Modbus

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:16 PM UTC
• Version: 1.0.0

Overview

The skill is advertised as a Modbus industrial protocol tool, but it only manages local files and includes an unsafe config update path, so it should be reviewed before installation.

Install only if you want a local note/config record manager, not a real Modbus tool. Do not rely on its status output for industrial device state, avoid passing untrusted config keys or values, and be aware it stores and mutates files under ~/.modbus or the directory named by MODBUS_DIR.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/script.sh:128

Finding

Arbitrary Command Execution Through GNU sed Program Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 128-145
Vulnerability Type: Command injection through dynamically constructed sed program
Risk Level: High

bash

cmd_config() {
    local key="${1:-}" val="${2:-}"
    local cfg="$DATA_DIR/config.txt"
    if [ -z "$key" ]; then
        echo "=== Config ==="
        if [ -f "$cfg" ]; then
            while IFS="=" read -r k v; do echo "  $k=$v"; done < "$cfg"
        else echo "  (empty — use config <key> <value>)"; fi
    elif [ -z "$val" ]; then
        grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)"
    else
        if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then
            sed -i "s|^${key}=.*|${key}=${val}|" "$cfg"
        else
            echo "${key}=${val}" >> "$cfg"
        fi
        echo "Set: $key=$val"
    fi
}

Technical Analysis

The user-controlled key and val arguments are interpolated directly into a GNU sed program. Shell double quoting only keeps the resulting text in one shell argument; it does not make that text safe as sed syntax.

An attacker can include delimiter characters, regular-expression syntax, newlines, or additional sed commands. GNU sed provides the e command, which executes a command through a shell. A value containing a newline can terminate the intended substitution and insert an e command. The unvalidated key can also alter the matching expression and replacement program.

Attack Path

1. The attacker invokes the Skill with access to the config command.
2. The attacker first creates a normal configuration entry:

   bash

   scripts/script.sh config target initial
   

3. The attacker updates that existing entry with a crafted argument containing a replacement delimiter, newline, GNU sed e command, and comment. Conceptually, the injected value transforms the genera ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a sed program using untrusted input.
• Restrict configuration keys to a strict allowlist such as ^[A-Za-z_][A-Za-z0-9_]*$.
• Treat configuration values exclusively as data and support arbitrary values through a format with a proper serializer, such as JSON.
• If a line-oriented format must be retained, rewrite the file using a safe implementation that passes values separately from program text and explicitly handles newlines.
• Write changes to a securely created temporary file in the same directory, validate the result, set restrictive permissions, and atomically rename it over the original file.
• Add regression tests containing sed delimiters, backslashes, ampersands, newlines, regular-expression metacharacters, and GNU sed commands.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/script.sh:7

Finding

Caller-Controlled Data Directory Enables Unsafe File and Symlink Operations

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 7-15
Vulnerability Type: Unrestricted file path and unsafe symlink handling
Risk Level: Low

bash

VERSION="1.0.0"
DATA_DIR="${MODBUS_DIR:-$HOME/.modbus}"

_ensure_dirs() { mkdir -p "$DATA_DIR"; }

_save_entry() {
    _ensure_dirs
    local cmd="$1" val="$2"
    local ts=$(date '+%Y-%m-%d %H:%M:%S')
    printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"
}

The same uncontrolled path is subsequently used for destructive or modifying operations:

bash

sed -i "${num}d" "$DATA_DIR/data.jsonl"

bash

local cfg="$DATA_DIR/config.txt"
...
echo "${key}=${val}" >> "$cfg"

Technical Analysis

MODBUS_DIR is fully controlled by the caller and is accepted without canonicalization, ownership validation, directory permission checks, or restriction to an approved storage root. Files beneath that directory are opened for append or replacement without verifying that they are regular files and not symbolic links.

_ensure_dirs also creates the directory using permissions derived from the ambient umask, and the generated data and configuration files do not receive explicit restrictive modes. Consequently, data may be exposed to other local users when the surrounding permissions or umask are permissive.

Attack Path

1. An attacker who can control the Skill environment sets MODBUS_DIR to an unintended writable or shared directory.
2. The attacker places data.jsonl or config.txt as a symbolic link to another file writable by the Skill process.
3. The attacker invokes add or config.
4. The shell append redirection follows the symbolic link and writes attacker-selected content to the linked target.
5. Alternatively, the attacker directs remove at a selected data file, after which sed -i replaces or modifies that path.

This path does not bypass ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict storage to a canonical directory owned by the invoking user unless arbitrary locations are an explicit requirement.
• Set umask 077 before creating directories or files.
• Create the data directory with mode 0700 and data files with mode 0600.
• Reject symbolic links and non-regular files before reading or writing.
• Verify directory ownership and ensure it is not writable by untrusted users.
• Use secure file descriptors and atomic replacement rather than path-based checks followed by separate writes.
• If MODBUS_DIR must remain configurable, document its trust boundary and reject paths outside explicitly approved roots.

other

Warning

• Location: SKILL.md:10

Finding

Declared Modbus Functionality Does Not Match the Implemented Record Manager

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-13
Vulnerability Type: Misleading functionality and unsafe operational representation
Risk Level: Medium

markdown

# modbus

Modbus communication protocol tool. Use when json modbus tasks, csv modbus tasks, checking modbus status.
## Commands

The implementation advertised as status reporting only reports local application metadata:

bash

cmd_status() {
    echo "=== modbus Status ==="
    echo "  Version: $VERSION"
    echo "  Data dir: $DATA_DIR"
    local entries=$(cat "$DATA_DIR"/*.jsonl 2>/dev/null | wc -l || echo 0)
    echo "  Entries: $entries"
    echo "  Disk: $(du -sh "$DATA_DIR" 2>/dev/null | cut -f1 || echo empty)"
}

Technical Analysis

The Skill describes itself as a Modbus communication protocol tool and states that it can check Modbus status. The reviewed script implements only local JSONL record creation, listing, search, deletion, export, statistics, and configuration storage.

It contains no Modbus frame construction or parsing, function codes, unit identifiers, register addressing, serial transport, TCP transport, network connection, or device-status query. The status command reports the script version, local data directory, record count, and disk usage rather than the status of a Modbus device.

Attack Path

1. A user or Agent selects the Skill based on its Modbus description.
2. The caller invokes status, expecting information about an industrial device or Modbus connection.
3. The command returns local record-store metadata under a heading labeled modbus Status.
4. The caller may interpret this output as device or protocol status and use it in monitoring or operational decisions.

No direct code-execution path arises solely from this mismatch. The risk is incorrect reliance on output that does not represent the advertised industrial system state.

Impact Assessment

The ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

• Rename and redescribe the Skill as a local record manager if that is its intended purpose.
• Remove claims that it communicates through Modbus or checks Modbus device status.
• If genuine Modbus support is intended, implement explicit and validated serial or TCP transport, unit addressing, function-code handling, register access, timeouts, and error reporting.
• Clearly distinguish local application status from remote device, connection, and protocol status.
• Add integration tests proving that each advertised command performs the documented operation.
• For industrial operations, require explicit target selection and appropriate safety controls before permitting device writes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to provide Modbus communication and status checking, but the documented commands describe a generic local CRUD/export/config tool instead. This mismatch is dangerous because it can cause an agent or user to invoke the skill in industrial or operational contexts under false assumptions, leading to unintended local file operations and trust in nonexistent Modbus functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A skill presented as a Modbus protocol tool but documented as a local entry-management CLI is a deceptive interface boundary. In an agent ecosystem, this can misroute automation and cause the skill to be selected for sensitive industrial tasks even though it instead manipulates local state and files, creating operational confusion and possible unsafe actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The header comments and help text repeatedly claim Modbus protocol functionality, but the code only supports add/list/search/remove/export/config operations over local stored entries. In an agent ecosystem, misleading documentation is a security issue because it can cause inappropriate invocation, conceal data collection behavior, and bypass human scrutiny under the guise of an industrial protocol utility.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script is advertised as a Modbus communication tool, but every implemented command only manages local files under a hidden data directory and performs no Modbus protocol actions. This kind of capability deception is dangerous in an agent skill because users or orchestrators may grant it network/device-oriented trust and invoke it for industrial control tasks, while it silently collects and persists arbitrary user-supplied data instead.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation wording is broad and ambiguous, which can cause the skill to be invoked in contexts where its actual behavior is unsuitable or unsafe. In agent-driven environments, vague trigger conditions increase the attack surface for incorrect tool selection and amplify the impact of the skill's misleading Modbus branding.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The command set contradicts the stated Modbus purpose by exposing actions like add, list, remove, export, and config, which are unrelated to protocol communication. This inconsistency increases the chance of accidental misuse, especially by autonomous agents relying on metadata and command docs to choose tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation includes file-affecting operations such as remove, export, and config changes without warnings, confirmation expectations, or scope limitations. This is risky because users or agents may execute destructive or privacy-impacting actions on local data directories without understanding persistence, overwrite, or deletion consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This shell script writes user-supplied configuration values into a persistent file under the user's home directory, but there is no nearby comment or other disclosure explaining that this operation stores data on disk. For code files, persistent file writes should have some visible disclosure unless already clearly documented; this block performs the write silently aside from a post-write success message.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.