Ai Agent Tools

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:37 PM UTC
• Version: 0.1.0

Overview

The utility code is mostly straightforward, but the installation guidance tells users to fetch mutable GitHub code and includes unnecessary sudo execution, so it needs review before use.

Install only from the reviewed local artifact or a pinned, verified release. Do not run this library with sudo or administrator privileges, and only expose its file read/write tools to an agent with explicit path limits and user-approved output locations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19
• Finding: Unverified Remote Python Payload Retrieved from a Mutable Branch<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:19` - `INSTALLATION.md:13` - `INSTALLATION.md:16` - `INSTALLATION.md:215` - `README.md:28` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:19`: ```bash wget https://raw.githubusercontent.com/cerbug45/ai-agent-tools/main/ai_agent_tools.py ``` `INSTALLATION.md:13`: ```bash wget https://raw.githubusercontent.com/cerbug45/ai-agent-tools/main/ai_agent_tools.py ``` `INSTALLATION.md:16`: ```bash curl -O https://raw.githubusercontent.com/cerbug45/ai-agent-tools/main/ai_agent_tools.py ``` `INSTALLATION.md:215`: ```bash curl -O https://raw.githubusercontent.com/cerbug45/ai-agent-tools/main/ai_agent_tools.py ``` `README.md:28`: ```bash wget https://raw.githubusercontent.com/cerbug45/ai-agent-tools/main/ai_agent_tools.py ``` The installation guide also presents mutable repository installation methods: ```bash git clone https://github.com/cerbug45/ai-agent-tools.git pip install git+https://github.com/cerbug45/ai-agent-tools.git ``` ### Technical Analysis The documented commands retrieve executable Python source from the mutable `main` branch of a personal GitHub repository. They do not pin an immutable commit, verify a cryptographic checksum, validate a signature, or use signed release provenance. The downloaded module is subsequently imported by user applications or executed using: ```bash python ai_agent_tools.py ``` Consequently, the payload that executes can differ from the locally audited `ai_agent_tools.py`. Although downloading software is a legitimate installation activity, retrieving mutable and unverified executable content is not necessary for the declared utility-library functionality and violates supply-chain integrity principles. The locally reviewed implementation does not contain malicious networking, persistence, subprocess execution, credential access, or obfuscation. However, those findings do not establis ...[truncated 1502 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove direct download instructions that reference a mutable branch. 2. Prefer the audited `ai_agent_tools.py` already distributed with the Skill package. 3. Publish immutable, versioned releases through a trusted package registry. 4. If GitHub downloads remain necessary, pin them to a reviewed full commit hash rather than `main`, for example: ```bash curl -fLO https://raw.githubusercontent.com/cerbug45/ai-agent-tools/FULL_COMMIT_HASH/ai_agent_tools.py ``` 5. Publish a SHA-256 checksum through an authenticated release channel and require verification before import or execution: ```bash echo "EXPECTED_SHA256 ai_agent_tools.py" | sha256sum --check - ``` 6. Use signed release tags, package signatures, and verifiable build provenance. 7. Configure automated dependency and release-integrity monitoring. 8. Instruct users to inspect and verify downloaded source before executing it. 9. Avoid executing downloaded code with elevated privileges. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: INSTALLATION.md:262
• Finding: Unnecessary Root Execution Recommended as a Permission Workaround<![CDATA[ ## Vulnerability Details **File Location**: `INSTALLATION.md:262-269` **Vulnerability Type**: Unsafe privilege escalation guidance **Risk Level**: High ### Vulnerable Code ```bash **Solution:** ```bash # Make file executable (Linux/macOS) chmod +x ai_agent_tools.py # Or run with appropriate permissions sudo python ai_agent_tools.py ``` ``` ### Technical Analysis The installation guide recommends running the Python module with `sudo` in response to a permission error. The library's declared functions—text processing, JSON and CSV conversion, calculations, in-memory state, and ordinary user-controlled file operations—do not require root privileges. Running Python as root grants the entire module unrestricted system-level access. This is particularly unsafe because the same documentation recommends retrieving the module from an unpinned, mutable remote branch. Python source does not need an executable permission bit when invoked through the Python interpreter, so both the `chmod +x` advice and root execution fail to address the underlying filesystem ownership or access-control problem safely. The local demonstration code writes `test.txt` to the current working directory. A permission failure should be resolved by selecting a user-writable directory or correcting ownership and permissions, not by elevating the interpreter. ### Attack Path 1. A user downloads the module using the documented mutable remote-source procedure. 2. The user encounters a permission error because the current directory or target file is not writable. 3. Following the troubleshooting guide, the user executes: ```bash sudo python ai_agent_tools.py ``` 4. Any top-level or demonstration code in the downloaded module executes as root. 5. A compromised or malicious payload can modify protected files, install services, access system credentials, or establish system-wide persistence. Even when the reviewed local version is used, normal programming errors or future cha ...[truncated 642 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `sudo python ai_agent_tools.py` recommendation. 2. Do not recommend making the Python source executable; invoke it through a user-owned virtual environment instead: ```bash python3 -m venv .venv . .venv/bin/activate python ai_agent_tools.py ``` 3. Diagnose the actual permission problem using directory ownership and access checks: ```bash pwd ls -ld . ls -l ai_agent_tools.py ``` 4. Run the test from a user-writable project or temporary directory. 5. Correct ownership only for files legitimately belonging to the user rather than elevating the program. 6. Ensure library operations are confined to explicitly approved paths when exposed as agent tools. 7. Add documentation stating that the package neither requires nor should be run with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

Method 2: Clone from GitHub (Recommended for Development)

```bash
# Clone the repository
git clone https://github.com/cerbug45/ai-agent-tools.git

# Navigate to the directory
cd ai-agent-tools

# Test the installation
python ai_agent_tools.py
```

### Method 3: Install as Python Package (Coming Soon)

```bash
# Using pip (when published to PyPI)
pip install ai-agent-tools

# From GitHub directly
pip install git+https://github.com/cerbug45/ai-agent-tools.git
```

### Method 4: Add as Git Submodule (For Larger Projects)

```bash
# Add to your project as a submodule
git submodule add https://github.com/cerbug45/ai-agent-tools.git libs/ai-agent-tools

# Update the submodule
git submodule update --init --recursive
```

## 🐍 Python Version Requirements

- **Minimum:** Python 3.7
- **Recommended:** Python 3.9 or higher
- **Tested on:** Python 3.7, 3.8, 3.9, 3.10, 3.11

Check your Python version:

```bash
python --version
# or
python3 --version
```

## 📋 System Requirements

### Operati

• Confidence: 90% confidence
• Finding: The installation guide instructs users to install directly from a live GitHub repository and also to download raw code for execution, which bypasses stronger supply-chain controls such as signed releases, pinned commits, hashes, or vetted package publication. In a skill/install context this is more dangerous because the document normalizes immediate trust and execution of remote code, so repository compromise or upstream tampering could lead to arbitrary code execution on user systems.

Memory Manipulation

High

• Category: Memory Poisoning

Content

```

### 2. Memory Management
Clear memory when no longer needed:

```python
memory = MemoryTools()

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

chmod +x ai_agent_tools.py

# Or run with appropriate permissions
sudo python ai_agent_tools.py
```

### Issue: Python Version

• Confidence: 84% confidence
• Finding: The guide recommends running `sudo python ai_agent_tools.py` as a troubleshooting step, which encourages executing downloaded code with elevated privileges. In the context of this installation document, users are also told to fetch code directly from GitHub, so combining remote code retrieval with root execution materially increases the chance of full-system compromise if the file is malicious or tampered with.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file documents write and file-management capabilities such as writing files, saving outputs, and later clearing memory, but it does not include any warning that these actions can overwrite data or remove stored state. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The documentation specifies phone validation as 'Turkish format' and uses Turkish-format examples elsewhere, which imposes a locale-specific assumption in a general-purpose utility library. Under SQP-3, locale constraints should either be optional for the user or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The file's human-facing docstrings, status messages, and example output are entirely in Turkish, which effectively fixes the skill's natural-language interface to a single language. There is no indication that users can choose another language or that the Turkish-only behavior is a justified regional constraint.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code file defines a general-purpose write operation that creates directories and overwrites file contents, but provides no confirmation prompt or explicit user disclosure before the write occurs. Although there is a success return string after completion, it does not warn the user in advance, and the helper is broad enough that file modification may not be obvious from the calling context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The JSON save function persists arbitrary data to disk and creates parent directories, but the code only reports success after the action is complete. There is no confirmation mechanism, pre-write disclosure, or explicit warning in the surrounding documentation about saving or overwriting user data.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The document shows the expected test output entirely in Turkish, which implies a fixed language experience for users following the guide. Because no user opt-in, alternative language option, or justification for the locale is provided, this appears to violate the language/locale policy criteria.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file describes file operations including writing files, and later shows `save_json(..., "output.json")` and `save_json(data, "users.json")` as normal usage. There is no accompanying warning about overwriting existing files, choosing safe paths, or reviewing outputs before saving, which is a user-data integrity concern for a skill aimed at AI agents.

Static analysis

No suspicious patterns detected.