Adr Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward ADR-writing helper that reads repository context and suggests creating documentation, with one shell-command hardening caveat.

This skill appears safe to install for ADR generation. When using it, treat command placeholders such as keywords, package names, and imports as untrusted input: pass them as separate command arguments or quote them safely rather than pasting raw values into a shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Shell Command Injection Through Unsafely Interpolated Placeholders

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38, 42, and 69
Vulnerability Type: Shell command injection
Risk Level: Medium

Vulnerable Code

bash

# Line 38
git log --oneline --all --grep="<keyword>" | head -20

# Line 42
git log -p --all -S '<package-name>' -- package.json | head -40

# Line 69
grep -rc "<framework-import>" --include="*.{ts,js,py,go}" . 2>/dev/null | sort -t: -k2 -rn | head -10

Technical Analysis

The Skill directs an Agent to substitute values derived from a conversation or repository into shell command templates. It does not require validation, shell-safe escaping, or invocation through an API that passes arguments without a shell.

The double-quoted placeholders on lines 38 and 69 remain vulnerable to shell expansions such as command substitution using $(...) or backticks. The single-quoted placeholder on line 42 can become unsafe if an attacker-controlled value contains a single quote that terminates the quoted argument, followed by shell operators and additional commands.

The vulnerability is conditional upon the Agent implementing these placeholders through direct textual interpolation and executing the resulting command through a shell. The file contains no embedded malicious payload, but its documented execution pattern can turn untrusted input into executable shell syntax.

Attack Path

1. An attacker introduces a crafted keyword, package name, or framework import value into the conversation or a repository artifact that the Agent analyzes.
2. The Agent extracts that value while following the Skill's analysis procedure.
3. The Agent substitutes the value directly into one of the documented shell command templates.
4. The resulting command is executed through a shell without robust argument separation or escaping.
5. Shell metacharacters, command substitutions, or broken quoting in the supplied value cause attacker-selected commands to execute.
6. Those commands run wit ...[truncated 1136 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell commands by replacing placeholders in command strings.
2. Invoke programs through an execution API that accepts an executable and an argument array without using a shell. For example, pass the search value as a distinct argument to git or grep.
3. Treat all values obtained from conversations, repository contents, commit messages, dependency metadata, and documentation as untrusted.
4. If shell execution is unavoidable, apply a proven shell-quoting routine appropriate to the exact shell rather than manually adding quotation marks.
5. Reject control characters and unexpected shell metacharacters. Where practical, constrain keywords, package names, and import identifiers to an explicit allowlist of expected characters.
6. Use explicit option termination or pattern operands where supported, such as -- or grep -e, to prevent values beginning with a hyphen from being interpreted as options.
7. Update the Skill instructions to state that placeholders are conceptual and must never be interpolated directly into shell source.
8. Add adversarial tests covering values containing single quotes, double quotes, backticks, $(), semicolons, newlines, pipes, redirection operators, and leading hyphens.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.