T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:3- Finding
Contact Data Is Created Without Enforcing Restrictive Filesystem Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Contact Book
Security checks for vulnerabilities and agentic risk
Overview
This is a local plaintext contact/activity logger with disclosed storage and export behavior, but users should treat stored and exported contact details as unencrypted local files.
Install only if you are comfortable with contact and relationship notes being stored unencrypted under ~/.local/share/contact-book and exported as plaintext. Avoid highly sensitive entries on shared machines, review file permissions, and treat CSV/JSON exports carefully when opening them in other tools.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:65- Finding
Unescaped Contact Values Produce Unsafe JSON and CSV Exports
- Content
View full analysis
> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" ``` ### Technical Analysis The JSON export inserts log-derived values directly between JSON quotation marks without escaping double quotes, backslashes, newlines, or other control characters. A crafted contact value can therefore invalidate the resulting document or inject additional JSON properties or objects. The CSV export concatenates fields with commas without applying RFC 4180 quoting or escaping. Values containing commas, quotation marks, or line breaks can alter the exported row structure. More importantly, contact values beginning with spreadsheet formula markers such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the CSV file is opened in spreadsheet software. Although shell command substitution is not performed by this script, downstream applications may treat the exported content as active syntax. ### Attack Path A representative spreadsheet-formula attack is: 1. An attacker supplies or persuades the user to store a crafted contact value beginning with a formula marker. 2. The value is written to a command log. 3. The user runs `contact-book export csv`. 4. The script copies the value into `export.csv` without quoting or formula neutralization. 5. The user opens the export in spreadsheet software. 6. The spreadsheet interprets the crafted cell as a formula, subject to the spreadsheet application's security settings. A represe ...[truncated 1073 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims a personal contact book with tags, search, and relationship tracking for managing contacts and follow-ups. The code does not implement structured contacts at all: it simply appends free-form text to per-command log files and offers generic search, stats, recent activity, status, and export functions. While there is some overlap with tagging, searching, and planning in a broad sense, the primary behavior is a general-purpose productivity/event logger rather than a contact manager. It also includes several capabilities unrelated to contact management, such as streaks, weekly reviews, reports, and generic exports. Therefore the declared description does not accurately represent the code's actual behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script claims to be a contact book but implements a generic activity logger with commands unrelated to contact management. This deceptive capability mismatch can cause users or higher-level agents to entrust sensitive personal contact data to a tool that does not provide the expected structure, access controls, or privacy properties, increasing the chance of misuse and unintended disclosure.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The add command accepts arbitrary free-form input and appends it directly to a plaintext log, rather than creating validated contact entries. In the context of a contact-book skill, this is dangerous because users may provide names, phone numbers, addresses, and relationship details expecting contact-oriented storage semantics, but the tool merely dumps them into local logs without safeguards or clear boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill handles sensitive personal data such as names, emails, reminders, and relationship notes, yet only mentions that data stays local and is plain text without clearly warning about privacy exposure on shared or compromised machines. Users may reasonably store confidential contact information believing it is safely managed, while unencrypted logs and exports remain readable by other local processes, backups, or anyone with filesystem access.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## Tips - Run any command without arguments to review its recent entries — quick way to check history - Use `contact-book recent` for a cross-command activity timeline - Combine `search` with shell tools: `contact-book search "2025" | grep "plan"` - The `prioritize` command helps surface your most important relationship-building tasks
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The help text markets the utility as a contact book while the commands reveal a generic productivity logger. Misrepresentation is security-relevant here because it can socially engineer users or calling agents into submitting sensitive contact and relationship data under false assumptions about purpose, storage model, and retrieval behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The export function creates additional plaintext or weakly structured copies of all stored history and contact-like data on disk, which expands the attack surface and increases the chance of accidental exposure, backup leakage, or unauthorized local access. Because the skill is presented as handling personal contacts, secondary copies are especially sensitive and should not be created silently.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes searching contact details, which implies lookup over contact records and fields. Instead, the code performs a case-insensitive grep across every .log file in the data directory, including unrelated activity/history logs, so the behavior is broad text search over miscellaneous logs rather than contact search.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill persistently stores user-supplied data that is likely to include personal contact information in plaintext log files under the user's home directory, without any warning or consent prompt. In a contact-book context, that materially raises privacy risk because users are especially likely to enter sensitive third-party data they may not realize is being retained verbatim.
- Content
Static analysis
No suspicious patterns detected.