Mileage

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:38 AM UTC
• Version: 2.0.1

Overview

The skill is advertised as vehicle mileage tracking but actually stores, searches, and exports broad personal home-management notes under that label.

Review this before installing if you expected a mileage-only tool. It can retain broad personal notes locally, search and export them, and does not document a cleanup or retention workflow. Avoid storing sensitive travel, schedule, cost, or household information unless you are comfortable managing the files yourself under ~/.local/share/mileage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:6

Finding

Personal Mileage Data Is Created Without Restrictive Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 6–8
Vulnerability Type: Insecure local data permissions
Risk Level: Medium

bash

DATA_DIR="${HOME}/.local/share/mileage"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Technical Analysis

The script creates its data directory and log files without setting a restrictive umask or explicitly applying secure permission modes. Their effective permissions therefore depend on the invoking user's environment.

With a common umask of 022, the directory can be created with mode 0755 and files with mode 0644. This may allow other local users to traverse the directory and read mileage records, travel history, schedules, maintenance information, costs, and generated exports.

The same permission issue affects files subsequently created through shell redirection in the data directory. Existing files are not checked or hardened when the application starts.

Attack Path

1. A victim runs the Skill and records mileage, schedules, costs, maintenance details, or other travel information.
2. The script creates ~/.local/share/mileage and its files using the victim's default umask.
3. On a multi-user system with permissive resulting modes, another local account traverses the victim's home and application data directories.
4. The local account reads history.log, command-specific logs, or generated export files.
5. The exposed data is used to infer travel patterns, vehicle usage, expenses, or scheduled activity.

Exploitation requires local access and sufficient traversal permission on the parent directories.

Impact Assessment

This issue does not grant elevated privileges or code execution. Its primary impact is unauthorized disclosure of application data to other local users. The scope is limited to records and exports stored in the Mileage data directory, but those records may ...[truncated 62 chars]

Remediation

View remediation

Remediation Suggestions

• Set a restrictive process mask before creating any application data:

  bash

  umask 077
  DATA_DIR="${HOME}/.local/share/mileage"
  mkdir -p -- "$DATA_DIR"
  chmod 700 -- "$DATA_DIR"
  

• Create all logs and exports with mode 0600.

• Harden existing installations by checking and correcting the modes of the data directory and files during startup.

• Reject a data directory that is a symbolic link or is owned by another user.

• Consider using atomic file creation and replacement when generating exports.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:75

Finding

CSV Export Allows Spreadsheet Formula Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 75–80
Vulnerability Type: CSV formula injection and invalid CSV encoding
Risk Level: Medium

bash

csv)
    echo "type,time,value" > "$out"
    for f in "$DATA_DIR"/*.log; do
        [ -f "$f" ] || continue
        local name=$(basename "$f" .log)
        while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f"
    done
    ;;

Technical Analysis

The val field originates from user-supplied entry text and is written directly to CSV. The implementation neither applies RFC 4180 field quoting nor neutralizes values beginning with spreadsheet formula indicators such as =, +, -, or @.

Consequently, spreadsheet software may interpret a crafted value as a formula rather than inert text. Commas, quotes, and line breaks in an entry can also alter the CSV structure and place attacker-controlled content into additional rows or columns.

Depending on the spreadsheet application and its security configuration, malicious formulas can trigger external network requests, expose spreadsheet data, or invoke dangerous legacy functionality. Exploitation occurs in the spreadsheet application rather than directly in the Bash process.

Attack Path

1. An attacker causes the victim to record attacker-controlled text, or supplies an entry that the victim imports manually, such as a value beginning with a spreadsheet formula marker.
2. The entry is stored in one of the local log files.
3. The victim runs mileage export csv.
4. The script copies the entry into export.csv without safe quoting or formula neutralization.
5. The victim opens the exported file in spreadsheet software.
6. The spreadsheet interprets the crafted cell as a formula and performs behavior allowed by that application's formula engine and security policy.

Impact Assessment

The Skill itself gains no additional system privileges. The pote ...[truncated 337 chars]

Remediation

View remediation

Remediation Suggestions

• Encode every CSV field according to RFC 4180:
  • Enclose fields in double quotes.
  • Replace each embedded double quote with two double quotes.
  • Preserve commas and line breaks only inside quoted fields.
• Treat user-controlled cells beginning with =, +, -, @, tab, or carriage return as potentially formula-bearing.
• Neutralize formula-like values using a strategy compatible with the target spreadsheet application, such as prefixing them with an apostrophe while preserving the original value separately where fidelity is required.
• Implement CSV generation with a dedicated serializer rather than shell string concatenation.
• Add tests covering formulas, commas, quotes, newlines, Unicode text, and empty fields.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/script.sh:59

Finding

JSON Export Fails to Escape User-Controlled Data

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 59–69
Vulnerability Type: Improper JSON serialization
Risk Level: Low

bash

json)
    echo "[" > "$out"
    local first=1
    for f in "$DATA_DIR"/*.log; do
        [ -f "$f" ] || continue
        local name=$(basename "$f" .log)
        while IFS='|' read -r ts val; do
            [ $first -eq 1 ] && first=0 || echo "," >> "$out"
            printf '  {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out"
        done < "$f"
    done
    echo "\n]" >> "$out"
    ;;

Technical Analysis

The exporter constructs JSON through direct string interpolation. User-controlled val content is inserted between JSON quotation marks without escaping double quotes, backslashes, or control characters.

A crafted entry can therefore make the export syntactically invalid or terminate the intended string and inject additional JSON properties or objects. The echo "\n]" statement is also implementation-dependent: without echo -e, many shells write a literal backslash and n, which can make the generated document invalid even without malicious input.

This is principally an integrity and interoperability vulnerability. If another application assumes that the exported file is trusted and processes injected structure, the impact can extend to that downstream consumer.

Attack Path

1. An attacker-controlled value containing quotation marks, backslashes, control characters, or JSON syntax is saved as a Mileage entry.
2. The victim runs mileage export json.
3. The script interpolates the value directly into a JSON string.
4. The resulting export is malformed or contains attacker-influenced JSON structure.
5. A downstream application parses the export, fails unexpectedly, or acts on injected fields if its parser accepts the resulting document.

Impact Assessment

The direct impact is corruption of exported re ...[truncated 284 chars]

Remediation

View remediation

Remediation Suggestions

• Generate JSON with a real serializer, for example jq, passing every value through --arg.
• If avoiding external dependencies, implement a thoroughly tested JSON-escaping routine that handles quotation marks, backslashes, control characters, and Unicode correctly.
• Replace implementation-dependent echo behavior with printf, including for structural delimiters.
• Build the complete document in a temporary file with restrictive permissions, validate it with a JSON parser, and atomically rename it to the destination.
• Add tests for quotation marks, backslashes, tabs, newlines, carriage returns, empty values, and Unicode input.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill metadata and description present a narrowly scoped vehicle mileage tracker, but the documented commands expose a much broader personal record-keeping tool with inventory, reminders, checklists, maintenance, search, and generic logging. This scope mismatch is dangerous because users and higher-level agents may grant trust, invoke the skill, or provide data under false assumptions about what the skill does and stores, increasing the chance of inappropriate data collection and misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest frames the skill as a vehicle mileage/trip tracker, while the command set implements broad home-management and arbitrary note/logging functions unrelated to mileage. In an agent ecosystem, this deceptive or overly broad interface can cause data to be routed to a skill outside its expected purpose, violating least privilege and increasing privacy risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The advertised purpose is vehicle mileage tracking, but the command surface is a broad home-management logger with unrelated categories. This mismatch can deceive users into providing data outside the expected scope and is a strong indicator of hidden or repurposed functionality inconsistent with the declared skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The write paths accept arbitrary free-form input and persist it across many unrelated categories rather than structured mileage records. In a skill presented as mileage tracking, this enables covert collection of broadly sensitive user content under misleading labels, increasing the risk of privacy abuse and unauthorized data retention.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation markets the tool as a focused mileage utility, yet the listed commands reveal unrelated multi-category record management. While this is primarily a transparency and trust-boundary issue rather than direct code execution, misleading scope claims can cause users to underestimate what information they may store and later expose through search or export.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script branding and inline documentation conflict with the built-in help, which describes a different 'home toolkit' capability set. Such inconsistent identity is dangerous because it undermines informed consent and suggests the code was repurposed without updating disclosures, a common sign of deceptive packaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script creates a persistent data directory and history log and records user-provided content without any upfront notice, consent flow, or retention explanation. Because the skill already appears scope-mismatched, this undisclosed local persistence is more dangerous than usual and can lead users to expose sensitive information they did not expect to be stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill states that all data is stored locally and that activity is automatically logged, but it does not prominently warn users about persistent retention, what is recorded, or how to delete it. This can lead to unintentional storage of sensitive travel or personal data, especially because the skill supports broad categories beyond mileage and includes export/search capabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.