Security audit

Agent Cli Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with orchestrating AI CLI tools, but it under-discloses risky local shell execution, credential-file access, persistent config writes, and external AI context sharing.

Review this skill carefully before installing. Use it only if you are comfortable with an agent reading shell and project configuration, running installed AI CLI tools, writing `~/.ai-cli-config.json`, and potentially sending code diffs or summaries to the providers behind those CLIs. Prefer a dedicated AI-only config file, avoid generic `.env` access, and remove automatic `~/.zshrc` sourcing unless you explicitly trust that shell startup file.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scan_ai_tools.sh:6
Finding: Unsafe Shell Initialization and PATH-Based Tool Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan_ai_tools.sh:6-31`; related mandatory instructions in `SKILL.md:11-29` **Vulnerability Type**: Unsafe shell configuration execution and untrusted executable resolution **Risk Level**: Medium ### Vulnerable Code ```bash # 加载环境变量 [ -f "$HOME/.zshrc" ] && source "$HOME/.zshrc" CONFIG_FILE="$HOME/.ai-cli-config.json" # 要扫描的 AI CLI 工具列表（只检测这三个核心工具） AI_TOOLS=( "gemini:Gemini CLI:Google AI - 网络搜索/问答" "claude:Claude Code:Anthropic AI - 代码/问答" "cursor-agent:Cursor Agent:AI代码编辑器 - 代码生成/调试" ) echo "🤖 AI CLI 工具扫描器" echo "======================" echo "" available_tools=() unavailable_tools=() for tool_info in "${AI_TOOLS[@]}"; do IFS=':' read -r cmd name desc <<< "$tool_info" # 检查命令是否存在 if command -v "$cmd" &> /dev/null; then echo "✅ $name ($cmd) - 已安装" # 测试可用性 - 直接运行帮助命令 if "$cmd" --help &> /dev/null || "$cmd" -h &> /dev/null || "$cmd" --version &> /dev/null || "$cmd" -v &> /dev/null; then ``` The skill documentation explicitly requires this behavior: ```bash source ~/.zshrc command -v gemini command -v claude command -v cursor-agent ``` ### Technical Analysis The scanner sources the user's interactive `.zshrc` file in its current process. Sourcing a shell configuration does not merely import environment variables: every shell command, function definition, alias, command substitution, and external program referenced by the file may execute. After loading the file, the script trusts the resulting `PATH` and invokes executables by short names. Although the tool names themselves are fixed, the executable selected for each name is controlled by `PATH`. A malicious or compromised shell configuration can therefore prepend an attacker-controlled directory containing a forged `gemini`, `claude`, or `cursor-agent` executable. Redirecting output to `/dev/null` does not provide isolation and does not prevent the resolved program from modifying ...[truncated 1261 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not source interactive shell startup files during tool discovery. - Use the scanner's existing sanitized environment or accept explicit executable paths from the user. - If login-shell environment discovery is indispensable, isolate it in a subprocess and extract only a strictly validated `PATH`; do not run the scanner inside that shell. - Resolve each executable to an absolute path before execution. - Validate ownership, permissions, file type, and expected installation directories for resolved executables. - Provide a discovery-only mode that checks file presence without executing candidate programs. - When an availability test is necessary, run it with a minimal environment, timeout, restricted working directory, and operating-system sandbox. - Document that availability testing executes third-party binaries and obtain confirmation before doing so. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:65
Finding: Overbroad Access to Credential-Bearing Project Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65`; related behavior at `SKILL.md:142` and `SKILL.md:202-216` **Vulnerability Type**: Excessive access to potentially unrelated secrets **Risk Level**: Medium ### Vulnerable Instructions ```text 3. **Environment Sync:** Read `.ai-config.yaml` or `.env` from project root for permission config. ``` The error-handling section also directs the skill to use `.env` as an authentication fallback: ```text | **Auth Failed** | `401 Unauthorized` | Try local backup `.env`; if failed, skip and notify user. | ``` The security section states that credential files will be read and checked: ```text ### Why We Need to Read Config Files This skill requires reading shell and project configuration files to: - Scan for installed AI CLI tools in PATH - Verify API keys/credentials are valid - Read project-specific AI configs (`.ai-config.yaml`, `.env`) ### Credential Protection - **Local Processing Only**: All credential checks happen locally on your machine - **No Data Exfiltration**: Credentials are never sent to external servers - **Minimal Access**: Only reads necessary config files, never writes or modifies them - **Sandboxed Execution**: AI CLI tools run in isolated processes ``` ### Technical Analysis A generic project `.env` file commonly contains database passwords, cloud credentials, signing keys, deployment tokens, and secrets unrelated to AI CLI discovery. The instructions do not define an allowlist of permissible variable names, require user approval, or establish a redaction boundary. The skill also describes passing intermediate outputs, diffs, summaries, and task context between external AI CLI tools. Although no implemented exfiltration routine was found in the supplied script, indiscriminately reading `.env` creates a sensitive-data exposure path if its contents are included in prompts, diagnostic output, session summaries, or subprocess environments. The claim that credential checks are lo ...[truncated 1294 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove all instructions to read a generic `.env` file. - Use a dedicated configuration file containing only AI CLI settings and references to credentials. - Define an explicit allowlist of supported variable names and read only those values after informed user approval. - Prefer operating-system credential stores or provider-specific credential helpers over plaintext project files. - Never place secret values in prompts, summaries, logs, diffs, error messages, or session handover records. - Redact recognized credentials before passing any context to an external AI CLI. - Run credential validation only against the intended provider and clearly disclose that such validation may make a network request. - Correct the unsupported sandboxing claim or implement verifiable process and network isolation. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/scan_ai_tools.sh:51
Finding: Unconditional Overwrite of Persistent User Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan_ai_tools.sh:51-73`; conflicting documentation at `SKILL.md:211-214` **Vulnerability Type**: Undisclosed destructive configuration write **Risk Level**: Low ### Vulnerable Code ```bash # 生成配置文件 echo "生成配置文件: $CONFIG_FILE" cat > "$CONFIG_FILE" << EOF { "version": "1.0", "scan_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "available": [ $(for tool in "${available_tools[@]}"; do IFS=':' read -r cmd name desc <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\"}," done | sed '$ s/,$//') ], "unavailable": [ $(for tool in "${unavailable_tools[@]}"; do IFS=':' read -r cmd name desc status <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\", \"status\": \"$status\"}," done | sed '$ s/,$//') ] } EOF ``` The destination is defined earlier as: ```bash CONFIG_FILE="$HOME/.ai-cli-config.json" ``` This conflicts with the documented access model: ```text - **Minimal Access**: Only reads necessary config files, never writes or modifies them ``` ### Technical Analysis The `>` redirection creates or truncates `~/.ai-cli-config.json` before writing the newly generated scan result. There is no existence check, backup, confirmation prompt, merge operation, or atomic replacement. Consequently, any prior user configuration—including strategy and priority fields described elsewhere in the skill—can be silently destroyed. The destination is persistent in the user's home directory, while the documentation explicitly claims the skill does not write or modify configuration files. This mismatch prevents users from accurately evaluating the skill's side effects. ### Attack Path 1. The user already has `~/.ai-cli-config.json` containing customized tool priorities or strategy settings. 2. The user follows the instruction that the scanner must be executed. 3. The shell opens the existing file using truncating redirection. 4. The exi ...[truncated 528 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Clearly disclose that the scanner writes a persistent home-directory configuration file. - Provide a read-only scan mode that prints results without modifying any file. - Require explicit confirmation before creating or replacing the destination. - Refuse to overwrite an existing file by default and offer a separate, explicit `--force` option. - Preserve existing user-defined fields through a validated merge operation. - Write to a temporary file in the same directory, set restrictive permissions such as mode `0600`, validate the generated JSON, and atomically rename it into place. - Optionally create a timestamped backup before an approved replacement. - Update `SKILL.md` so its stated access and modification behavior accurately matches the implementation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The document presents key operational instructions exclusively in Chinese under a prominent 'important' section, while the rest of the skill is in English. This creates a language/locale constraint without offering the user a language choice or documenting that the skill is intended only for Chinese-speaking users.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims credentials are handled locally with 'no data exfiltration', but the documented workflow explicitly invokes external AI CLI tools, passes project context such as git diff and summaries, and may use backup credentials from local config files. This can mislead users into trusting the skill with sensitive data under false assumptions, increasing the chance that secrets or proprietary code are sent to third-party services.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The script's description understates its behavior: besides scanning for installed AI CLI tools, it sources the user's ~/.zshrc and writes a persistent configuration file under the home directory. In a skill context, this hidden side effect is risky because users may consent to a harmless scan but unintentionally execute arbitrary shell initialization code and modify their environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Sourcing ~/.zshrc executes arbitrary shell code from the user's startup file, not just environment variable assignments. In this script, that happens automatically before the scan, so running a seemingly simple discovery tool can trigger unintended commands, network access, credential exposure, or destructive actions already embedded in the shell config.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The script's comments and all user-visible messages are in Chinese, which imposes a specific language on users without opt-in. The policy allows locale constraints only when they are explicitly offered as a choice or clearly justified as region-specific, which is not present here.

Static analysis

No suspicious patterns detected.