Hash Utilities

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This is a local hash and checksum utility with coherent behavior, though users should be careful not to pass real HMAC secrets on the command line.

Installers should treat this as a local utility for user-selected files and strings. Avoid using real long-lived HMAC secrets with the current command-line interface unless you are comfortable with command history and process-list exposure; a prompt or stdin-based key flow would be safer.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hash_tool.py:54

Finding

HMAC Secret Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/hash_tool.py, lines 54-55 and 72
Vulnerability Type: Command-line secret exposure
Risk Level: Medium

Vulnerable Code

python

p = sub.add_parser('hmac', help='HMAC signature')
p.add_argument('message'); p.add_argument('-k', '--key', required=True)

python

elif args.command == 'hmac':
    print(f"HMAC-{args.algorithm}: {hmac_sign(args.message, args.key, args.algorithm)}")

Technical Analysis

The HMAC interface requires users to provide the secret key through the -k or --key command-line argument. Command-line arguments are not an appropriate transport mechanism for sensitive credentials because they can be:

• Recorded in interactive shell history.
• Captured by command auditing or process-monitoring systems.
• Observed through process inspection facilities while the command is running, subject to operating-system permissions.
• Retained in terminal logs, automation logs, or diagnostic output that records invoked commands.

The code does not itself transmit or print the key, but its required invocation method unnecessarily places the secret in externally observable process metadata. Exploitation requires local access to command history, process metadata, or command logs; no remote exploitation path was identified.

Attack Path

1. A user invokes the HMAC operation with a sensitive key, for example:

   shell

   python3 scripts/hash_tool.py hmac "message" --key "sensitive-secret"
   

2. The complete invocation is retained in shell history, automation logs, audit telemetry, or temporarily exposed through process inspection.
3. A local user, administrator, monitoring service, or attacker who has gained access to one of those data sources obtains the HMAC key.
4. The attacker uses the disclosed key to generate valid HMAC values for attacker-controlled messages.
5. If an external system relies on that key for message ...[truncated 657 chars]

Remediation

View remediation

Remediation Suggestions

Do not require secrets to be supplied as command-line arguments.

1. Prompt for the key without terminal echo by using getpass.getpass():

   python

   import getpass
   
   key = getpass.getpass("HMAC key: ")
   print(f"HMAC-{args.algorithm}: {hmac_sign(args.message, key, args.algorithm)}")
   

2. Make --key unnecessary and preferably remove it to prevent accidental insecure usage.
3. For automation, accept the key through standard input or a dedicated inherited file descriptor rather than process arguments.
4. If key-file support is added, require restrictive file permissions, avoid following untrusted symbolic links where applicable, and document secure file handling.
5. Avoid environment variables for long-lived secrets when stronger mechanisms are available, because environment data may also be exposed through process inspection, crash reports, or logs.
6. Clear references to the key as soon as practical, while recognizing that Python strings cannot be reliably erased from memory.
7. Update usage documentation so examples never place real HMAC secrets directly on the command line.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is broad and covers many generic hashing and verification requests, which can cause the skill to activate in situations where a more appropriate or safer tool should handle the request. Over-broad activation increases the chance of unintended file access or misuse on arbitrary user-supplied paths and data, especially because the skill advertises file hashing and integrity verification without tighter scoping.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description is primarily in English but appends Chinese trigger guidance, which implicitly introduces a language-specific behavior without documenting language selection or user opt-in. The file does not state that the skill is bilingual or let users choose their preferred language.

Content

No source excerpt is available for this finding.