T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:163- Finding
Skill Instructions Recommend Disabling Sandbox and Inheriting the Entire Host Environment
- Content
View full analysis
- Remediation
View remediation
Security audit
wreckit
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible code-verification skill, but it asks for overly broad execution permissions and ships helpers with unsafe command and dashboard behavior.
Install only if you are comfortable running repository tooling with strong isolation. Do not follow the sandbox-bypass or inherit-all environment guidance for untrusted projects; prefer a disposable container or VM, remove secrets from the environment, avoid automatic npx downloads, and treat the dashboard as local-sensitive until its rendering and CORS handling are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
assets/dashboard/index.html:337- Finding
Stored DOM Cross-Site Scripting in the Local Dashboard
- Content
View full analysis
${GATE_ICONS[gate.status]}${gate.name} ${gate.detail || ''} ${gate.duration || ''} `; } function renderFindings(findings) { if (!findings || !findings.length) return ''; return findings.map(f => `${f.severity} ${f.message}`).join(''); } ``` The generated markup is ultimately assigned to `innerHTML`: ```javascript function render(runs) { const grid = document.getElementById('grid'); if (!runs.length) { grid.innerHTML = ``; return; } const order = { undefined: 0, running: 0, blocked: 1, caution: 2, ship: 3 }; runs.sort((a, b) => (order[a.decision] ?? 0) - (order[b.decision] ?? 0)); grid.innerHTML = runs.map(renderCard).join(''); renderStats(runs); document.getElementById('last-refresh').textContent = new Date().toLocaleTimeString(); } ``` `renderCard` also directly interpolates fields such as `run.repo`, `run.mode`, `run.language`, `run.framework`, `run.branch`, gate data, and finding messages. ### Technical Analysis The dashboard server reads `.wreckit/dashboard.json` from watched project directories and returns the parsed objects without schema validation or output encoding. The browser then interpolates object fields into HTML strings and assigns those strings to `innerHTML`. An attacker-c ...[truncated 1491 chars]🔨 No runs yet
Start a wreckit audit to see results here
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/dashboard/server.mjs:83- Finding
Wildcard CORS Exposes Local Audit Results to Arbitrary Websites
- Content
View full analysis
{ const url = new URL(req.url, `http://localhost:${PORT}`); // CORS res.setHeader('Access-Control-Allow-Origin', '*'); if (url.pathname === '/api/status') { const status = await getStatus(); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(status)); return; } ``` ### Technical Analysis Binding the service to `127.0.0.1` prevents direct remote TCP access, but it does not prevent a website loaded in the user's browser from sending requests to the loopback address. The wildcard `Access-Control-Allow-Origin` response permits JavaScript from any web origin to read the API response. The client-side `fetch(DATA_PATH)` identified by the pre-scan is same-origin and is necessary for dashboard operation. The security issue is the server's wildcard CORS policy, not that same-origin fetch itself. The current proof-bundle generator emits limited status metadata, but the server accepts arbitrary dashboard JSON from watched projects. Future or manually generated files may contain repository names, branch names, finding details, paths, or other sensitive audit information. ### Attack Path 1. The user runs the dashboard server on port 3939. 2. The user visits an attacker-controlled website. 3. The website sends a browser request to `http://127.0.0.1:3939/api/status`. 4. The local server returns `Access-Control-Allow-Origin: *`. 5. The browser permits the attacker page to read the response. 6. The page transmits the local audit metadata to the attacker's server. ### Impact Assessment An arbitrary website can read the local dashboard's aggregated audit data while the service is running. The exposed scope includes all fields returned from every wat ...[truncated 172 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/design-review.sh:92- Finding
Unpinned Package Is Automatically Downloaded and Executed During Audits
- Content
View full analysis
/dev/null 2>&1; then echo "Attempting madge analysis..." >&2 if MADGE_OUTPUT=$(npx --yes madge --circular --json . 2>/dev/null); then USED_MADGE=true echo "madge succeeded" >&2 else echo "madge failed or not available, using manual scan" >&2 fi fi ``` ### Technical Analysis `npx --yes madge` can retrieve and execute a package from the configured npm registry when no suitable local executable exists. The command does not specify an exact version, require a lockfile-resolved local package, or verify package integrity. Consequently, the code executed by an audit can change after the Skill itself has been reviewed. A compromised package release, registry configuration, or similarly named package resolution could execute attacker-controlled code under the auditor's account. The risk is unnecessary because the script already contains a manual dependency-graph fallback. ### Attack Path 1. The user audits a TypeScript project on a system with `npx`. 2. The project does not have a trusted local `madge` executable. 3. `npx --yes madge` resolves the package using the active npm configuration. 4. `npx` downloads and executes the resolved package without a separate approval prompt. 5. A compromised or malicious package executes with the audit process's filesystem and environment access. 6. If the Skill's sandbox-bypass guidance is also followed, the package has unrestricted user-level host access. ### Impact Assessment A malicious dependency can execute arbitrary code with the privileges of the user running the audit. Potential scope includes project modification, credential access, network communication, and modification of other user-writable files. The issue does not inherently grant root privileges, bu ...[truncated 109 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mutation-test.sh:9- Finding
Caller-Controlled Test Command Is Executed Through Shell Eval
- Content
View full analysis
&2 echo "Verifying baseline tests pass..." >&2 if ! eval "$TEST_CMD" >/dev/null 2>&1; then echo '{"error":"Baseline tests fail. Fix tests before mutation testing."}' exit 1 fi ``` It is evaluated again for each generated mutation: ```bash if eval "$TEST_CMD" >/dev/null 2>&1; then SURVIVED=$((SURVIVED + 1)) echo " SURVIVED: ${file}:${LINENUM}" >> "$RESULTS_FILE" else KILLED=$((KILLED + 1)) echo " KILLED: ${file}:${LINENUM}" >> "$RESULTS_FILE" fi ``` ### Technical Analysis The second positional argument is documented as a caller-provided test command. `eval` reparses the entire value as shell source, so command substitutions, redirects, pipelines, semicolons, and other shell operators are executed rather than treated as arguments. Although executing a selected test runner is part of mutation testing, interpreting arbitrary input as unrestricted shell code is not required. The repeated invocation inside the mutation loop can also execute an injected payload multiple times. Other helpers observed during the audit also use `eval` for command strings, including behavior capture, regression, and type-check logic. The confirmed directly caller-controlled path above is sufficient to establish the vulnerability. ### Attack Path 1. An attacker or untrusted automation influences the second argument to `mutation-test.sh`. 2. The argument contains a legitimate-looking test command followed by shell syntax that executes ...[truncated 697 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/telemetry.sh:16- Finding
Predictable Shared Temporary Files Permit Local Symlink Clobbering
- Content
View full analysis
/tmp/wreckit-gate-stderr-$$ || true) exit_code=$? if echo "$output" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status','UNKNOWN'))" >/tmp/wreckit-status-$$ 2>/dev/null; then valid_json="true" status=$(cat /tmp/wreckit-status-$$) fi stderr_content=$(cat /tmp/wreckit-gate-stderr-$$ 2>/dev/null | head -5 | tr '\n' ' ' | tr '"' "'") rm -f /tmp/wreckit-gate-stderr-$$ /tmp/wreckit-status-$$ ``` The mutation helper follows the same predictable PID-based pattern: ```bash cp "$file" "/tmp/wreckit-backup-$$" awk -v ln="$LINENUM" -v rep="$MUTATED" \ 'NR==ln{print rep;next}{print}' "$file" > "/tmp/wreckit-mutated-$$" cp "/tmp/wreckit-mutated-$$" "$file" cp "/tmp/wreckit-backup-$$" "$file" rm -f "/tmp/wreckit-backup-$$" "/tmp/wreckit-mutated-$$" ``` ### Technical Analysis Process IDs are predictable, and `/tmp` is generally shared among local users. These files are opened or overwritten without exclusive creation and without first creating a private directory. A local attacker can pre-create a symbolic link at a predicted path and point it at another file writable by the audit user. Shell redirection to `/tmp/wreckit-gate-stderr-$$` follows symbolic links. Copy operations involving the mutation backup and mutation output can also interact unsafely with attacker-prepared paths. Cleanup only removes the predictable pathname and does not prevent the earlier overwrite. ### Attack Path 1. A local attacker observes or predicts the process ID of an upcoming audit process. 2. The attacker creates a symbolic link such as `/tmp/wreckit-gate-stderr-` pointing to a file writable by the victim. 3. The victim starts the audit. 4. The telemetry redirection follows the symbol ...[truncated 536 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (116)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/differential-test.sh [path]` — oracle comparison, golden tests (BUILD/REBUILD) → JSON
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/differential-test.sh [path]` — oracle comparison, golden tests (BUILD/REBUILD) → JSON
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions recommend bypassing sandboxing and approvals without a prominent safety warning or narrow justification. In a skill that executes project tooling and networked package operations, that materially raises the risk of unsafe command execution, unintended filesystem access, and supply-chain exposure.
- Content