T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup.py:58- Finding
Unsafe Tar Archive Extraction Allows Writes Outside the Restore Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Backup Tool
Security checks for vulnerabilities and agentic risk
Overview
This backup skill needs review because it claims protections like encryption and exclusions that are not actually implemented, and its restore path can write outside the chosen folder from a crafted archive.
Do not rely on this skill for sensitive or encrypted backups as published. Treat its archives as plaintext, do not restore archives you do not fully trust, do not depend on --exclude, and avoid unattended broad backups such as /home until the documentation and implementation are corrected.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup.py:17- Finding
Accepted Exclusion Rules Are Silently Ignored
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:1- Finding
Documented Encryption and Integrity Protections Are Not Implemented
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documentation claims security-sensitive features like AES-256 encryption, integrity verification, excludes, sync behavior, and scheduling-related use cases that static analysis indicates are not actually implemented. This is dangerous because users may rely on nonexistent protections and assume backups are encrypted or filtered when they are not, leading to data exposure or accidental inclusion of sensitive files.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises and documents shell execution of a backup script but does not declare any tool scope such as permissions or allowed-tools. In an agent setting, undeclared shell capability increases the chance that the skill is invoked with broader execution authority than reviewers or policy expect, especially for filesystem-wide backup and restore operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description uses broad invocation conditions such as backing up important files, scheduled backups, sync folders, encryption, and restore scenarios without clear limits. Over-broad routing can cause the skill to be selected in situations involving sensitive or destructive file operations, increasing the likelihood of unnecessary shell execution and unsafe filesystem access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation describes restore and automated backup usage without warnings about destructive overwrite risk, broad filesystem capture, credential handling, or the dangers of unattended cron execution. In a backup/restore context, missing warnings materially increase the chance of data loss, accidental backup of sensitive material, or silent recurring execution against unintended paths.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata and module docstring explicitly claim encryption support, but the implementation only creates and restores compressed tar archives and computes a checksum. This can cause users to back up sensitive data under the false assumption it is encrypted, resulting in plaintext-at-rest exposure if the archive is accessed by an attacker or copied from insecure storage.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The advertised security property does not exist: the code never encrypts backup contents during creation and never decrypts during restore. In the context of a backup skill intended for important and sensitive files, this mismatch is especially dangerous because users are likely to rely on the claim and store confidential data in unprotected archives.
- Content