wreckit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:01 PM UTC
• Version: 2.3.1

Overview

This is a plausible code-verification skill, but it asks for overly broad execution permissions and ships helpers with unsafe command and dashboard behavior.

Install only if you are comfortable running repository tooling with strong isolation. Do not follow the sandbox-bypass or inherit-all environment guidance for untrusted projects; prefer a disposable container or VM, remove secrets from the environment, avoid automatic npx downloads, and treat the dashboard as local-sensitive until its rendering and CORS handling are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:163
• Finding: Skill Instructions Recommend Disabling Sandbox and Inheriting the Entire Host Environment<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:163-166` **Vulnerability Type**: Least-privilege boundary bypass **Risk Level**: High ### Vulnerable Code ```markdown - `--full-auto` sandbox blocks `npm install` network access (ENOTFOUND registry.npmjs.org) - Fix: use `--dangerously-bypass-approvals-and-sandbox` flag instead - Auth: `echo "$OPENAI_API_KEY" | codex login --with-api-key` stores credentials to `~/.codex/auth.json` - Config: `~/.codex/config.toml` with `model = "gpt-5.2-codex"` and `[shell_environment_policy] inherit = "all"` ``` ### Technical Analysis The Skill explicitly recommends disabling approval and sandbox controls when network access is unavailable. It also recommends configuring subprocesses to inherit the complete parent environment. Code verification commonly executes repository-controlled test scripts, package lifecycle hooks, compilers, and analysis tools. Running these components outside the sandbox while exposing all environment variables materially expands their privileges. The audited repository or a downloaded dependency could access API keys, authentication files, source repositories, SSH material, and other user-readable host data. The Skill only needs scoped access to the target project and explicitly approved analysis tools. Disabling the sandbox and inheriting all environment variables exceed those minimum requirements. ### Attack Path 1. A user asks the Skill to audit an untrusted or compromised repository. 2. The agent follows the instructions in `SKILL.md`. 3. The agent starts Codex with `--dangerously-bypass-approvals-and-sandbox`. 4. The environment policy exposes all parent environment variables. 5. A repository-controlled test, build script, or package lifecycle hook executes during verification. 6. That code reads inherited secrets or modifies files outside the audited project without sandbox restrictions. ### Impact Assessment Successful exploitation can provide the repository-controlled pr ...[truncated 377 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the recommendation to use `--dangerously-bypass-approvals-and-sandbox`. - Keep sandbox and approval controls enabled during all audits. - Use an explicit allowlist for network destinations and executable tools. - Pass only the environment variables required by a specific command instead of using `inherit = "all"`. - Redact or unset `OPENAI_API_KEY`, cloud credentials, SSH agent variables, and other secrets before executing project-controlled commands. - Run tests and package tools in an isolated container or disposable workspace with read-only mounts where practical. - Require explicit, informed user approval before any operation that installs packages or executes repository-controlled hooks. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: assets/dashboard/index.html:337
• Finding: Stored DOM Cross-Site Scripting in the Local Dashboard<![CDATA[ ## Vulnerability Details **File Location**: `assets/dashboard/index.html:337-423` **Vulnerability Type**: Stored DOM XSS through unescaped dashboard fields **Risk Level**: High ### Vulnerable Code ```javascript function renderGate(gate) { return ` <div class="gate"> <div class="gate-icon gate-${gate.status}">${GATE_ICONS[gate.status]}</div> <span class="gate-name">${gate.name}</span> <span class="gate-detail">${gate.detail || ''}</span> <span class="gate-time">${gate.duration || ''}</span> </div> `; } function renderFindings(findings) { if (!findings || !findings.length) return ''; return findings.map(f => ` <div class="finding"> <span class="finding-sev sev-${f.severity}">${f.severity}</span> <span>${f.message}</span> </div> `).join(''); } ``` The generated markup is ultimately assigned to `innerHTML`: ```javascript function render(runs) { const grid = document.getElementById('grid'); if (!runs.length) { grid.innerHTML = ` <div class="empty-state" style="grid-column: 1/-1"> <h2>🔨 No runs yet</h2> <p>Start a wreckit audit to see results here</p> </div> `; return; } const order = { undefined: 0, running: 0, blocked: 1, caution: 2, ship: 3 }; runs.sort((a, b) => (order[a.decision] ?? 0) - (order[b.decision] ?? 0)); grid.innerHTML = runs.map(renderCard).join(''); renderStats(runs); document.getElementById('last-refresh').textContent = new Date().toLocaleTimeString(); } ``` `renderCard` also directly interpolates fields such as `run.repo`, `run.mode`, `run.language`, `run.framework`, `run.branch`, gate data, and finding messages. ### Technical Analysis The dashboard server reads `.wreckit/dashboard.json` from watched project directories and returns the parsed objects without schema validation or output encoding. The browser then interpolates object fields into HTML strings and assigns those strings to `innerHTML`. An attacker-c ...[truncated 1491 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace HTML string construction with DOM APIs and assign all untrusted values through `textContent`. - If HTML templating must remain, apply context-appropriate escaping to every externally derived field. - Validate `/api/status` objects against a strict schema and reject unexpected fields or incorrect types. - Restrict status values to enumerated values before using them in class names. - Add a restrictive Content Security Policy, including a prohibition on inline scripts and inline event handlers. - Add regression tests using payloads in `repo`, `branch`, `gate.name`, `gate.detail`, and `findings[].message`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/dashboard/server.mjs:83
• Finding: Wildcard CORS Exposes Local Audit Results to Arbitrary Websites<![CDATA[ ## Vulnerability Details **File Location**: `assets/dashboard/server.mjs:83-93` **Vulnerability Type**: Cross-origin disclosure from a loopback service **Risk Level**: Medium ### Vulnerable Code ```javascript const server = createServer(async (req, res) => { const url = new URL(req.url, `http://localhost:${PORT}`); // CORS res.setHeader('Access-Control-Allow-Origin', '*'); if (url.pathname === '/api/status') { const status = await getStatus(); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(status)); return; } ``` ### Technical Analysis Binding the service to `127.0.0.1` prevents direct remote TCP access, but it does not prevent a website loaded in the user's browser from sending requests to the loopback address. The wildcard `Access-Control-Allow-Origin` response permits JavaScript from any web origin to read the API response. The client-side `fetch(DATA_PATH)` identified by the pre-scan is same-origin and is necessary for dashboard operation. The security issue is the server's wildcard CORS policy, not that same-origin fetch itself. The current proof-bundle generator emits limited status metadata, but the server accepts arbitrary dashboard JSON from watched projects. Future or manually generated files may contain repository names, branch names, finding details, paths, or other sensitive audit information. ### Attack Path 1. The user runs the dashboard server on port 3939. 2. The user visits an attacker-controlled website. 3. The website sends a browser request to `http://127.0.0.1:3939/api/status`. 4. The local server returns `Access-Control-Allow-Origin: *`. 5. The browser permits the attacker page to read the response. 6. The page transmits the local audit metadata to the attacker's server. ### Impact Assessment An arbitrary website can read the local dashboard's aggregated audit data while the service is running. The exposed scope includes all fields returned from every wat ...[truncated 172 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the CORS header because the dashboard UI and API are served from the same origin. - If cross-origin access is required, use an exact allowlist rather than `*`. - Reject requests containing unexpected `Origin` headers. - Validate the `Host` header to reduce DNS rebinding exposure. - Consider requiring an unpredictable session token for access to the local API. - Return only the minimum fields needed by the dashboard and avoid exposing absolute paths, source text, secrets, or raw logs. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/design-review.sh:92
• Finding: Unpinned Package Is Automatically Downloaded and Executed During Audits<![CDATA[ ## Vulnerability Details **File Location**: `scripts/design-review.sh:92-100` **Vulnerability Type**: Unsafe mutable dependency execution **Risk Level**: High ### Vulnerable Code ```bash if [ "$LANGUAGE" = "ts" ] && command -v npx >/dev/null 2>&1; then echo "Attempting madge analysis..." >&2 if MADGE_OUTPUT=$(npx --yes madge --circular --json . 2>/dev/null); then USED_MADGE=true echo "madge succeeded" >&2 else echo "madge failed or not available, using manual scan" >&2 fi fi ``` ### Technical Analysis `npx --yes madge` can retrieve and execute a package from the configured npm registry when no suitable local executable exists. The command does not specify an exact version, require a lockfile-resolved local package, or verify package integrity. Consequently, the code executed by an audit can change after the Skill itself has been reviewed. A compromised package release, registry configuration, or similarly named package resolution could execute attacker-controlled code under the auditor's account. The risk is unnecessary because the script already contains a manual dependency-graph fallback. ### Attack Path 1. The user audits a TypeScript project on a system with `npx`. 2. The project does not have a trusted local `madge` executable. 3. `npx --yes madge` resolves the package using the active npm configuration. 4. `npx` downloads and executes the resolved package without a separate approval prompt. 5. A compromised or malicious package executes with the audit process's filesystem and environment access. 6. If the Skill's sandbox-bypass guidance is also followed, the package has unrestricted user-level host access. ### Impact Assessment A malicious dependency can execute arbitrary code with the privileges of the user running the audit. Potential scope includes project modification, credential access, network communication, and modification of other user-writable files. The issue does not inherently grant root privileges, bu ...[truncated 109 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `npx --yes madge` with `npx --no-install madge`. - Require `madge` to be a lockfile-pinned development dependency of the Skill or audited project. - Pin an exact reviewed version and verify package integrity through the lockfile. - Do not install or download dependencies automatically during an audit. - Prefer the existing manual analysis fallback when the trusted local tool is unavailable. - Execute third-party analyzers in a restricted environment with secrets removed and network access disabled. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mutation-test.sh:9
• Finding: Caller-Controlled Test Command Is Executed Through Shell Eval<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mutation-test.sh:9-53` and `scripts/mutation-test.sh:198` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash # Usage: ./mutation-test.sh [project-path] [test-command] set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" PROJECT="${1:-.}" TEST_CMD="${2:-}" PROJECT="$(cd "$PROJECT" && pwd)" cd "$PROJECT" ``` The caller-supplied value is evaluated as shell syntax: ```bash echo "Test command: $TEST_CMD" >&2 echo "Verifying baseline tests pass..." >&2 if ! eval "$TEST_CMD" >/dev/null 2>&1; then echo '{"error":"Baseline tests fail. Fix tests before mutation testing."}' exit 1 fi ``` It is evaluated again for each generated mutation: ```bash if eval "$TEST_CMD" >/dev/null 2>&1; then SURVIVED=$((SURVIVED + 1)) echo " SURVIVED: ${file}:${LINENUM}" >> "$RESULTS_FILE" else KILLED=$((KILLED + 1)) echo " KILLED: ${file}:${LINENUM}" >> "$RESULTS_FILE" fi ``` ### Technical Analysis The second positional argument is documented as a caller-provided test command. `eval` reparses the entire value as shell source, so command substitutions, redirects, pipelines, semicolons, and other shell operators are executed rather than treated as arguments. Although executing a selected test runner is part of mutation testing, interpreting arbitrary input as unrestricted shell code is not required. The repeated invocation inside the mutation loop can also execute an injected payload multiple times. Other helpers observed during the audit also use `eval` for command strings, including behavior capture, regression, and type-check logic. The confirmed directly caller-controlled path above is sufficient to establish the vulnerability. ### Attack Path 1. An attacker or untrusted automation influences the second argument to `mutation-test.sh`. 2. The argument contains a legitimate-looking test command followed by shell syntax that executes ...[truncated 697 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove every use of `eval` for test, type-check, and regression commands. - Accept the executable and arguments as an array rather than a single shell command string. - Where possible, map detected test runners to fixed argument arrays, such as `("npx" "--no-install" "vitest" "run")`. - If configurable commands are necessary, use a structured configuration format containing separate executable and argument fields. - Reject shell metacharacters rather than attempting to quote an arbitrary command string. - Remove sensitive environment variables before invoking repository-controlled tests. - Add security tests that pass semicolons, command substitutions, redirects, and pipelines as command arguments and verify that they are never interpreted by a shell. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/telemetry.sh:16
• Finding: Predictable Shared Temporary Files Permit Local Symlink Clobbering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/telemetry.sh:16-42`; additional instances at `scripts/mutation-test.sh:189-216` **Vulnerability Type**: Insecure temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash output=$(("$@") 2>/tmp/wreckit-gate-stderr-$$ || true) exit_code=$? if echo "$output" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status','UNKNOWN'))" >/tmp/wreckit-status-$$ 2>/dev/null; then valid_json="true" status=$(cat /tmp/wreckit-status-$$) fi stderr_content=$(cat /tmp/wreckit-gate-stderr-$$ 2>/dev/null | head -5 | tr '\n' ' ' | tr '"' "'") rm -f /tmp/wreckit-gate-stderr-$$ /tmp/wreckit-status-$$ ``` The mutation helper follows the same predictable PID-based pattern: ```bash cp "$file" "/tmp/wreckit-backup-$$" awk -v ln="$LINENUM" -v rep="$MUTATED" \ 'NR==ln{print rep;next}{print}' "$file" > "/tmp/wreckit-mutated-$$" cp "/tmp/wreckit-mutated-$$" "$file" cp "/tmp/wreckit-backup-$$" "$file" rm -f "/tmp/wreckit-backup-$$" "/tmp/wreckit-mutated-$$" ``` ### Technical Analysis Process IDs are predictable, and `/tmp` is generally shared among local users. These files are opened or overwritten without exclusive creation and without first creating a private directory. A local attacker can pre-create a symbolic link at a predicted path and point it at another file writable by the audit user. Shell redirection to `/tmp/wreckit-gate-stderr-$$` follows symbolic links. Copy operations involving the mutation backup and mutation output can also interact unsafely with attacker-prepared paths. Cleanup only removes the predictable pathname and does not prevent the earlier overwrite. ### Attack Path 1. A local attacker observes or predicts the process ID of an upcoming audit process. 2. The attacker creates a symbolic link such as `/tmp/wreckit-gate-stderr-<pid>` pointing to a file writable by the victim. 3. The victim starts the audit. 4. The telemetry redirection follows the symbol ...[truncated 536 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create one private temporary directory with `mktemp -d`. - Set `umask 077` before creating temporary files. - Store every temporary file below the private directory. - Register an `EXIT`, `INT`, and `TERM` trap to remove the directory safely. - Avoid PID-derived names in shared directories. - For mutation testing, store backups inside the private directory while preserving a unique path for every source file. - Add interruption handling that restores the currently mutated source file before exiting. - Use exclusive file creation where a standalone temporary file is unavoidable. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (116)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A slop/static scan alone does not justify the broad build/migration/bug-fix verification claims in the description. Users may incorrectly infer that multiple independent quality controls ran when only superficial scanning occurred.

Ae1

High

• Category: analysis-evasion

Content

- `scripts/differential-test.sh [path]` — oracle comparison, golden tests (BUILD/REBUILD) → JSON

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- `scripts/differential-test.sh [path]` — oracle comparison, golden tests (BUILD/REBUILD) → JSON

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instructions recommend bypassing sandboxing and approvals without a prominent safety warning or narrow justification. In a skill that executes project tooling and networked package operations, that materially raises the risk of unsafe command execution, unintended filesystem access, and supply-chain exposure.