Security audit

Twitch

Security checks for vulnerabilities and agentic risk

Overview

This is a simple offline Twitch-labeled logging CLI that stores user inputs locally, with some quality and local-data handling caveats but no evidence of hidden exfiltration or harmful behavior.

Install only if you are comfortable with a generic offline logger that saves command inputs and exports under ~/.local/share/twitch. Do not enter Twitch tokens, passwords, private URLs, or personal identifiers, and review local file permissions if using a shared machine. Expect manual recordkeeping rather than real Twitch API integration.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:4
Finding: Local data files are created without enforced private permissions
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` ### Technical Analysis The script creates its data directory and log files using the caller's current `umask`. It does not explicitly require owner-only permissions for either the directory or the files. On a system with a common `022` umask, `mkdir` normally creates the directory with mode `0755`, while shell redirection normally creates log and export files with mode `0644`. Other local users may consequently be able to list or read stored data. A more permissive umask would expose the data further. The path is also not checked to ensure that it is owned by the current user and is a real directory rather than a symbolic link. This matters most in unusual environments where an attacker can modify the user's home-directory hierarchy. ### Attack Path 1. A user executes the Skill with a permissive or ordinary default umask. 2. The script creates `~/.local/share/twitch/` and later creates logs and exports beneath it. 3. User-supplied score, rank, history, tracking, or other activity data is written to those files. 4. Another local account with traversal access to the user's home directory reads the files if their resulting permissions permit it. ### Impact Assessment The issue can disclose locally stored Skill inputs, history, and exports to other users on the same system. It does not grant additional privileges, remote access, or code execution. The scope is limited to data readable with the victim process's resulting filesystem permissions. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:102
Finding: Search input can be interpreted as grep command-line options
Content: View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis Although `"$term"` is shell-quoted and therefore does not permit shell metacharacter injection, `grep` still parses a value beginning with `-` as an option. The command does not use the `--` end-of-options marker or pass the search value through an explicit pattern option. An input such as `--file=/path/to/file` can cause `grep` to read patterns from another local file rather than treating the supplied value as literal search text. Other supported `grep` options may alter matching behavior, resource use, or file processing. Because only the first search argument is assigned to `term` and it remains quoted, this is not arbitrary shell command execution. The issue is limited to manipulation of `grep` behavior. ### Attack Path 1. An attacker or untrusted caller supplies a search term beginning with a hyphen, such as `--file=/path/readable/by/the-user`. 2. The Skill invokes `grep -i "$term" "$f"` for each log file. 3. `grep` interprets the search term as an option. 4. The process reads the referenced file as a pattern source or otherwise changes its search behavior. 5. The operation may return misleading results, consume excessive resources, fail unexpectedly, or access files that were not intended to participate in the search. ### Impact Assessment The process can access only files already readable by the user running the Skill. No privilege escalation or direct remote disclosure is present ...[truncated 151 chars]
Remediation: View remediation
/dev/null || true) ``` If the search term should be interpreted literally rather than as a regular expression, also use fixed-string matching: ```bash m=$(grep -iF -- "$term" "$f" 2>/dev/null || true) ``` Apply reasonable limits to search-term length if the command may process untrusted or automated input. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:55
Finding: Untrusted log values are exported without JSON or CSV escaping
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ``` ### Technical Analysis User-controlled values are inserted directly into JSON strings without escaping quotation marks, backslashes, control characters, or newlines. A crafted value can therefore corrupt the JSON structure or inject additional properties and objects into the generated document. CSV fields are likewise written without RFC 4180 quoting. Commas, quotation marks, and line breaks can create additional columns or rows. More importantly, values beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` remain active. When the exported file is opened in spreadsheet software, such values may be evaluated as formulas. The exact effect of formula evaluation depends on the spreadsheet application and its security configuration. It may range from misleading displayed data to network requests or dangerous external-content behavior. No automatic e ...[truncated 1301 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation presents this as a Twitch management skill, but the listed behavior is a generic local logging/export utility that records arbitrary inputs and persists them in local files. That mismatch is dangerous because users may provide sensitive operational or account-related data under the assumption the tool is narrowly scoped to Twitch metrics, while the skill instead stores broad user input and exposes additional commands unrelated to the declared purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation guidance is broad and ambiguous, which increases the chance the agent will call this skill in contexts beyond intended Twitch data management. In an agent setting, unclear trigger boundaries can cause overbroad data capture or inappropriate use of a persistence-capable tool when a narrower, safer action would suffice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises automatic history/activity logging and local storage, but it does not clearly foreground that user actions and inputs will be persistently recorded. This is dangerous because users may disclose sensitive channel, operational, or personal information without understanding it will be retained and exportable from disk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a CLI for Twitch-oriented channel metrics workflows such as highlights, scoring streams, rankings, and tracking stats. However, the help and command handlers expose many generic append-only logging commands that simply store arbitrary user input to local files without Twitch-specific logic or channel-data management, indicating the implemented behavior is materially different from the claimed purpose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline CLI documentation explicitly advertises 'stats' and later repeats 'stats' as 'Summary statistics', implying users can invoke a statistics-summary action. In the case statement, the first 'stats)' branch at L183-L197 always matches, so the later 'stats) _stats ;;' branch at L303 is dead code; the documentation therefore contradicts actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script persistently stores all user-supplied input under ~/.local/share/twitch and also appends it to history.log without clearly warning the user. In an agent-skill context, users may provide stream notes, tokens, URLs, personal identifiers, or other sensitive content assuming it is transient; persistent local logging can therefore create unintended disclosure risk to other local users, backups, support tools, or later exports.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.