Security audit
Security checks for vulnerabilities and agentic risk
This sorting skill is mostly coherent, but one JSON sorting fallback can turn crafted input into Python code execution, and it keeps a persistent local history of processed filenames.
Review before installing. The skill does useful local sorting and analysis, but avoid using the json command on untrusted filenames or keys, especially on systems without jq. Also expect a local history file to retain names and metadata for files you process; do not use it on sensitive paths unless that audit trail is acceptable.
scripts/script.sh:178Arbitrary Python Code Execution Through Unsafe JSON Argument Interpolation
scripts/script.sh:43Operation History Log Injection Through Unescaped User-Controlled Fields
The skill advertises itself primarily as a sorting utility, but it also declares additional analysis functions and persistent history logging that are not clearly reflected in the top-level purpose statement. Undisclosed persistence to ~/.local/share/sort/history.log can expose filenames, usage patterns, or sensitive operational context, and feature creep beyond the declared scope reduces transparency and informed consent for users and orchestrators selecting the skill.
The description says to use the skill when "monitoring changes, reporting results, alerting anomalies," which are broad, generic activities rather than specific trigger phrases or constrained contexts. In a manifest/markdown file, this can cause unintended invocation because the activation scope is not clearly limited to explicit sorting-related requests.
User file operations are logged persistently, but the usage/help text does not warn users that filenames and metadata will be retained. The main danger is silent privacy loss: users may process confidential files assuming the tool is stateless, while the skill leaves an audit trail on disk.
The script persistently records operation names, filenames, flags, and counts to a history file without necessity for core sorting behavior. In a skill context that may process arbitrary user files, this can leak sensitive filenames, dataset characteristics, and usage patterns to local disk and to any other process or user with access to that account.
The JSON fallback embeds user-controlled file and key values directly into a python3 -c command string. If either value contains shell- or Python-significant characters, this can lead to command injection or unintended code execution, and even when not exploitable it expands the skill's execution surface through external interpreters beyond simple sorting.
The script creates a persistent data directory and history log under the user's home directory, which goes beyond transient sorting behavior described by the skill. While not directly code-execution dangerous, it introduces undisclosed local data retention of filenames and usage metadata that may expose sensitive workflow information.
The manifest focuses on sorting files, lines, and columns with custom ordering and deduplication. The implemented freq and stats commands perform analysis and reporting operations rather than sorting, which broadens the skill's behavior beyond the stated description.
No suspicious patterns detected.