T01 · Skill Instruction Hijacking
Error
- Location
scripts/skill-tmpl.sh:8- Finding
Persistent Third-Party Promotional Output Hijacking in Generated Skills
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Template
Security checks for vulnerabilities and agentic risk
Overview
This skill should go to Review because it mixes a template-generator identity with a persistent local logging utility and promotional output injected into generated templates.
Review carefully before installing. Avoid putting secrets, tokens, private notes, or business-sensitive data into this skill because it can retain entries and command arguments locally in plaintext. Treat generated templates as needing cleanup before reuse, especially the fixed promotional footer and branding guidance. The artifact does not show remote exfiltration or destructive behavior, but its packaging and persistence behavior are not cleanly scoped to the advertised template-generator purpose.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:5- Finding
User Records and Command History May Be Created with Excessive Local Read Permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` From `scripts/script.sh:51-54`: ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } ``` ### Technical Analysis The script stores user-provided records in `data.log` and command arguments in `history.log`, but it does not establish a restrictive umask or explicitly set private directory and file permissions. Consequently, permissions depend on the invoking process's environment. With a common `022` umask: - `mkdir -p "$DATA_DIR"` can create the directory with mode `0755`. - Shell redirection can create `data.log` and `history.log` with mode `0644`. On a multi-user system, those modes can allow other local accounts to traverse the storage directory and read the logs. The exposure is significant because `cmd_add` writes the complete supplied record to `data.log`, while `_log` records the first argument for commands such as `add`, `run`, and `search`. The configurable `SKILL_TEMPLATE_DIR` also means storage can be redirected to another location. Although all path expansions are quoted, the script does not verify that the selected directory is private or that existing log paths are regular files rather than symbolic links. ### Attack Path 1. The victim runs the tool under a permissive umask, such as `022`. 2. `scripts/script.sh` creates the data directory without explicitly restricting its mode. 3. The victim invokes `add`, `run`, or `search` with private or sensitive t ...[truncated 1183 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest says this is a skill-template generator, but the documented functionality is a general-purpose logging and record-management CLI with persistent storage, search, export, and command history. This mismatch can mislead users and reviewers into authorizing a skill under false expectations, making hidden data collection or unrelated local operations more dangerous.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The front matter presents the skill as a template generator, while the main body describes a separate data-management utility. Security reviews and users rely on the manifest for trust decisions, so this inconsistency can conceal the real operational scope and lead to inappropriate installation or use.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The bulk of the documentation advertises unrelated data-log commands despite claiming to be a skill-template generator. Broad documentation inconsistency is a security issue because it obscures true capability, including persistent local storage and command history logging, and undermines informed consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script’s actual functionality is a generic local logging/CRUD utility that stores user-provided data in a local database and history log, which materially differs from the advertised purpose of generating and validating skill templates. This mismatch is dangerous because users or automation may grant trust and execute it expecting scaffolding behavior, while it instead collects and persists input data without a purpose aligned to the manifest.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents persistent local file access and storage behavior, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and governance gap: users and platforms cannot accurately assess or constrain the skill’s file access, increasing the risk of unintended data exposure or unauthorized local state changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill mentions that entries and command history are stored locally, but it does not present this as a clear warning or highlight the privacy implications. Users may unknowingly place sensitive data into commands or entries that are then retained in plaintext and later exportable, increasing the chance of local disclosure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The inline help and header describe the script as a "multi-purpose utility tool," which directly contradicts the manifest’s narrowly scoped skill-template generator description. Such contradictory documentation increases the risk of deceptive packaging or unsafe operator assumptions, because reviewers and users cannot reliably determine what the tool is supposed to do before execution.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The add path writes arbitrary user-supplied content to a persistent local log database immediately, but the tool’s primary description does not clearly warn that it stores data. While this is local-only behavior, undisclosed persistence can leak sensitive prompts, names, or other operator input into files under the user’s home directory, especially in a skill context where users may expect one-shot generation rather than logging.
- Content
Static analysis
No suspicious patterns detected.