Security audit

Launchpad

Security checks for vulnerabilities and agentic risk

Overview

The visible skill looks like a simple blockchain reference tool, but the package also contains a conflicting nested skill that can persistently write, delete, and export local data.

Review this package before installing. The top-level reference tool appears low risk, but the bundled nested skill should be removed or clearly documented unless you intentionally want a local ~/.launchpad datastore with delete/export/config behavior.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: skills/launchpad/scripts/script.sh:10
Finding: Unescaped User Input Corrupts JSONL Records
Content: View full analysis
> "$DATA_DIR/data.jsonl" } ``` ### Technical Analysis The `_save_entry` function inserts attacker-controlled input directly into a JSON object without JSON encoding. Although shell quoting prevents this input from being interpreted as shell syntax, it does not make the value safe for JSON. Quotes, backslashes, control characters, and literal newlines can terminate the intended value or introduce additional records. Subsequent commands parse the file using line-oriented `grep` and `cut` operations rather than a JSON parser, which amplifies the integrity issue. Stored terminal control characters may also be replayed when records are listed or searched. ### Attack Path 1. An attacker or untrusted caller invokes `add` with a value containing JSON delimiters or a newline, for example: ```bash scripts/script.sh add $'first"}\n{"ts":"2099-01-01 00:00:00","cmd":"add","val":"forged' ``` 2. `_save_entry` writes the value verbatim to `data.jsonl`. 3. The injected newline creates an additional apparent JSONL record. 4. `list`, `search`, `stats`, or `export` processes the corrupted data and can display or export fabricated information. ### Impact Assessment The vulnerability permits modification of the logical structure and integrity of the application's local record database. It can produce fabricated entries, misleading counts, malformed exports, or terminal-display manipulation. Exploitation is limited to files writable by the account running the skill. It does not grant additional operating-system privileges and no arbitrary shell-command execution path ...[truncated 19 chars]
Remediation: View remediation
> "$DATA_DIR/data.jsonl" ``` Additional hardening should include: - Parse stored records with a JSON-aware tool such as `jq`. - Reject or sanitize unsafe terminal control characters before displaying records. - Set restrictive permissions on the data directory and file, such as directory mode `0700` and file mode `0600`. - Detect and report malformed existing records rather than silently parsing them with `grep` and `cut`. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: skills/launchpad/scripts/script.sh:75
Finding: Search Term Is Interpreted as a Regular Expression or Command Option
Content: View full analysis
}" if [ -f "$DATA_DIR/data.jsonl" ]; then local matches=$(grep -ic "$term" "$DATA_DIR/data.jsonl" 2>/dev/null || echo 0) echo "Found: $matches matches" grep -i "$term" "$DATA_DIR/data.jsonl" 2>/dev/null | head -20 | while IFS= read -r line; do local val=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) local ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) echo " [$ts] $val" done ``` ### Technical Analysis The user-controlled search term is passed to `grep` without the `--` end-of-options marker and without fixed-string mode. Consequently: - A term beginning with `-` can be interpreted as a `grep` option. - Regular-expression metacharacters alter the search semantics. - A sufficiently expensive regular expression against a large local data file may consume excessive processing time. - Invalid options or expressions may cause errors and misleading output. This is not shell-command injection because the variable is quoted. The issue is argument and regular-expression interpretation by `grep`. ### Attack Path 1. Populate `data.jsonl` with enough content to make searches meaningful. 2. Invoke the search command with a term beginning with `-` or containing an expensive regular expression. 3. `grep` interprets that value as an option or expression rather than a literal search term. 4. The command returns incorrect results, fails, or consumes unnecessary resources. For example, a value such as `-v` is treated as an option by implementations that continue option parsing after preceding options. ### Impact Assessment An attacker able to control search arguments can d ...[truncated 301 chars]
Remediation: View remediation
/dev/null || true) grep -iF -- "$term" "$DATA_DIR/data.jsonl" 2>/dev/null ``` Additional improvements include: - Validate the maximum length of the search term. - If regular-expression search is an intentional feature, provide it through a separate command and validate the expression before use. - Avoid `|| echo 0` where `grep` returning no matches could produce ambiguous output; explicitly distinguish no-match status from operational errors. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: skills/launchpad/scripts/script.sh:139
Finding: Configuration Keys and Values Are Embedded Unsafely in Regex and Sed Expressions
Content: View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis Both `key` and `val` originate from command-line arguments and are embedded directly into regular expressions and a generated `sed` program. A crafted key can contain regex metacharacters such as `.`, `*`, `[`, `]`, `^`, or `$`, causing `grep` and `sed` to match configuration entries other than the intended key. A key or value containing the `|` delimiter can terminate parts of the substitution expression. In the replacement portion, `&` expands to the entire matched text, allowing unintended content duplication. Shell quoting prevents direct shell expansion of embedded command substitutions, so this is not demonstrated arbitrary shell-command execution. It nevertheless permits unintended modification or corruption of the local configuration file. ### Attack Path 1. Ensure `config.txt` contains one or more existing entries. 2. Invoke `config` with a key containing regular-expression syntax that matches an unintended entry. 3. Supply a value containing sed replacement metacharacters such as `&`, or the selected `|` delimiter. 4. The `grep` test identifies an ...[truncated 581 chars]
Remediation: View remediation
&2 return 1 fi ``` Avoid generating a `sed` program from untrusted values. A safer approach is to rewrite the configuration file using exact string comparisons: ```bash tmp=$(mktemp "$DATA_DIR/config.XXXXXX") awk -F= -v key="$key" -v value="$val" ' BEGIN { updated = 0 } $1 == key { print key "=" value; updated = 1; next } { print } END { if (!updated) print key "=" value } ' "$cfg" > "$tmp" chmod 600 "$tmp" mv -- "$tmp" "$cfg" ``` Also: - Validate or encode newlines and control characters in values. - Use secure temporary files in the same directory to preserve atomic replacement. - Apply restrictive file permissions. - Use fixed-string comparison when retrieving a key instead of interpolating it into a regex. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: skills/launchpad/scripts/script.sh:109
Finding: CSV Export Allows Spreadsheet Formula Injection
Content: View full analysis
"$out" while IFS= read -r line; do ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo "$ts,$c2,$vl" >> "$out" done < "$DATA_DIR/data.jsonl" ;; *) echo "Formats: json, csv"; return 1 ;; esac ``` ### Technical Analysis The export function writes attacker-controlled record values directly into CSV rows. It neither quotes fields according to CSV rules nor neutralizes spreadsheet formula prefixes. Values beginning with `=`, `+`, `-`, or `@` may be interpreted as formulas when the exported file is opened in spreadsheet software. Depending on the spreadsheet application and its security settings, formulas can create external links, trigger network requests, expose information through remote resources, or deceive the user. Commas, quotes, and newlines also break the intended column and row structure, allowing an attacker to place content into additional cells. ### Attack Path 1. Add an entry whose value begins with a spreadsheet formula, for example: ```bash scripts/script.sh add '=HYPERLINK("https://attacker.example/","Open report")' ``` 2. Export the records: ```bash scripts/script.sh export csv ``` 3. The formula is written directly into `launchpad-export.csv`. 4. A user opens the file in formula-capable spreadsheet software. 5. The application interprets the cell as a formula, subject to its security controls. ### Impact Assessment Successful exploitation requires a victim to open the generated CSV in spreadsheet ...[truncated 405 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as a blockchain/crypto reference and conceptual lookup tool. The supplied code does not provide blockchain formulas, regulations, protocol analysis, on-chain lookups, or domain-specific reference functionality. Instead, it implements a generic local data manager that saves arbitrary entries to ~/.launchpad/data.jsonl, supports listing/searching/removing them, exports them to files, and reads/writes config values. This is a materially different primary purpose and includes undeclared persistent file storage and data-management capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest claims launchpad and protocol security analysis, but the full documented interface contains only generic entry-management commands such as add, remove, export, and config. In an agent setting, this kind of capability-description mismatch is dangerous because tool selection may rely on metadata; an agent could route sensitive tasks to a skill that does something materially different from what it advertises.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as a blockchain launchpad analysis/reference tool, but the documented commands expose only generic CRUD-style data management operations. This mismatch can mislead users and higher-level agents into invoking the skill under false assumptions, creating a deceptive interface that can mask unrelated or unsafe behavior and increase the risk of unintended execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script presents itself as a blockchain/crypto analysis and protocol-security reference tool, but its actual behavior is a generic local note/config datastore. This mismatch is dangerous because users and higher-level agents may grant it trust, invoke it in sensitive contexts, or rely on outputs under false assumptions about its capabilities, creating a deception/trust-boundary issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline documentation explicitly claims the tool can analyze launchpad operations and evaluate protocol security, yet the code only supports add/list/search/remove/export/config operations over a local file. In an agent ecosystem, misleading self-description can cause unsafe delegation and incorrect operator trust, especially if the tool is selected for security analysis tasks it cannot perform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation includes destructive or file-writing operations like remove, export, and config changes without warning about persistence, overwrite behavior, reversibility, or confirmation requirements. Even if the underlying tool is simple, omission of these safeguards in a skill intended for agent use can lead to accidental data loss or unsafe file writes when commands are invoked automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The config command updates or appends to $DATA_DIR/config.txt, which is a persistent file write affecting user data. While the command echoes the resulting key/value after writing, there is no prior warning in comments, docstrings, or help text that this command modifies on-disk configuration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.