T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:183- Finding
Potential Disclosure of Credentials and Proprietary Context to External AI Services
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Cli Orchestrator
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible AI CLI orchestrator, but it asks for broad automatic context handoff and credential-adjacent access while making security claims that its own script and instructions contradict.
Review this skill carefully before installing. It may be useful if you intentionally want multiple AI CLIs to share task context, but do not use it on repositories with secrets, private code, or sensitive diffs unless you add explicit redaction and per-provider approval. Avoid running the scanner as written unless you are comfortable with it executing your shell startup file and overwriting `~/.ai-cli-config.json`.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan_ai_tools.sh:6- Finding
Execution of Arbitrary Shell Startup Commands During Tool Scanning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan_ai_tools.sh:55- Finding
Unannounced Destructive Overwrite of User Configuration
- Content
View full analysis
"$CONFIG_FILE" << EOF { "version": "1.0", "scan_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "available": [ $(for tool in "${available_tools[@]}"; do IFS=':' read -r cmd name desc <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\"}," done | sed '$ s/,$//') ], "unavailable": [ $(for tool in "${unavailable_tools[@]}"; do IFS=':' read -r cmd name desc status <<< "$tool" echo " {\"cmd\": \"$cmd\", \"name\": \"$name\", \"desc\": \"$desc\", \"status\": \"$status\"}," done | sed '$ s/,$//') ] } EOF ``` The security documentation states: ```markdown - **Minimal Access**: Only reads necessary config files, never writes or modifies them ``` ### Technical Analysis The shell redirection operator `>` creates or truncates `~/.ai-cli-config.json` before writing the generated inventory. The script does not check whether the file already exists, request confirmation, preserve user-defined fields, create a backup, or perform an atomic replacement. This is inconsistent with the explicit claim that the Skill never writes or modifies configuration files. A user relying on that statement may run the scanner without realizing that an existing configuration—including manually assigned priorities and strategies—will be destroyed. The direct write is also non-atomic. Interruption, disk exhaustion, or process termination can leave a partially written or empty configuration file. ### Attack Path 1. The user has an existing `~/.ai-cli-config.json` containing customized priorities, strategy selections, or other settings. 2. The user ...[truncated 1096 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The header comment at L003 limits the script's purpose to scanning installed tools, testing availability, and generating a configuration file. Later, the user-facing guidance at L088 states that when using this skill, it will automatically call AI CLI tools by priority, which contradicts the actual code in this file because it performs no task execution or tool invocation beyond help/version checks during scanning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Sourcing $HOME/.zshrc executes arbitrary shell code from a user-controlled startup file before the scan runs. In a skill context, this creates an unexpected code execution path: any malicious or risky content in .zshrc will run with the script’s privileges, which is more dangerous than merely reading environment variables.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown includes the Chinese term "接管" inside otherwise English instructions, which implicitly introduces a language/localization inconsistency without user opt-in or explanation. This can violate language policy expectations for consistent user-facing skill content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Comments and console messages throughout the file are exclusively in Chinese, including the operational guidance at L077-L089. This creates a locale/language constraint without any opt-in or documented justification, which matches the language-policy violation criteria.
- Content