Security audit

Laundry

Security checks for vulnerabilities and agentic risk

Overview

This is a local laundry/home logging skill with some privacy and export-quality caveats, but no evidence of hidden network access, credential use, persistence abuse, or destructive behavior.

Install only if you are comfortable with laundry and household entries being stored locally under ~/.local/share/laundry and included in exports. Avoid entering sensitive personal details, be careful opening CSV exports in spreadsheet software, and review file permissions on shared machines.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:60
Finding: Unescaped User-Controlled Data in JSON and CSV Exports
Content: View full analysis
> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" ... while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" ``` ### Technical Analysis The export implementation inserts log-derived values directly into JSON and CSV documents without format-specific encoding. For JSON, quotation marks, backslashes, control characters, and embedded newlines in `$name`, `$ts`, or `$val` are not escaped. A crafted value can terminate the intended JSON string and inject additional properties or objects, or make the export syntactically invalid. For CSV, fields containing commas, quotation marks, or newlines are not quoted according to CSV rules. Values beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` also remain unchanged. When such an export is opened in spreadsheet software, the application may interpret the value as a formula rather than plain text. The current entry-writing commands contain an unrelated top-level `local` error, but the vulnerable export remains reachable for existing or manually created log files. The same condition would also become reachable through normal entry creation if that correctness defect is repaired. ### Attack Path 1. An attacker causes a crafted value to be present in a file under `~/.local/share/laundry/`. This could occur through a manually modified or imported log, or through normal entry creation after the top-level `local` defect is corrected. 2. For JSON injection, the value contains JSON metacharacters such as quotes, backslashes, or an object fragment. 3. For CSV injection, the value contains delimiters or begins with a spreadsheet formula pref ...[truncated 1144 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:6
Finding: Local Records and Exports Are Created Without Explicit Restrictive Permissions
Content: View full analysis
> "$DATA_DIR/add.log" echo "[" > "$out" ``` ### Technical Analysis The script does not set a restrictive process umask or explicitly assign permissions to the data directory, log files, history file, and generated exports. Their effective permissions therefore depend on the invoking environment's umask and the permissions of existing parent directories. Under a permissive umask, files containing laundry schedules, inventory, costs, reminders, maintenance details, and activity history may be readable by other local accounts. Export files aggregate the stored records and may expose a larger set of information in a single file. Exploitation is conditional: another account must have local access and sufficient traversal permissions on the parent directories. A restrictive preexisting home-directory configuration may prevent access, but the script itself does not enforce that security boundary. ### Attack Path 1. The user runs the Skill in an environment with a permissive umask or permissive parent-directory permissions. 2. The script creates `~/.local/share/laundry` and its logs or exports without explicitly restrictive modes. 3. The resulting directory or files are accessible to another local account. 4. That account traverses the permitted path and reads individual logs or generated export files. 5. Household activity, schedules, costs, inventory, reminders, or other stored values are disclosed. ### Impact Assessment The impact is limited to local confidentiality. An attacker with an account on the same host may obtain laundry-related records accessibl ...[truncated 284 chars]
Remediation: View remediation
/dev/null || true ``` 4. Create exports atomically using a securely created temporary file inside the protected data directory, set mode `0600`, and rename it into place only after successful generation. 5. Check that `DATA_DIR` is owned by the current user and is not an unexpected symbolic link before writing sensitive records. 6. Document that the records are private local data and add automated tests that run under a permissive umask to confirm the final directory and file modes remain restrictive. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description partially matches the code: the script does provide stats and export in multiple formats, and it can log laundry-related data. However, the declared purpose is narrower than the actual behavior. The code is a broader local laundry/home toolkit with many commands unrelated to simply tracking laundry loads, including inventory, reminders, checklists, costs, maintenance, seasonal notes, tips, search, recent activity, and status. These are substantive user-facing capabilities, not mere implementation details. There are no obvious dangerous hidden behaviors, but the declared description does not accurately represent the full functional scope of the script.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script persistently stores arbitrary user-provided entries under ~/.local/share/laundry and supports exporting them, but it gives no notice about retention, privacy, or sensitivity of logged content. In practice, users may enter schedules, household routines, costs, or other personal notes, creating a local privacy exposure and increasing the chance of unintended disclosure through exports or shared accounts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for tracking laundry loads, viewing usage stats, and exporting reports, but the command surface includes unrelated capabilities such as inventory, checklist, cost, maintain, seasonal, and tips. These commands expand the skill into a general home toolkit rather than a focused laundry logging/reporting tool.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The 'Why Laundry?' section explicitly says 'Works entirely offline — your data never leaves your machine'. Later, the documentation directs users to a remote feedback endpoint, which contradicts the absolute offline claim even if it is not core runtime behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states that it performs automatic history and activity logging, but the short description does not warn users that command activity will be stored locally. This can create privacy and operational risk on shared systems because users may enter sensitive household notes or schedules without realizing they are being retained and searchable.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The inline documentation labels the script as a 'home tool' and the help banner says 'home toolkit', which contradicts the skill's declared identity and purpose as a laundry tracker. This is not merely incomplete documentation; it actively signals a broader intent than the manifest's laundry-specific scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.