Read Tool

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

This skill is a simple input-reading utility, but its password and silent-input claims are misleading and could expose secrets in plaintext.

Review before installing. Do not use this skill for passwords, API keys, tokens, or other secrets unless the implementation is fixed to parse options correctly, use secure no-echo input for silent mode, and avoid writing sensitive values to stdout.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/read.py:1

Finding

Documented Silent Password Input Is Echoed and Written to Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/read.py:1-4
Related Documentation: SKILL.md:8-17, 24
Vulnerability Type: Plaintext disclosure of sensitive input caused by unimplemented option handling
Risk Level: Medium

Complete Vulnerable Code:

python

#!/usr/bin/env python3
import sys
prompt = sys.argv[1] if len(sys.argv) > 1 else ''
print(input(prompt), end='')

Technical Analysis

The skill documentation claims that the tool supports -s for silent password entry, -p for prompts, and -t for timeouts. It specifically presents the following password-handling example:

bash

read-tool -s -p "Password: " PASS

The implementation does not parse any of these options. It treats only the first command-line argument as a literal prompt and calls Python's standard input() function. Standard terminal input remains visibly echoed, so the documented -s behavior is not provided.

After reading the value, the implementation also sends the complete captured input to standard output using print(). Consequently, a password entered according to the documented usage can be exposed both on the terminal during entry and through stdout. Standard output may subsequently be captured by shell pipelines, process supervisors, CI logs, terminal recording systems, or calling agents.

The script also does not implement the documented timeout or variable-storage semantics. Although those discrepancies affect reliability, the security-relevant defect is the false assurance of silent input combined with unconditional plaintext output.

Attack Path

1. A user or agent relies on SKILL.md and invokes the documented password example:

   bash

   read-tool -s -p "Password: " PASS
   

2. The implementation interprets -s as an ordinary prompt rather than enabling silent mode.
3. The user enters a password while the terminal visibly echoes the characters.
4. The script prints t ...[truncated 1013 chars]

Remediation

View remediation

Remediation Suggestions

1. Implement explicit argument parsing, such as with Python's argparse, for the documented -p, -t, and -s options.
2. When silent mode is enabled, read input with getpass.getpass() or another mechanism that securely disables terminal echo.
3. Do not write sensitive input to stdout. Define a secure and explicit mechanism for returning or consuming values, and warn callers against placing secrets in logs or command-line arguments.
4. Implement the documented timeout safely, or remove the timeout claim from SKILL.md.
5. Reconcile the documented variable-storage behavior with the actual process model. A child process cannot directly assign a variable in its parent shell without a deliberate shell integration mechanism.
6. Add automated tests confirming that silent input is not echoed, secrets are not printed, options are parsed correctly, and unsupported argument combinations fail safely.
7. Until secure silent handling is implemented, remove the password example and clearly state that the tool must not be used to capture sensitive information.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

## Options

- `-p PROMPT`: Display prompt before reading
- `-t N`: Timeout after N seconds
- `-s`: Silent mode (don't echo input)

Static analysis

No suspicious patterns detected.