Security audit

Sandwich

Security checks for vulnerabilities and agentic risk

Overview

This skill claims to analyze blockchain sandwich operations, but the packaged tool is actually a local note/config manager that persists, deletes, and exports user-entered data.

Review this as a mislabeled local storage tool, not a blockchain analysis tool. Install only if you are comfortable with it creating ~/.sandwich, persisting entries/configuration there, deleting records by line number, and exporting local files; avoid entering sensitive analysis inputs until the purpose and storage behavior are corrected.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

other

Warning

Location: SKILL.md:12
Finding: Declared Blockchain Analysis Functionality Does Not Match the Implementation
Content: View full analysis
[args] Commands: status Show current status add Add new entry list List all entries search Search entries remove Remove entry by number export Export data to file stats Show statistics config View or set config ``` ### Technical Analysis The Skill represents itself as a blockchain sandwich-operation and protocol-security analysis tool. Its implementation contains no blockchain transaction processing, on-chain data retrieval, protocol analysis, or sandwich-attack detection logic. Instead, it implements a generic local entry manager that stores user-provided text in a JSONL file under `${SANDWICH_DIR:-$HOME/.sandwich}`. This behavior is materially different from the stated purpose and can cause an AI Agent or user to select the Skill under false assumptions about its capabilities. ### Attack Path 1. An Agent selects the Skill based on the description in `SKILL.md`. 2. The Agent expects analysis of a transaction, protocol, or sandwich mechanism. 3. The implemented command interface instead accepts and stores generic entries locally. 4. Information supplied for the expected analysis may be persisted in `$HOME/.sandwich/data.jsonl`. 5. The caller receives note-management output rather than the advertised security analysis. ### Impact ...[truncated 452 chars]
Remediation: View remediation
` and `search `. - Add tests that compare documented capabilities with implemented command behavior. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:9
Finding: Unescaped User Input Permits JSONL Record Corruption and Injection
Content: View full analysis
> "$DATA_DIR/data.jsonl" } ``` ### Technical Analysis The `val` variable ultimately contains user-controlled input from the `add` command. It is inserted directly into a JSON string without JSON encoding. Quoting the shell variable prevents shell word splitting and command substitution at this point, but it does not make the value valid or safe JSON. Double quotes, backslashes, newlines, and control characters remain unescaped. An input containing a quote and newline can terminate the intended JSON value and add attacker-controlled text or extra lines. The resulting file may no longer be valid JSONL. Because other commands parse records using `grep` and `cut` rather than a JSON parser, forged fields may also be presented as legitimate entries. ### Attack Path 1. Invoke `scripts/script.sh add` with an entry containing embedded quotes or newlines. 2. `cmd_add` passes the value to `_save_entry`. 3. `_save_entry` interpolates the value directly into the JSON text. 4. The injected characters alter the JSON structure or create additional physical lines. 5. Subsequent `list`, `search`, `stats`, or `export` operations process the malformed or forged records. For example, a value conceptually shaped like the following can introduce an additional line: ```text original-value"} {"ts":"forged","cmd":"add","val":"forged-value ``` ### Impact Assessment Exploitation is limited to files writable by the user running the Skill, principally `$DATA_DIR/data.jsonl`. It does not directly provide privilege escalation. Potential consequences include: - Corruption of the local ...[truncated 227 chars]
Remediation: View remediation
> "$DATA_DIR/data.jsonl" } ``` Additional hardening should include: - Validate each existing line with a JSON parser before displaying or exporting it. - Define and enforce reasonable record-length limits. - Reject unsupported control characters if multiline entries are not required. - Add tests covering quotes, backslashes, tabs, newlines, Unicode, and empty values. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:113
Finding: CSV Export Allows Spreadsheet Formula Injection
Content: View full analysis
"$out" while IFS= read -r line; do ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo "$ts,$c2,$vl" >> "$out" done < "$DATA_DIR/data.jsonl" ;; ``` ### Technical Analysis The export routine concatenates data into comma-separated rows without applying CSV quoting or escaping. Values containing commas, quotes, carriage returns, or newlines can therefore change the row and column structure. Additionally, user-controlled values that begin with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` are written unchanged. Some spreadsheet applications may interpret such cells as formulas when the exported file is opened. The exact effect depends on the spreadsheet program and its security policy, but potentially dangerous formulas can initiate external requests or other application-specific actions. ### Attack Path 1. Add an entry whose value starts with a formula marker, such as `=`, `+`, `-`, or `@`. 2. Run `scripts/script.sh export csv`. 3. The value is written verbatim to `sandwich-export.csv`. 4. A user opens the generated file in spreadsheet software. 5. If the application evaluates formulas automatically or after a prompt, the attacker-controlled expression is interpreted as a formula. Separately, an entry containing commas, quotes, or line breaks can corrupt the exported table structure even if formulas are not evaluated. ### Impact Assessment The shell script itself does not evaluate the spreadsheet formula. Exploitation requires the generated CSV file to be ...[truncated 531 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:139
Finding: Unescaped Configuration Values Alter the Dynamically Constructed sed Expression
Content: View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis Both `key` and `val` are user-controlled and are interpolated into `grep` regular expressions and a `sed` substitution program. In the `sed` call: - Regular-expression metacharacters in `key` can change which configuration lines match. - The `|` delimiter in either input can break the substitution syntax. - `&` in `val` expands to the entire matched text in a `sed` replacement. - Backslashes can alter replacement semantics. - Other malformed input can cause the command to fail under `set -e`. As a result, a caller can update unintended configuration lines, produce an unexpected replacement, corrupt `config.txt`, or terminate the command. ### Attack Path 1. Create or populate `$DATA_DIR/config.txt` with multiple entries. 2. Invoke `scripts/script.sh config ` using regex metacharacters in the key or replacement metacharacters such as `&`, `\`, or `|` in the value. 3. The script embeds those characters directly into the `grep` pattern and `sed` program. 4. The resulting expression matches unintended lines, performs an unintended replacement, becomes syntacti ...[truncated 578 chars]
Remediation: View remediation
&2 return 1 fi ``` - Avoid constructing a `sed` program from untrusted input. - Parse the file as key-value records and rewrite it through a temporary file using exact string comparison. - Create temporary files securely with `mktemp` and atomically replace the original file after a successful write. - If `sed` must be retained, separately escape all regular-expression characters in the key and all delimiter, ampersand, and backslash characters in the replacement. - Apply the same exact-match approach to the `grep "^${key}="` operations. - Add tests for regex metacharacters, delimiters, ampersands, backslashes, spaces, and newline-containing arguments. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises blockchain sandwich-analysis capabilities, but the documented commands implement a generic local data-management tool with persistent storage, deletion, export, and configuration writes. This mismatch is dangerous because users or higher-level agents may invoke the skill under false assumptions, granting it access to local state-changing operations unrelated to its stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description promises one class of behavior while the body documents another, creating an integrity problem in the skill interface. In agent ecosystems, this can lead to unsafe delegation because selection decisions are based on metadata that understates local file manipulation and persistence capabilities.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The command list describes status/add/list/search/remove/export/config actions typical of a local note or inventory tool, not blockchain sandwich analysis. Such deceptive or misleading documentation can cause operators and agents to trust and run the skill in sensitive contexts, despite it performing unrelated local data operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline documentation explicitly describes the script as analyzing sandwich/protocol security operations, but no such logic exists. Deceptive self-description in a security-oriented skill is hazardous because it can cause operators to rely on nonexistent analysis capabilities and overlook that the tool is instead collecting and storing local data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata and help text claim blockchain/security 'sandwich' analysis, but the implementation is a local note/config store with add/list/search/remove/export behavior. In an agent-skill context, this mismatch is dangerous because it can mislead users or higher-level orchestration into granting trust or invoking the tool for security analysis while it instead persists arbitrary user input to disk, creating deceptive functionality and unexpected data handling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The user-facing help output advertises analytical blockchain functionality that the available commands do not perform. Because help text is a primary trust signal for users and agents, this misrepresentation increases the likelihood of misuse, misplaced confidence, and unapproved data persistence under false pretenses.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Commands such as remove, export, and config can delete data, write files, or modify local configuration, but the documentation provides no warnings, confirmation requirements, or scope details. This increases the chance of accidental destructive actions and makes it easier for an agent to trigger persistent side effects without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This shell script updates or appends configuration values in $DATA_DIR/config.txt, which is a persistent file write affecting user state. Although the command prints a success message after writing, there is no user-facing warning in comments, help text, or prompts that the config command modifies files under the user's home directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.