Security audit

script creator with github companion

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it asks an agent to create files, run shell commands, and install unpinned Python packages in a shared environment without enough input validation or dependency safeguards.

Review this skill before installing. Only use it with trusted script names and dependency names, and require the agent to validate names, keep paths inside ~/.nanobot/workspace/test, quote shell arguments, and pin or review Python packages before installation. A per-script virtual environment would reduce the shared-environment risk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:75
Finding: Shell Command Injection and Workspace Escape Through Unsanitized Placeholders
Content: View full analysis
``` ```bash cd git init ``` ```bash touch . ``` ```bash cd ~/.nanobot/workspace/test/ ``` ```bash git commit -m "" ``` ### Technical Analysis The Skill instructs the Agent to interpolate script names, extensions, paths, and commit messages directly into shell commands. It does not require validation, shell-safe quoting, canonical path verification, or execution through an argument-array API. If a user-controlled value contains shell metacharacters such as `;`, `&&`, command substitutions, redirections, or newline characters, the shell may interpret those characters as additional commands. Script names containing `../`, path separators, or absolute-path syntax could also cause operations to escape `~/.nanobot/workspace/test`. The plan-confirmation requirement does not reliably mitigate this flaw. A malicious value can be presented in the plan and subsequently passed unchanged to a shell after confirmation. The vulnerable behavior occurs when an Agent follows these command templates literally. ### Attack Path 1. An attacker asks the Agent to create or modify a script and supplies a malicious script name, extension, or commit message. 2. The value includes shell control syntax or path traversal, such as a script name logically equivalent to `example; ` or `../../`. 3. The Agent inserts the value into one of the documented shell commands without validation or quoting. 4. The shell parses the injected syntax as an additional command, or the resolved path leaves the intended workspace. 5. The injected command runs with the Agent ...[truncated 663 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:94
Finding: Unpinned and Unverified Third-Party Package Installation
Content: View full analysis
``` ```bash source ~/.nanobot/workspace/venv/bin/activate pip install ... deactivate ``` ```bash source ~/.nanobot/workspace/venv/bin/activate pip install deactivate ``` ### Technical Analysis The Skill directs the Agent to install packages using unresolved package names without requiring exact version pins, cryptographic hashes, a trusted package index, provenance checks, or package-name review. Python package installation can execute package-controlled build logic during installation. Consequently, installing a malicious, compromised, typo-squatted, or dependency-confusion package can result in code execution rather than merely adding inert library files. The virtual environment is shared at `~/.nanobot/workspace/venv` rather than isolated per script. A malicious or incompatible package can therefore contaminate other scripts that use the same environment. Version omission also makes the workflow nondeterministic because the installed package can change after the Skill has been reviewed. ### Attack Path 1. An attacker requests a Python script and specifies a deceptive, typo-squatted, compromised, or attacker-controlled package. 2. The package is included in the creation or modification plan. 3. After confirmation, the Agent runs `pip install` without pinning a version or verifying a hash or source. 4. Pip retrieves the package and may execute its build or installation logic. 5. Malicious code runs with the Agent user's privileges and can alter the shared virtual environment or access other resources available to that user. 6. Other scripts using the same virtual environment may subsequently import the contaminated package, extending the impact be ...[truncated 593 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: script-git-manager description: > Create and modify scripts in ~/.nanobot/workspace/test with strict Git versioning. Each script lives in its own directory with an isolated git repository. Always confirms creation plan before execution and reports progress at each step. Uses ~/.nanobot/workspace/venv for Python environment and package management.

Static analysis

No suspicious patterns detected.