Ai Cli Orchestrator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:17 AM UTC
• Version: 1.0.3

Overview

The skill is a plausible AI CLI orchestrator, but it asks for broad automatic context handoff and credential-adjacent access while making security claims that its own script and instructions contradict.

Review this skill carefully before installing. It may be useful if you intentionally want multiple AI CLIs to share task context, but do not use it on repositories with secrets, private code, or sensitive diffs unless you add explicit redaction and per-provider approval. Avoid running the scanner as written unless you are comfortable with it executing your shell startup file and overwriting `~/.ai-cli-config.json`.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:183
• Finding: Potential Disclosure of Credentials and Proprietary Context to External AI Services<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-30, 136, 183, 216-222` **Vulnerability Type**: Sensitive data exposure through external AI CLI context transfer **Risk Level**: High ### Complete Code Snippets ```markdown 2. **Availability Check:** Run `tool --version` or simple echo tests to verify API key validity. 3. **Environment Sync:** Read `.ai-config.yaml` or `.env` from project root for permission config. ``` ```markdown | **Auth Failed** | `401 Unauthorized` | Try local backup `.env`; if failed, skip and notify user. | ``` ```markdown - **Shared Context:** When switching tools, always pass `git diff` or latest `summary.md` to the接管 tool. ``` ```markdown - Read project-specific AI configs (`.ai-config.yaml`, `.env`) ### Credential Protection - **Local Processing Only**: All credential checks happen locally on your machine - **No Data Exfiltration**: Credentials are never sent to external servers - **Minimal Access**: Only reads necessary config files, never writes or modifies them ``` ### Technical Analysis The documented workflow reads files that commonly contain API keys and other credentials, including `.env`, and directs the orchestrator to pass `git diff` or `summary.md` content between AI CLI tools. These tools may communicate with third-party, network-hosted AI services. No controls are specified for secret detection, context redaction, file allowlisting, provider-specific consent, or preventing environment-file contents from entering prompts. The instruction to “always pass” a diff or summary creates an especially broad transfer boundary: diffs can include newly added secrets, private source code, credentials removed from files, internal endpoints, or confidential business data. This behavior conflicts with the claims that processing is local and that credentials are never sent to external servers. Although the repository does not contain a direct network-exfiltration implementation, the documented operational workflo ...[truncated 1288 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not read `.env` contents for tool discovery or availability testing. 2. Treat `.env`, credential stores, private keys, and authentication files as prohibited prompt sources. 3. Replace automatic context transfer with explicit, per-transfer user approval that identifies the destination provider. 4. Apply secret scanning and redaction before sending diffs, summaries, logs, or source files to any AI CLI. 5. Use a default-deny file policy with explicit project-relative allowlists. 6. Limit diffs to the files and lines strictly required for the active task. 7. Prevent fallback tools from receiving primary-tool transcripts unless the user approves the transfer. 8. Document that network-backed AI CLIs may send supplied context to third-party services. 9. Add automated tests using synthetic secrets to verify that credentials cannot enter generated prompts. 10. If credential validity must be checked, invoke a provider-specific authentication-status operation without reading or forwarding the credential value. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan_ai_tools.sh:6
• Finding: Execution of Arbitrary Shell Startup Commands During Tool Scanning<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan_ai_tools.sh:5-6` **Vulnerability Type**: Unnecessary execution of user-controlled shell initialization code **Risk Level**: Medium ### Complete Code Snippet ```bash # 加载环境变量 [ -f "$HOME/.zshrc" ] && source "$HOME/.zshrc" ``` ### Technical Analysis The scanner sources the complete `~/.zshrc` file into its current shell process. The `source` operation does not merely import environment variables: it executes every shell statement in the file with the scanner’s privileges. Shell startup files may contain command substitutions, network operations, aliases, functions, filesystem modifications, plugin loaders, or other interactive-shell logic. A malicious entry can also modify `PATH` or define functions matching `gemini`, `claude`, `codex`, or the other scanned command names. The subsequent availability tests could then execute attacker-controlled logic. Sourcing an executable startup file is unnecessary for basic tool discovery and violates least-execution principles. It also makes the scanner’s behavior dependent on code outside the reviewed package. ### Attack Path 1. An attacker, compromised shell plugin, installer, or other local process places a malicious command or function in `~/.zshrc`. 2. The user runs `scripts/scan_ai_tools.sh`, expecting it only to inspect installed AI tools. 3. Line 6 sources the complete startup file. 4. The malicious statement executes immediately with the invoking user’s privileges. 5. Alternatively, the startup file modifies `PATH` or defines a function named after a scanned AI tool. 6. The scanner’s later `command -v` and help/version checks locate and execute the spoofed tool implementation. This path requires the startup file to have already been modified, but the scanner unnecessarily activates its contents in a non-interactive audit operation. ### Impact Assessment Executed commands inherit the invoking user’s privileges and environment. They can there ...[truncated 517 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `source "$HOME/.zshrc"` operation. 2. Use the scanner’s inherited `PATH` for `command -v` checks. 3. If additional search paths are required, accept them through an explicit command-line option or a non-executable configuration file. 4. Do not evaluate shell fragments to import environment variables. 5. Resolve discovered executables to absolute paths and validate that they are regular executable files before invoking them. 6. Run availability checks with a minimal, controlled environment where practical. 7. Add timeouts to tool checks so a malicious or defective command cannot indefinitely stall the scanner. 8. Document exactly which external executables will be invoked during scanning. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan_ai_tools.sh:55
• Finding: Unannounced Destructive Overwrite of User Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan_ai_tools.sh:8, 52-73`; contradictory documentation at `SKILL.md:222` **Vulnerability Type**: Unsafe persistent configuration overwrite and misleading side-effect declaration **Risk Level**: Medium ### Complete Code Snippets ```bash CONFIG_FILE="$HOME/.ai-cli-config.json" ``` ```bash # 生成配置文件 echo "生成配置文件: $CONFIG_FILE" cat > "$CONFIG_FILE" << EOF { "version": "1.0", "scan_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "available": [ $(for tool in "${available_tools[@]}"; do IFS=':' read -r cmd name desc <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\"}," done | sed '$ s/,$//') ], "unavailable": [ $(for tool in "${unavailable_tools[@]}"; do IFS=':' read -r cmd name desc status <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\", \"status\": \"$status\"}," done | sed '$ s/,$//') ] } EOF ``` The security documentation states: ```markdown - **Minimal Access**: Only reads necessary config files, never writes or modifies them ``` ### Technical Analysis The shell redirection operator `>` creates or truncates `~/.ai-cli-config.json` before writing the generated inventory. The script does not check whether the file already exists, request confirmation, preserve user-defined fields, create a backup, or perform an atomic replacement. This is inconsistent with the explicit claim that the Skill never writes or modifies configuration files. A user relying on that statement may run the scanner without realizing that an existing configuration—including manually assigned priorities and strategies—will be destroyed. The direct write is also non-atomic. Interruption, disk exhaustion, or process termination can leave a partially written or empty configuration file. ### Attack Path 1. The user has an existing `~/.ai-cli-config.json` containing customized priorities, strategy selections, or other settings. 2. The user ...[truncated 1096 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Correct the documentation to disclose that the scanner creates or updates `~/.ai-cli-config.json`. 2. Refuse to overwrite an existing file unless the user explicitly confirms the operation or supplies a force option. 3. Preserve user-managed fields by parsing and merging the existing configuration rather than replacing it wholesale. 4. Create a timestamped backup before modifying an existing configuration. 5. Write to a securely created temporary file in the same directory, validate the JSON, set restrictive permissions, and atomically rename it into place. 6. Use a restrictive `umask`, such as `077`, before creating configuration files. 7. Provide a read-only mode that prints scan results to standard output without changing the filesystem. 8. Return a nonzero status if generation or validation fails, leaving the previous configuration intact. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The header comment at L003 limits the script's purpose to scanning installed tools, testing availability, and generating a configuration file. Later, the user-facing guidance at L088 states that when using this skill, it will automatically call AI CLI tools by priority, which contradicts the actual code in this file because it performs no task execution or tool invocation beyond help/version checks during scanning.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Sourcing $HOME/.zshrc executes arbitrary shell code from a user-controlled startup file before the scan runs. In a skill context, this creates an unexpected code execution path: any malicious or risky content in .zshrc will run with the script’s privileges, which is more dangerous than merely reading environment variables.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The markdown includes the Chinese term "接管" inside otherwise English instructions, which implicitly introduces a language/localization inconsistency without user opt-in or explanation. This can violate language policy expectations for consistent user-facing skill content.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Comments and console messages throughout the file are exclusively in Chinese, including the operational guidance at L077-L089. This creates a locale/language constraint without any opt-in or documented justification, which matches the language-policy violation criteria.

Static analysis

No suspicious patterns detected.