Security audit

Home Organizer

Security checks for vulnerabilities and agentic risk

Overview

This home organizer skill is mostly a local utility, but it stores personal entries persistently and falsely reports deletion, so users should review it before installing.

Install only if you are comfortable with local plaintext storage under your user data directory. Avoid adding sensitive addresses, schedules, or personal notes until the package documents retention clearly, restricts file permissions, and implements real deletion or a purge command.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Undisclosed Persistent Storage and Ineffective Data Removal
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } ``` ### Technical Analysis The script automatically creates a persistent data directory and writes user-supplied entries to `data.log`. It also records command activity in `history.log`. This persistence is not clearly disclosed by the skill documentation, which states that results are written to standard output. The `remove` command is functionally misleading: it reports that an entry was removed but never reads from or modifies `data.log`. Consequently, data that users believe has been deleted remains recoverable through direct filesystem access or subsequent `list`, `search`, and `export` commands. The files are created using the process's default `umask`, without explicit restrictive permissions. Depending on the execution environment and configured `umask`, stored household or personal information may be accessible to other accounts or processes with filesystem access. ### Attack Path 1. A user invokes `add` with household, schedule, address-related, or other personal information. 2. The script appends the information in plaintext to `data.log`. 3. The user invokes `remove` for that entry. 4. The script prints a successful removal message but does not alter `data.log`. 5. The retained entry can later be recovered using `list`, `search`, `export`, or direct access to the data file. 6. If local file permissions permit, another local ac ...[truncated 613 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/organize.sh:3
Finding: Unquoted Input Expansion Allows Word Splitting and Pathname Expansion
Content: View full analysis
/dev/null || true; INPUT="$*" ``` ```bash ' "$CMD" $INPUT ``` ### Technical Analysis The script initially combines all remaining arguments into the scalar variable `INPUT` using `"$*"`. It later expands `$INPUT` without quotation marks when invoking Python. Unquoted shell expansion applies: 1. Field splitting based on the current `IFS`. 2. Pathname expansion for wildcard characters such as `*`, `?`, and bracket expressions. As a result, the arguments received by Python can differ from those supplied by the caller. For example, an input containing `*` can expand into filenames from the current working directory. This construction does not, by itself, re-evaluate shell metacharacters as executable syntax, so arbitrary command execution was not established. The confirmed issue is unintended argument transformation and environment-dependent behavior. ### Attack Path 1. A caller supplies an argument containing wildcard characters or carefully selected whitespace. 2. The script stores the combined text in `INPUT`. 3. At line 33, the unquoted `$INPUT` expansion triggers shell field splitting and pathname expansion. 4. Matching filenames from the current directory are substituted into the Python argument list. 5. Python processes input different from what the caller intended, producing incorrect or unpredictable output. ### Impact Assessment The issue affects input integrity and reliability rather than system privileges. An attacker who can influence command arguments and the working directory can alter the arguments processed by the program. No privilege escalation, arbitrary command execution, network access, or unauthorized filesystem modification was demonstrated. The practical scope is the current invocation and the filenames visible from its w ...[truncated 23 chars]
Remediation: View remediation
0)); then shift fi python3 -c ' import sys cmd = sys.argv[1] if len(sys.argv) > 1 else "help" inp = " ".join(sys.argv[2:]) # Remaining implementation ' "$CMD" "$@" ``` If the application requires all remaining input as exactly one argument, use: ```bash INPUT="$*" python3 -c '...' "$CMD" "$INPUT" ``` Additional hardening should include: 1. Avoid unquoted variable expansions unless field splitting is explicitly required. 2. Use Bash arrays for multi-argument input. 3. Add tests covering spaces, empty arguments, `*`, `?`, bracket patterns, leading hyphens, and filenames containing whitespace. 4. Consider using ShellCheck in continuous integration; this pattern is detectable as unsafe shell expansion. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The primary instructions and workflow section are presented in Chinese, with no indication that users can choose another language or locale. This creates a language/locale policy concern because the skill appears to assume a specific language rather than offering an explicit option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script persistently logs user-supplied arguments to a history file without notice, which can capture sensitive data such as search terms, filenames, personal notes, or tokens passed on the command line. In a local utility context this creates a privacy and confidentiality risk, especially because the data is retained in predictable storage under the user's home directory.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The command name and user-facing output indicate that an entry is being removed, but the implementation never edits or deletes content from the data file. This is an active contradiction between the skill's implied command intent and its actual behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.