Tool Output Auditor

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 0.1.0

Overview

This skill is a small output-auditing helper that is broadly triggered but its behavior is disclosed, local, and aligned with preventing agents from acting on misread command results.

Installers should understand that this skill may activate often after meaningful commands and may encourage using a local Python helper on captured output. Use the helper on intended command logs or bounded files, and be cautious with output from untrusted programs because terminal control characters or very large streams could make the summary misleading or slow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit_output.py:62

Finding

Untrusted Terminal Control Sequences Are Printed Without Sanitization

Content

View full analysis

Vulnerability Details

File Location: scripts/audit_output.py, lines 62–68 and 135–139
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

python

def decisive_lines(text: str):
    out = []
    for line in text.splitlines():
        low = line.lower()
        if any(re.search(p, low) for p in SUCCESS_PATTERNS + FAIL_PATTERNS + PARTIAL_PATTERNS + WARNING_PATTERNS):
            out.append(line)
    return out[:12]

python

lines = decisive_lines(text)
if lines:
    for line in lines:
        print(f'- {line}')
else:
    print('- No decisive lines found; inspect the full output manually.')

Technical Analysis

The auditor treats captured command output as untrusted input but prints selected lines directly to the terminal. The original lines are preserved without removing or escaping ANSI escape sequences, OSC sequences, C0/C1 control characters, or other terminal directives.

An attacker-controlled command can include a recognized pattern such as successfully, error:, or warn in a line containing terminal control sequences. The line will pass decisive_lines() and subsequently be written unchanged to the operator's terminal.

Depending on terminal capabilities and configuration, malicious sequences could alter colors, move the cursor, erase or overwrite displayed text, create deceptive hyperlinks, change a terminal title, or otherwise spoof the visible audit result. This does not establish arbitrary operating-system command execution by itself, but it undermines the integrity of the security-relevant output.

Attack Path

1. An attacker influences the output of a command, build process, log source, package, or remote service being audited.
2. The attacker emits a line containing a recognized classification keyword and crafted terminal control sequences.
3. The operator saves that output to a file or pipes it to audit_output.py.
4. decisive_lines() selects the malicious li ...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

• Sanitize every untrusted line before printing it to an interactive terminal.
• Remove or visibly escape ANSI, OSC, C0, and C1 control sequences, including the ESC character and non-printable control bytes.
• Preserve ordinary newline and tab handling only when explicitly required.
• Consider rendering control characters in an unambiguous form such as \x1b, \x07, or Unicode control pictures.
• Provide a raw-output mode only as an explicit opt-in, accompanied by a warning that the content may contain terminal control sequences.
• Add regression tests containing cursor movement, screen clearing, OSC hyperlinks, terminal-title changes, carriage returns, backspaces, and mixed recognized keywords.
• Keep the computed verdict and recommendation separate from untrusted evidence and clearly delimit quoted evidence so it cannot visually impersonate trusted output.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/audit_output.py:110

Finding

Unbounded Input Loading Can Exhaust Memory or Processing Resources

Content

View full analysis

Vulnerability Details

File Location: scripts/audit_output.py, lines 110–112
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code

python

if args.path:
    text = Path(args.path).read_text(encoding='utf-8')
else:
    text = sys.stdin.read()

Technical Analysis

Both supported input paths read all available content into a single in-memory string. Path.read_text() loads the complete file, while sys.stdin.read() continues until end-of-file. The implementation imposes no maximum byte count, file-size check, read timeout, or bounded streaming behavior.

After loading the input, the script repeatedly scans the complete string during classification, context detection, line splitting, and regular-expression matching. Consequently, very large input can consume substantial memory and CPU. An stdin source that does not terminate can also keep the program waiting indefinitely while continuously accumulating data.

Attack Path

1. An attacker supplies or influences a command-output file, log file, named pipe, or stdin stream presented to the auditor.
2. The input is made extremely large or, for stdin, kept open while data continues to arrive.
3. read_text() or sys.stdin.read() attempts to retain the entire input in memory.
4. Subsequent classification and line processing perform additional full-input scans and allocations.
5. The process experiences excessive memory use, high processing time, termination by the operating system, or indefinite unavailability.

Impact Assessment

Successful exploitation can deny availability of the auditing process and consume resources under the privileges of the user running it. The issue does not provide privilege escalation, access to protected files beyond those the operator explicitly supplies, or demonstrated code execution.

The immediate scope is the auditor process, but resource pressure may affect other processes owned by the same user or, under con ...[truncated 157 chars]

Remediation

View remediation

Remediation Suggestions

• Define and document a maximum accepted input size appropriate for expected command output.
• For regular files, inspect file metadata before reading and reject files exceeding the limit.
• Read files and stdin incrementally in bounded chunks instead of calling unbounded read_text() or read().
• Stop reading after the configured byte or line limit and return a clear ambiguous or error verdict indicating that the input was truncated.
• Avoid retaining the complete input when only pattern matches and a limited number of decisive lines are required.
• Apply execution time and memory limits when the utility runs in automated or multi-tenant environments.
• Add tests for oversized files, endless streams, named pipes, inputs without newlines, and multibyte UTF-8 data near the byte limit.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description says to use the skill for 'validation, packaging, publishing, deployments, file edits, process management, API calls, or any workflow where the next action must depend on actual output rather than assumptions.' This scope is extremely broad and lacks clear boundaries or exclusion conditions, increasing the chance of unintended invocation across ordinary agent tasks.

Content

No source excerpt is available for this finding.