Reg Limited

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:59 PM UTC
• Version: 1.0.2

Overview

The skill appears non-malicious, but it should be reviewed because it stores vehicle plate reminder data locally without clear disclosure or restrictive permissions and its documentation overstates city and reminder support.

Review before installing if you plan to store real plate numbers. Treat it as mainly a Beijing query tool, not a reliable multi-city reminder system. The add command keeps plate, city, and reminder time in ~/.reg-limited/config.json in plaintext, so avoid using it on shared machines or with sensitive vehicle data unless the storage permissions and documentation are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/reg-limited.js:232

Finding

Reminder Data Stored in Plaintext Without Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: bin/reg-limited.js:232-256
Vulnerability Type: Insecure local storage of personal data
Risk Level: Medium

Vulnerable Code

js

const fs = require('fs');
const configPath = process.env.HOME + '/.reg-limited/config.json';

let config = { reminders: [] };
try {
  if (fs.existsSync(configPath)) {
    config = JSON.parse(fs.readFileSync(configPath));
  }
} catch (e) {}

const reminder = {
  id: Date.now().toString(),
  city,
  plate,
  time,
  created: new Date().toISOString()
};

config.reminders.push(reminder);

const dir = require('path').dirname(configPath);
if (!fs.existsSync(dir)) {
  fs.mkdirSync(dir, { recursive: true });
}

fs.writeFileSync(configPath, JSON.stringify(config, null, 2));

Technical Analysis

The application stores vehicle plate numbers, cities, reminder times, and creation timestamps in the predictable path ~/.reg-limited/config.json. The data is serialized directly as plaintext JSON.

Neither fs.mkdirSync() nor fs.writeFileSync() specifies a restrictive permission mode. Consequently, permissions are determined by the process umask. Under a commonly used umask such as 0022, the directory can be created with mode 0755 and the file with mode 0644, potentially making the reminder data readable by other local users.

The implementation also does not verify the ownership or existing type of the configuration directory and file before accessing them. The confirmed exposure is the absence of explicit access controls for the stored personal data.

Attack Path

1. A user invokes reg-limited add with a city, vehicle plate, and reminder time.
2. The application places those values into the reminder object.
3. The directory and configuration file are created using permissions derived from the environment's umask.
4. On a shared system with permissive resulting permissions, another local ...[truncated 911 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the configuration directory with owner-only permissions:

   js

   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   

2. Create and write the configuration file with mode 0600:

   js

   fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
     encoding: 'utf8',
     mode: 0o600
   });
   

3. Apply restrictive permissions to existing installations using fs.chmodSync(dir, 0o700) and fs.chmodSync(configPath, 0o600) where appropriate.

4. Before reading or replacing an existing file, use lstat and ownership checks to ensure it is a regular file owned by the current user rather than an unexpected filesystem object.

5. Write updates to an owner-only temporary file in the same protected directory and atomically rename it to the destination to reduce corruption and replacement risks.

6. Minimize retained personal data. If the complete plate is unnecessary for reminders, store a masked or otherwise reduced representation. If full plate retention is required, consider encryption backed by an operating-system credential store.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior does not match the detected capabilities: the skill performs external network access, overstates multi-city support, and claims reminder delivery that may not actually occur. This is security-relevant because users and reviewers cannot accurately assess what data leaves the system or what operational guarantees exist, which can lead to unintended data disclosure and unsafe reliance on incorrect traffic-restriction results.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · bin/reg-limited.js (reported line 47)May include surrounding context.

js

if (result) {
      const rules = parseBeijingRules(result);
      if (rules) {
        return rules;
      }
    }
    return null;

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill appears to require shell and environment capabilities but does not declare any tool scope or permissions. Undeclared execution capabilities are dangerous because they bypass least-privilege review and can enable command execution or access to sensitive environment data beyond what users would reasonably expect from a vehicle restriction query tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill describes sending reminders through external message channels without warning users that vehicle plate numbers and city/timing data may be transmitted to third-party services. Plate information is sensitive personal data in many contexts, and silent forwarding to Feishu, Telegram, or similar channels can create privacy and compliance risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code invokes curl through execSync, which spawns a shell and an external binary instead of using a native HTTP client. While the URL is hardcoded and there is no obvious command injection here, using shell execution increases attack surface, blocks the process synchronously, and inherits the risks of PATH/binary hijacking or unexpected shell behavior in compromised environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

City names, parsing logic, and remote content assumptions are all tied to Chinese-language data sources and Chinese locale strings, but the tool does not explicitly present itself as China/Chinese-only or offer any language/locale opt-in. This can violate language/locale policy expectations when a skill silently forces one locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill persists reminder data to ~/.reg-limited/config.json, including plate numbers and scheduling data, without clearly disclosing this storage behavior to the user. Persistent storage of potentially sensitive personal data can surprise users and create privacy risk, especially on shared systems or where home directories are backed up or accessible to other tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The tool makes an outbound request to an external government website to retrieve Beijing restriction data, but the CLI help does not clearly tell users that network access occurs. This is primarily a transparency/privacy issue rather than direct code-execution risk, but undisclosed network activity can be problematic in restricted or monitored environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest text says the tool is for 'Chinese cities' and the keywords further narrow it to 'beijing', which indicates a locale-specific scope. Under the policy, locale constraints should either offer user choice or be clearly documented and justified; this manifest provides no such explanation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bin/reg-limited.js:42