Security audit

Agent Cli Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with orchestrating AI CLI tools, but it under-discloses risky local shell execution, credential-file access, persistent config writes, and external AI context sharing.

Review this skill carefully before installing. Use it only if you are comfortable with an agent reading shell and project configuration, running installed AI CLI tools, writing `~/.ai-cli-config.json`, and potentially sending code diffs or summaries to the providers behind those CLIs. Prefer a dedicated AI-only config file, avoid generic `.env` access, and remove automatic `~/.zshrc` sourcing unless you explicitly trust that shell startup file.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scan_ai_tools.sh:6
Finding: Unsafe Shell Initialization and PATH-Based Tool Execution
Content: View full analysis
/dev/null; then echo "✅ $name ($cmd) - 已安装" # 测试可用性 - 直接运行帮助命令 if "$cmd" --help &> /dev/null || "$cmd" -h &> /dev/null || "$cmd" --version &> /dev/null || "$cmd" -v &> /dev/null; then ``` The skill documentation explicitly requires this behavior: ```bash source ~/.zshrc command -v gemini command -v claude command -v cursor-agent ``` ### Technical Analysis The scanner sources the user's interactive `.zshrc` file in its current process. Sourcing a shell configuration does not merely import environment variables: every shell command, function definition, alias, command substitution, and external program referenced by the file may execute. After loading the file, the script trusts the resulting `PATH` and invokes executables by short names. Although the tool names themselves are fixed, the executable selected for each name is controlled by `PATH`. A malicious or compromised shell configuration can therefore prepend an attacker-controlled directory containing a forged `gemini`, `claude`, or `cursor-agent` executable. Redirecting output to `/dev/null` does not provide isolation and does not prevent the resolved program from modifying ...[truncated 1261 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:65
Finding: Overbroad Access to Credential-Bearing Project Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/scan_ai_tools.sh:51
Finding: Unconditional Overwrite of Persistent User Configuration
Content: View full analysis
"$CONFIG_FILE" << EOF { "version": "1.0", "scan_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "available": [ $(for tool in "${available_tools[@]}"; do IFS=':' read -r cmd name desc <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\"}," done | sed '$ s/,$//') ], "unavailable": [ $(for tool in "${unavailable_tools[@]}"; do IFS=':' read -r cmd name desc status <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\", \"status\": \"$status\"}," done | sed '$ s/,$//') ] } EOF ``` The destination is defined earlier as: ```bash CONFIG_FILE="$HOME/.ai-cli-config.json" ``` This conflicts with the documented access model: ```text - **Minimal Access**: Only reads necessary config files, never writes or modifies them ``` ### Technical Analysis The `>` redirection creates or truncates `~/.ai-cli-config.json` before writing the newly generated scan result. There is no existence check, backup, confirmation prompt, merge operation, or atomic replacement. Consequently, any prior user configuration—including strategy and priority fields described elsewhere in the skill—can be silently destroyed. The destination is persistent in the user's home directory, while the documentation explicitly claims the skill does not write or modify configuration files. This mismatch prevents users from accurately evaluating the skill's side effects. ### Attack Path 1. The user already has `~/.ai-cli-config.json` containing customized tool priorities or strategy settings. 2. The user follows the instruction that the scanner must be executed. 3. The shell opens the existing file using truncating redirection. 4. The exi ...[truncated 528 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document presents key operational instructions exclusively in Chinese under a prominent 'important' section, while the rest of the skill is in English. This creates a language/locale constraint without offering the user a language choice or documenting that the skill is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill claims credentials are handled locally with 'no data exfiltration', but the documented workflow explicitly invokes external AI CLI tools, passes project context such as git diff and summaries, and may use backup credentials from local config files. This can mislead users into trusting the skill with sensitive data under false assumptions, increasing the chance that secrets or proprietary code are sent to third-party services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script's description understates its behavior: besides scanning for installed AI CLI tools, it sources the user's ~/.zshrc and writes a persistent configuration file under the home directory. In a skill context, this hidden side effect is risky because users may consent to a harmless scan but unintentionally execute arbitrary shell initialization code and modify their environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Sourcing ~/.zshrc executes arbitrary shell code from the user's startup file, not just environment variable assignments. In this script, that happens automatically before the scan, so running a seemingly simple discovery tool can trigger unintended commands, network access, credential exposure, or destructive actions already embedded in the shell config.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's comments and all user-visible messages are in Chinese, which imposes a specific language on users without opt-in. The policy allows locale constraints only when they are explicitly offered as a choice or clearly justified as region-specific, which is not present here.
Content: No source excerpt is available for this finding.