Ai Code Helper

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:06 AM UTC
• Version: 2.0.2

Overview

This skill is mostly a local logging tool, but it is marketed as an AI code helper and can persist sensitive development text in plaintext.

Review this carefully before installing. Use it only if you want a local plaintext audit log of code-related notes and prompts. Do not paste secrets, tokens, private keys, regulated data, or proprietary source unless you are comfortable with that text being saved under ~/.local/share/ai-code-helper and later searchable or exportable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:6

Finding

Potentially Sensitive Development Data Is Persisted Without Explicit Access Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:6-9
Vulnerability Type: Insecure plaintext storage and insufficient file permission hardening
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${HOME}/.local/share/ai-code-helper"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

User input is also written to category-specific logs throughout the command handlers. For example, scripts/script.sh:146-152 contains:

bash

local input="$*"
local ts=$(date '+%Y-%m-%d %H:%M')
echo "$ts|$input" >> "$DATA_DIR/check.log"
local total=$(wc -l < "$DATA_DIR/check.log")
echo "  [Ai Code Helper] check: $input"
echo "  Saved. Total check entries: $total"
_log "check" "$input"

Technical Analysis

The Skill records user-supplied code review findings, source fragments, generated code, file names, and related development information in plaintext under a predictable directory. It does not establish a restrictive umask, assign mode 0700 to the data directory, or assign mode 0600 to generated log files.

Consequently, the effective permissions depend on the caller's environment. Under a permissive configuration such as umask 022, newly created directories and files may be readable by other local accounts, subject to the permissions of parent directories. The same input is also duplicated in both a category log and history.log, increasing its exposure and retention footprint.

This issue does not independently grant remote access or elevated privileges. Exploitation requires a local account or process that can traverse the affected user's home-directory hierarchy and read the generated files.

Attack Path

1. A user invokes a command such as check, lint, generate, diff, or fix with text containing sensitive source code, internal paths, vulnerability details, tokens, or other confidential information.
2. The scrip ...[truncated 908 chars]

Remediation

View remediation

Remediation Suggestions

• Set a restrictive process mask before creating any storage:

  bash

  umask 077
  

• Create and verify the data directory with owner-only permissions:

  bash

  mkdir -p -m 700 -- "$DATA_DIR"
  chmod 700 -- "$DATA_DIR"
  

• Create log and export files with mode 0600, and reject symbolic links where practical.

• Warn users not to submit credentials, private keys, access tokens, or unnecessary source code.

• Avoid duplicating full user input in history.log; record only metadata when possible.

• Add commands for secure deletion, retention limits, and automatic expiration.

• Document that data is persistently stored in plaintext and identify its exact location.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:59

Finding

Unescaped User-Controlled Data Produces Unsafe JSON and CSV Exports

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:59-85
Vulnerability Type: Improper output encoding and spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

bash

case "$fmt" in
    json)
        echo "[" > "$out"
        local first=1
        for f in "$DATA_DIR"/*.log; do
            [ -f "$f" ] || continue
            local name=$(basename "$f" .log)
            while IFS='|' read -r ts val; do
                [ $first -eq 1 ] && first=0 || echo "," >> "$out"
                printf '  {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out"
            done < "$f"
        done
        echo "" >> "$out"
        echo "]" >> "$out"
        ;;
    csv)
        echo "type,time,value" > "$out"
        for f in "$DATA_DIR"/*.log; do
            [ -f "$f" ] || continue
            local name=$(basename "$f" .log)
            while IFS='|' read -r ts val; do
                echo "$name,$ts,$val" >> "$out"
            done < "$f"
        done
        ;;

Technical Analysis

Values originating from command-line input are inserted directly into JSON strings without escaping quotation marks, backslashes, control characters, or line breaks. A value containing such characters can make export.json syntactically invalid or alter its apparent object structure when consumed by permissive downstream software.

CSV output is likewise assembled through direct comma concatenation. Fields are not quoted according to RFC 4180, so commas, quotation marks, and line breaks can create additional cells or records. In addition, values beginning with spreadsheet formula indicators such as =, +, -, or @ are not neutralized. When the resulting CSV is opened in spreadsheet software, an attacker-controlled value may be interpreted as a formula rather than plain text.

Exploitation depends on attacker-controlled content first being recorde ...[truncated 1343 chars]

Remediation

View remediation

Remediation Suggestions

• Generate JSON through a serializer such as jq rather than string interpolation.
• If implementing JSON encoding locally, correctly escape quotation marks, backslashes, control characters, and embedded line breaks.
• Encode CSV according to RFC 4180: wrap every field in double quotes and replace each embedded double quote with two double quotes.
• For files intended to be opened in spreadsheets, neutralize fields beginning with =, +, -, @, tab, or carriage return, or export to a format that explicitly preserves string types.
• Clearly document whether CSV output is intended for machine processing or spreadsheet use.
• Add tests covering commas, pipes, quotation marks, backslashes, Unicode, multiline values, and formula-leading values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as an AI-powered code review and generation tool, but the documented behavior is primarily persistent logging, search, export, and history management. This mismatch can cause users to disclose sensitive code, prompts, or security findings under the false assumption that the tool is performing transient code assistance rather than storing everything in plaintext.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The branding and help text present the tool as a code-helper/devtools utility, but no code-help behavior exists; it only records and displays inputs. This deceptive framing makes it more likely users will paste proprietary code, credentials, or internal findings, creating a privacy and trust risk in the skill context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims AI-powered code review and related development functions, but the implementation simply stores arbitrary user input to local files. This mismatch is dangerous because users may provide source code, secrets, or sensitive project context under the assumption of analysis, while the tool silently accumulates that data instead of performing the advertised task.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest advertises AI-powered code review, validation, and generation, while the body describes a file-based logging system. This deceptive framing increases the chance that users will input proprietary code or secrets without realizing the primary behavior is retention and local archival.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description omits a clear warning that all command inputs and activity are written to plaintext logs. Users may enter source code, credentials, vulnerability notes, or internal paths believing the tool is ephemeral, creating avoidable disclosure risk on the local system.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs persistent storage and export of user-provided operation data in plaintext. Because the inputs may include arbitrary code, bug reports, or sensitive analysis content, the logging path becomes a natural retention and leak channel even without any remote exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The export capability is described as a convenience feature, but there is no user-facing warning that it serializes accumulated logs into reusable formats such as JSON and CSV. This makes bulk disclosure easier, especially when the logs may contain proprietary code, prompts, or security findings.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Commands with arguments are defined to save the full user input as timestamped entries, enabling long-term retention of arbitrary content. In a code-assistance context, that content may include proprietary source, secrets, exploit details, or internal architecture notes that should not be broadly stored.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Storing all data in plaintext files and supporting later export creates an easily accessible corpus of user-supplied content. Any local compromise, shared account, backup exposure, or accidental file sharing could reveal accumulated sensitive information at scale.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Logging every command execution to a history file creates a comprehensive audit trail of user activity that may reveal project names, filenames, security work, and operational patterns. Even if individual entries seem harmless, the aggregate history can expose sensitive workflows and investigative context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script contains undisclosed data-management features such as export, search, recent, stats, and status that increase the ability to enumerate and retrieve previously stored user inputs. In a skill presented as a coding assistant, these hidden persistence and retrieval capabilities increase the chance of unintentional data exposure and violate user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The export feature aggregates all stored activity into json/csv/txt files without any warning that potentially sensitive history will be collected into a single portable artifact. Consolidating historical prompts and code snippets materially increases exposure if the export file is shared, indexed, backed up, or accessed by another local user/process.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool creates a natural-language data store by persisting all user inputs and then exposing them through display, search, recent, and export commands. In the context of an AI code helper, users are especially likely to submit high-value sensitive text, making this a practical local data leakage mechanism even without network exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-provided inputs are written verbatim to persistent local logs without notice, consent, masking, or retention limits. For a code-assistance skill, this is risky because prompts often contain source code, API keys, tokens, stack traces, or other sensitive natural-language data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Persistent logging, full-text search, statistics, and export materially expand the skill's data-handling scope beyond simple code assistance. Broader data-management features increase the blast radius of any sensitive content entered into the tool and are not clearly justified by the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.