data, private incident details, or sensitive infrastructure notes, and review the local log directory and exported files before sharing or backing them up.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:68- Finding
Unsafe JSON and CSV Serialization of Attacker-Controlled Log Content
- Content
View full analysis
> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" ``` ### Technical Analysis The export implementation directly interpolates log content into JSON and CSV without format-appropriate encoding. For JSON output, quotation marks, backslashes, control characters, and embedded line breaks are not escaped. A crafted value can terminate the intended JSON string, inject additional properties or objects, or make the exported document invalid. This threatens the integrity of downstream processing and can alter the apparent meaning of exported records. For CSV output, fields are not enclosed in quotes and embedded quotes are not doubled. Commas and line breaks can therefore create additional columns or records. Values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` may be interpreted as formulas when opened in compatible spreadsheet applications. The script itself does not evaluate these values as shell commands. Exploitation occurs when a generated export is consumed by a parser, automation system, or spreadsheet that assigns active semantics to malformed or formula-bearing data. ### Attack Path #### JSON injection path 1. An attacker persuad ...[truncated 1903 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a CPU monitoring utility, but the documented behavior is a broad append-only local logging system that accepts arbitrary user input, persists it across many files, and exposes unrelated operational actions such as backup, restore, fix, and cleanup. This mismatch is dangerous because users and agents may grant trust or supply sensitive operational data under the assumption they are invoking a narrow observability tool, when in fact the skill functions as a generic data collection and journaling surface.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest advertises CPU monitoring and process ranking, but the body describes a general-purpose local operations journal with arbitrary logging. In an agent setting, this kind of semantic deception can cause inappropriate invocation, leakage of sensitive infrastructure notes into local storage, and mistaken reliance on capabilities the skill does not actually provide.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The advertised capability is CPU monitoring and process ranking, but the implementation exposes a broad 'sysops toolkit' interface with unrelated commands. This mismatch is dangerous because users or higher-level agents may trust the manifest and invoke operationally sensitive actions under false assumptions, creating room for deceptive or unintended behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The command handlers do not inspect CPU state at all; they persist arbitrary user input into files under ~/.local/share/cpu. In an agent setting, this is dangerous because the skill effectively acts as a covert persistence sink for prompts, operational context, or sensitive data while pretending to perform system monitoring.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill name and top-level description suggest a focused CPU-monitoring tool, while the body instructs use as a generic sysops journal. This context makes the mismatch more dangerous because users seeking low-risk telemetry functionality are more likely to trust and use the skill without realizing it creates durable local records unrelated to CPU inspection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Backup, restore, fix, cleanup, and general logging capabilities materially expand the command surface beyond CPU monitoring without justification. Even if these commands only log text, they normalize operationally sensitive workflows and encourage users to record remediation, backup, or incident details in a mislabeled tool, increasing the chance of confidential data retention and misuse.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Describing the tool as a general 'sysops toolkit' conflicts with the manifest's narrow CPU-monitoring role. This inconsistency weakens trust boundaries and can cause users, reviewers, or agents to misunderstand the skill's scope, which is especially risky when combined with hidden data persistence and unrelated commands.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The presence of unjustified operational capabilities broadens the skill beyond its stated CPU-focused purpose. Even though these handlers currently only log input, unnecessary capabilities increase attack surface and can mislead orchestrators into granting or invoking functionality that should not exist in this skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The export feature aggregates stored log contents into new files in multiple formats without warning that prior activity data will be copied and duplicated. This increases the exposure of potentially sensitive stored content and makes accidental sharing, backup propagation, or later discovery more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
User-supplied input is silently written to persistent local logs without clear disclosure in the help text or documentation. This creates a privacy and secret-retention risk because users and calling agents may pass sensitive operational data expecting ephemeral processing, not long-term storage.
- Content
Static analysis
No suspicious patterns detected.