session-cleanup

• Outcome: Review
• Latest audit: May 28, 2026 · 12:43 PM UTC
• Version: 1.4.0

Overview

This cleanup skill matches its stated purpose, but its cleanup script can uninstall packages or delete skill directories from tracked data with weaker safeguards than the instructions imply.

Review before installing. Use dry-run first, inspect the session-track.json contents, and avoid one-click cleanup unless every tracked path, package, and skill is expected. Be especially careful with package uninstalls and skill removal, because the script can act directly on tracked entries and skill deletion is permanent.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _npm_package_installed(pkg: str) -> bool:
    """Check if an npm package is installed globally."""
    result = subprocess.run(
        ["npm", "list", "-g", pkg],
        capture_output=True, text=True,
        shell=(platform.system() == "Windows")

• Confidence: 91% confidence
• Finding: This npm subprocess is executed with `shell=True` on Windows while incorporating a package name that can come from a manifest or track file. Even though a list is supplied, enabling shell invocation on Windows increases command-injection risk and allows attacker-controlled package values to influence shell parsing or invoke unexpected behavior in a cleanup utility that may run with broad local privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  ⏭️  SKIP (not installed): {pkg}")
            results["skipped"].append({"package": pkg, "reason": "not installed"})
            continue
        result = subprocess.run(
            ["npm", "uninstall", "-g", pkg],
            capture_output=True, text=True, shell=(platform.system() == "Windows")
        )

• Confidence: 92% confidence
• Finding: This global npm uninstall command runs with `shell=True` on Windows and consumes package names from externally supplied manifests or tracking data. In a cleanup skill, that makes the issue more dangerous because the script is already expected to perform destructive actions, so malicious input can potentially trigger shell-mediated command execution or unauthorized package removal with less scrutiny.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return True, "direct removal (temp path, trash unavailable)"
            return False, f"failed to move to Recycle Bin (exit code {result.returncode})"
        elif system == "Darwin":
            result = subprocess.run(
                ["osascript", "-e",
                 f'tell app "Finder" to delete POSIX file "{str(p)}"'],
                capture_output=True, text=True, timeout=15

• Confidence: 84% confidence
• Finding: The AppleScript command is built by interpolating an untrusted path directly into a quoted script string without escaping embedded quotes or AppleScript metacharacters. A crafted filename containing quotes could break out of the string literal and alter the script sent to `osascript`, making this a plausible command/script injection issue.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: `delete_skills` performs unconditional `shutil.rmtree` on any directory path listed in the manifest or track file, without applying the safety gates used for file deletion. In the context of a cleanup skill, manifests may be agent-generated or user-influenced, so this creates a path-deletion primitive that can erase arbitrary directories, not just disposable skill installations.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring claims skill deletion uses the same logic as `delete_files`, but the implementation skips those safety checks and directly recurses into deletion. This mismatch is dangerous because maintainers or reviewers may rely on the comment and miss that arbitrary directories can be removed outside the intended safety model.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad natural-language phrases like '会话清理', 'clean up session', 'cleanup now', and '帮我清理', which can be invoked accidentally during ordinary conversation. In a destructive skill, overly broad activation materially raises the risk of unintended tracking, deletion, or uninstall flows being started without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The cleanup-phase trigger words are especially risky because they map ambiguous phrases directly to destructive cleanup behavior. A casual user request like 'clean up' or '帮我清理' could cause the agent to enumerate and delete tracked items, making unintended invocation more dangerous in this context than in a read-only skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide contains multiple destructive commands for deleting files, directories, skills, and software, but it does not begin with a prominent warning about irreversible deletion, privilege requirements, verification steps, or the risk of path mistakes. In an agent-executed cleanup context, documentation like this can directly shape unsafe automation behavior and increase the chance of accidental destructive actions.

Static analysis

No suspicious patterns detected.