Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:33 AM UTC
• Version: 2.0.0

Overview

The skill is presented as a placeholder-data generator, but its script mostly behaves like a persistent local input/history manager, so it needs review before installation.

Install only if you are comfortable with a local utility that may retain entered values under ~/.local/share/generator. Do not paste credentials, tokens, personal data, or proprietary fixture content into it unless the publisher fixes the scope mismatch, documents retention clearly, adds cleanup controls, and hardens file permissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:6

Finding

Potentially Sensitive Command Input Stored in Plaintext Logs

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 6-9 and 124-136
Vulnerability Type: Plaintext storage of potentially sensitive user input with inherited filesystem permissions
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${HOME}/.local/share/generator"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

bash

run)
    shift
    if [ $# -eq 0 ]; then
        echo "Recent run entries:"
        tail -20 "$DATA_DIR/run.log" 2>/dev/null || echo "  No entries yet. Use: generator run <input>"
    else
        local input="$*"
        local ts=$(date '+%Y-%m-%d %H:%M')
        echo "$ts|$input" >> "$DATA_DIR/run.log"
        local total=$(wc -l < "$DATA_DIR/run.log")
        echo "  [Generator] run: $input"
        echo "  Saved. Total run entries: $total"
        _log "run" "$input"
    fi
    ;;

The same plaintext logging pattern is repeated for the argument-bearing command branches through line 301.

Technical Analysis

The script accepts arbitrary command arguments and is designed to append them without redaction or encryption to command-specific log files and history.log. The storage directory is created using mkdir -p, but the script does not establish a restrictive umask or explicitly set directory and file permissions.

Consequently, the resulting access permissions depend on the invoking environment. Under a commonly used 022 umask, the directory may be created with mode 755 and log files with mode 644, potentially allowing other local users or processes to read their contents. Inputs are also duplicated: once in the command-specific log and once in history.log.

This behavior is not clearly disclosed in SKILL.md, which states that results are written to standard output. Users may therefore supply fixture records, tokens, personal information, or other sensitive sample dat ...[truncated 1680 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive umask before creating any storage:

   bash

   umask 077
   

2. Explicitly enforce secure permissions:

   bash

   install -d -m 700 "$DATA_DIR"
   touch "$DATA_DIR/history.log"
   chmod 600 "$DATA_DIR/history.log"
   

3. Default to stdout-only behavior and make persistent logging an explicit opt-in feature.

4. Do not record complete user arguments. Log only non-sensitive metadata such as the command name, timestamp, success state, and a generated record identifier.

5. If input logging is necessary, implement redaction for credentials, authorization headers, tokens, passwords, private keys, and other likely secrets.

6. Avoid duplicating sensitive values across command-specific logs and history.log.

7. Document the persistence behavior, storage location, retention policy, and deletion procedure in SKILL.md.

8. Add a command that securely deletes retained records and establish an automatic retention limit or expiration period.

9. Correct the top-level use of local, but apply the storage protections before making the affected command branches operational.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is a simple placeholder-data generator, but the documented commands and configuration indicate broader stateful behavior such as status tracking, item management, export, and a persistent local data directory. That mismatch is dangerous because users may invoke the skill expecting ephemeral mock-data generation while it accumulates, stores, and exports data, which can expose prompts, generated content, or other user-provided material without clear disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script's implemented behavior materially differs from the declared skill purpose: instead of generating placeholder data, it acts as a persistent local command/input logger with export, search, and reporting features. This kind of scope mismatch is dangerous because users may provide sample secrets, internal prompts, or fixture content under the assumption of transient generation, while the tool silently stores those inputs on disk for later retrieval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Labeling this as a 'Generator' utility while it predominantly logs and manages user-provided entries is misleading. Misrepresentation reduces informed consent and can cause users to enter data they would not otherwise provide, especially in a developer tooling context where sample inputs may contain credentials, tokens, or proprietary test data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The extra capabilities for status, reporting, search, recent history, and export create a broader data-handling surface than justified for a placeholder-data generator. Those features make previously entered content easy to enumerate and exfiltrate locally, increasing privacy and misuse risk if users paste sensitive development data into the tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

User input is appended verbatim to files under ~/.local/share/generator without a prominent warning or consent flow. In the context of a tool presented as a generator for dev fixtures, users may reasonably supply sensitive sample data, and persistent plaintext storage creates confidentiality risk for other local users, backups, or later export operations.

Content

No source excerpt is available for this finding.