Security audit

Rectifier

Security checks for vulnerabilities and agentic risk

Overview

The skill says it is a rectifier calculator, but it actually stores, deletes, searches, configures, and exports local records.

Review this before installing. Use it only if you want a simple local record manager named rectifier, not a rectifier design calculator. Do not store secrets in it, be careful with remove/export/config commands, and avoid opening exported CSV files from untrusted entries in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:10
Finding: Unescaped Input Allows JSONL Record Injection and Data Corruption
Content: View full analysis
> "$DATA_DIR/data.jsonl" } ``` The vulnerable function is reached through the `add` command at `scripts/script.sh:48-52`: ```bash cmd_add() { local value="${1:?Usage: rectifier add }" shift || true _save_entry "add" "$value $*" local count=$(wc -l < "$DATA_DIR/data.jsonl" 2>/dev/null || echo 0) echo "Added: $value (entry #$count)" } ``` ### Technical Analysis The `val` parameter contains user-controlled command-line input and is interpolated directly into a JSON object. Shell quoting prevents this value from being interpreted as a shell command, but it does not make the value safe for JSON. Quotation marks, backslashes, carriage returns, newlines, and other JSON control characters are not escaped. An attacker can consequently terminate the intended `val` field, corrupt the record, or insert additional lines that resemble independent JSONL records. The application's readers use line-based processing and `grep`/`cut` rather than a strict JSON parser. They therefore may display or export injected lines as legitimate stored records. ### Attack Path 1. An attacker or untrusted caller invokes `scripts/script.sh add` with an entry containing JSON delimiters and a newline. 2. `cmd_add` forwards the input to `_save_entry`. 3. `_save_entry` writes the input verbatim into `data.jsonl`. 4. The newline creates an additional physical record, while quotation marks can alter the apparent JSON structure. 5. Subsequent `list`, `search`, and `export` operations process the forged or malformed content. 6. Users may rely on misleading output or distribute an export containing atta ...[truncated 690 chars]
Remediation: View remediation
> "$DATA_DIR/data.jsonl" ``` Additional hardening should include: 1. Parse stored records with a strict JSON parser rather than `grep` and `cut`. 2. Reject malformed existing records and report their line numbers. 3. Consider limiting the accepted entry size to prevent excessive disk consumption. 4. Write records to a securely created temporary file and atomically replace the destination where multi-step updates are required. 5. Add tests covering quotation marks, backslashes, tabs, carriage returns, newlines, and Unicode input. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:105
Finding: Unescaped CSV Export Permits Spreadsheet Formula Injection
Content: View full analysis
"$out" while IFS= read -r line; do ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo "$ts,$c2,$vl" >> "$out" done < "$DATA_DIR/data.jsonl" ;; ``` ### Technical Analysis The exporter writes attacker-controlled values directly into CSV rows without applying RFC 4180-compatible quoting or escaping. Commas, double quotation marks, carriage returns, and newlines can therefore alter the exported row and column structure. In addition, spreadsheet applications commonly interpret cells beginning with characters such as `=`, `+`, `-`, or `@` as formulas. Because the exported `value` field can begin with these characters, an entry can become an active spreadsheet formula when a user opens the generated file. The script does not itself execute the formula. Exploitation occurs when the exported CSV is opened in a spreadsheet application that evaluates formula-like cells. ### Attack Path 1. An attacker adds an entry whose value begins with a spreadsheet formula marker, such as `=`, `+`, `-`, or `@`. 2. The entry is stored in `data.jsonl`. 3. A user runs `scripts/script.sh export csv`. 4. The exporter copies the value into `rectifier-export.csv` without quoting or neutralization. 5. The user opens the CSV in a spreadsheet application. 6. Depending on that appli ...[truncated 965 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:139
Finding: Unvalidated Configuration Input Enables Regex and sed Replacement Injection
Content: View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The caller-controlled `key` is inserted directly into basic regular expressions used by `grep` and `sed`. Regex metacharacters in the key can therefore match configuration names other than the literal key supplied by the caller. Both `key` and `val` are also inserted directly into the `sed` replacement expression. In a `sed` replacement: - `&` expands to the entire matched text. - Backslashes have special meaning. - The selected `|` delimiter can terminate the replacement expression. These characters can corrupt the replacement, duplicate matched text, make `sed` fail, or update an unintended configuration line. Because the script enables `set -e`, a malformed expression can terminate the command. This is text-processing injection rather than shell-command injection: the variables remain inside a quoted shell argument, and no direct operating-system command execution path was identified. ### Attack Path 1. An attacker or untrusted caller invokes `config` with a key containing regular-expression metacharacters. 2. The `grep` condition treats the key as a pattern and may report an ...[truncated 882 chars]
Remediation: View remediation
&2 return 1 fi ``` Do not construct regular expressions or `sed` replacement programs from raw user input. Prefer a parser-based update that compares keys literally and writes a new file safely. Additional measures should include: 1. Store configuration in a structured format such as JSON and update it with a trusted parser. 2. If the existing text format must remain, compare key names literally rather than as regular expressions. 3. Write updates to a securely created temporary file in the same directory and atomically rename it. 4. Validate or safely encode newlines and delimiter characters in values. 5. Apply restrictive permissions to the configuration directory and file. 6. Add tests for regex metacharacters, `&`, backslashes, delimiters, and multiline values. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a rectifier circuit design calculator, but the documented behavior is a generic local CRUD/export utility with persistent storage and deletion capabilities. That mismatch is dangerous because an agent or user may invoke it under false assumptions, leading to unintended data creation, modification, export, or removal outside the expected electrical-analysis scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline documentation and branding present the script as a rectifier circuit design calculator, but the available commands operate on stored local entries rather than electrical calculations. Deceptive labeling increases security risk because reviewers, users, and orchestration systems may misclassify the skill as low-risk utility logic and overlook its real data-handling behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implementation materially diverges from the declared purpose: instead of performing rectifier calculations, it acts as a generic persistent data tracker with search, delete, export, and config management. That mismatch is dangerous because users or higher-level agents may grant it trust and permissions appropriate for a calculator, while it actually provides broader data persistence and manipulation capabilities that can be abused for covert collection or staging of local data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest advertises calculator-oriented rectifier functionality, while the commands implement a generic local data-management tool. This can cause unsafe agent selection and tool misuse, especially in automated environments that rely on metadata to determine whether a skill is appropriate and low-risk for a task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation guidance uses broad phrases like JSON/CSV rectifier tasks and checking rectifier status without clear scope boundaries. In agentic systems, vague routing criteria can cause the skill to be selected for loosely related tasks, exposing local storage and modification functionality in contexts where it was not intended.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation claims rectifier calculator functionality, but the listed commands are entry-management operations such as add, remove, export, and config. This discrepancy increases the chance that users or agents will trigger state-changing operations while expecting read-only analytical behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation exposes data-modifying and export commands without warning about persistence, deletion, or data exfiltration to files. That omission is risky because users and agents may treat the skill as informational while it can alter local state or write potentially sensitive records to disk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script initializes a persistent directory under user-controlled storage and writes timestamped command/value records to a JSONL file, capabilities that are unnecessary for a simple calculator. In this context, unjustified persistence enlarges the attack surface by enabling silent local data accumulation, retention of sensitive user inputs, and later retrieval or export.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script modifies and appends to a persistent config file in the user's data directory, which is a file write operation covered by the missing-warning rule for code files. While it prints a success message after the change, there is no prior warning, confirmation, or explanatory comment/docstring disclosing that persistent configuration data will be written.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.