Notify Tool

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

The skill is a simple desktop notifier, but its bundled helper can execute unintended shell commands from notification title or message text.

Review this skill before installing. It appears intended for desktop notifications, but do not use it with untrusted or automatically forwarded title/message text unless the helper is fixed to call notify-send without a shell, such as subprocess.run with an argument list.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/notify.py:13

Finding

OS Command Injection Through Notification Title and Message

Content

View full analysis

Vulnerability Details

File Location: scripts/notify.py, line 13
Vulnerability Type: OS command injection
Risk Level: High

python

os.system(f'notify-send -u {urgency_map.get(urgency, "normal")} "{title}" "{message}"')

Technical Analysis

The title and message values originate from command-line arguments declared at lines 21–22 and are passed to send_desktop_notification() at line 25. Line 13 interpolates these untrusted values directly into a command executed through os.system().

os.system() invokes a system shell. Enclosing input in double quotes does not make it safe because shell constructs such as command substitution remain active inside double-quoted strings. An attacker can use payloads containing constructs such as $(command) or escape the quoted argument and append shell commands.

The broad exception handler does not prevent exploitation. Moreover, os.system() generally returns an exit status when a command fails rather than raising an exception.

Attack Path

1. An attacker gains control over the notification message or title supplied to the utility, directly or through an automated task that forwards untrusted content.
2. argparse stores the supplied value in args.message or args.title.
3. The value is passed without sanitization to send_desktop_notification().
4. The function inserts it into a shell command.
5. The shell evaluates injected syntax before or while invoking notify-send.
6. The injected command executes with the same operating-system identity and permissions as the notification process.

For example, a title or message containing shell command substitution can cause the substituted command to run even though the input is surrounded by double quotes.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user or service running the skill. Depending on those privileges and the host envi ...[truncated 310 chars]

Remediation

View remediation

Remediation Suggestions

Remove shell interpretation and invoke notify-send with a fixed executable and a separate argument list:

python

import subprocess

def send_desktop_notification(title: str, message: str, urgency: str = "normal"):
    urgency_map = {
        "low": "low",
        "normal": "normal",
        "critical": "critical",
    }

    try:
        subprocess.run(
            [
                "notify-send",
                "-u",
                urgency_map.get(urgency, "normal"),
                title,
                message,
            ],
            check=False,
        )
    except OSError:
        print(f"[NOTIFICATION] {title}: {message}")

Do not use shell=True. Retain the urgency allowlist, catch only expected errors such as OSError, and consider resolving notify-send to a trusted absolute path when the execution environment may have an attacker-controlled PATH. Add tests using inputs containing quotes, semicolons, dollar signs, backticks, and command-substitution syntax to verify that they are passed as literal notification text.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This is a true command-injection vulnerability. The code builds a shell command with untrusted user-controlled values (title and message) and executes it via os.system, so shell metacharacters or embedded quotes can break out of the intended arguments and execute arbitrary commands. In the context of a notification tool that is likely to be used from scripts and automation, externally supplied message content is common, which makes this more dangerous rather than less.

Content

Scanner excerpt · scripts/notify.py (reported line 14)May include surrounding context.

python

try:
        # Try notify-send (Linux)
        urgency_map = {'low': 'low', 'normal': 'normal', 'critical': 'critical'}
        os.system(f'notify-send -u {urgency_map.get(urgency, "normal")} "{title}" "{message}"')
    except:
        print(f"[NOTIFICATION] {title}: {message}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill documentation presents a shell-capable command-line utility but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may infer shell usage from examples and invoke command execution without clear least-privilege boundaries, increasing the risk of unintended or overly broad shell access.

Content

No source excerpt is available for this finding.