Grep Tool

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:56 AM UTC
• Version: 1.0.0

Overview

This is a simple local grep-style search skill with some availability robustness issues but no evidence of hidden, destructive, persistent, or exfiltrating behavior.

Install only if you are comfortable with a local search tool reading files or directories you point it at. Avoid running it over huge untrusted directories or with complex untrusted regex patterns until the implementation adds streaming, file-size limits, and regex timeouts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/grep.py:36

Finding

Regular Expression Denial of Service Through Untrusted Search Patterns

Content

View full analysis

Vulnerability Details

File Location: scripts/grep.py, lines 36-47
Vulnerability Type: Regular Expression Denial of Service (ReDoS)
Risk Level: Medium

Vulnerable Code:

python

# Compile regex
flags = re.IGNORECASE if ignore_case else 0
if word_regexp:
    pattern = r'\b' + pattern + r'\b'

try:
    regex = re.compile(pattern, flags)
except re.error as e:
    return [f"Invalid pattern: {e}"]

matches = []
for i, line in enumerate(lines):
    line_match = regex.search(line)

Technical Analysis

The command-line search pattern is passed directly to Python's backtracking re engine. Although malformed expressions are caught, syntactically valid expressions with nested or ambiguous quantifiers can require exponential matching time.

For example, a pattern such as (a+)+$ can cause catastrophic backtracking when evaluated against a sufficiently long line consisting of many a characters followed by a nonmatching character. The implementation imposes no pattern-complexity limit, input-line length limit, execution timeout, or cancellation mechanism. Consequently, a user who controls both the pattern and searched content—or who can direct the utility to adversarial content—can consume excessive CPU resources.

Attack Path

1. The attacker creates or identifies a readable text file containing a long near-matching line, such as thousands of a characters followed by X.
2. The attacker invokes or induces the Agent to invoke the Skill using a pathological expression such as (a+)+$.
3. re.compile() accepts the expression because it is syntactically valid.
4. regex.search(line) enters extensive backtracking while processing the crafted line.
5. The Skill process consumes CPU until matching completes, the task times out, or an external resource limit terminates it.

Impact Assessment

Successful exploitation can delay or halt the Skill invocation, cause Agent task tim ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

• Replace Python's backtracking regular-expression implementation with a linear-time engine where supported.
• If the existing engine must be retained, execute each match in an isolated worker with a strict wall-clock timeout and terminate workers that exceed it.
• Enforce reasonable limits on pattern length and input-line length.
• Reject or restrict high-risk regex constructs, while recognizing that static filtering alone is not a complete defense.
• Apply process-level CPU and memory limits when the Skill handles untrusted patterns or files.
• Return a clear timeout error rather than allowing an unbounded search to block the Agent.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/grep.py:28

Finding

Denial of Service Through Unbounded Whole-File Buffering

Content

View full analysis

Vulnerability Details

File Location: scripts/grep.py, lines 28-30
Vulnerability Type: Uncontrolled Memory Consumption
Risk Level: Medium

Vulnerable Code:

python

try:
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

Technical Analysis

readlines() loads the complete contents of every searched file into a Python list before matching begins. Memory usage therefore scales with the full file size and includes overhead for the list and individual Python string objects. A sufficiently large readable file can consume all memory available to the process or container.

Directory searches compound the exposure because each discovered file is passed to search_file(). Files are processed sequentially, so memory from previous calls can ordinarily be reclaimed, but any single oversized file remains sufficient to exhaust memory. The implementation performs no size check, streaming, memory quota enforcement, or protection against unexpectedly large files.

Attack Path

1. The attacker creates or identifies a very large file accessible to the Skill.
2. The attacker directs or induces the Agent to search that file or a directory containing it.
3. search_file() calls f.readlines() before processing any matches.
4. Python allocates memory for the entire file and associated list and string objects.
5. The process experiences severe memory pressure, is terminated by the operating system or container, or degrades other workloads on the same host.

Impact Assessment

Exploitation can terminate the Skill process, interrupt the Agent's task, and cause host-level resource pressure where isolation is weak. No additional privileges are obtained, and the flaw does not independently expose file contents beyond files the process can already read. Its primary impact is local availability within the process, container, or shared host resource boundary.

Remediation

View remediation

Remediation Suggestions

• Process files as streams rather than calling readlines().
• Maintain only the bounded state required for matching and context output, such as a deque containing the preceding -B lines and a counter for the following -A lines.
• Enforce configurable maximum file-size and line-length limits for untrusted input.
• Apply process or container memory limits as defense in depth.
• Handle oversized files explicitly and return a clear diagnostic instead of attempting to buffer them.
• Avoid duplicate context buffering and output where overlapping matches occur, further limiting avoidable memory growth.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.