Regex Tool

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

This is a straightforward local regex helper with a known availability caveat, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable running local regex patterns on provided text. Avoid using untrusted or very complex patterns against large inputs unless the execution environment has time or resource limits, because some regexes can hang or consume heavy CPU.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/regex.py:21

Finding

Unbounded Regular Expression Evaluation Enables Denial of Service

Content

View full analysis

Vulnerability Details

File Location: scripts/regex.py, lines 21-42
Vulnerability Type: Regular Expression Denial of Service (ReDoS)
Risk Level: Medium

Vulnerable Code

python

regex = re.compile(pattern, flags)

if replace:
    # Replacement mode
    if find_all:
        result = regex.sub(replace, text)
    else:
        result = regex.sub(replace, text, count=1)
    print(result)
elif find_all:
    # Find all matches
    matches = regex.findall(text)
    if verbose:
        for i, match in enumerate(matches):
            print(f"{i+1}: {match}")
    else:
        for match in matches:
            print(match)
else:
    # Single match
    match = regex.search(text)

Technical Analysis

The script compiles a user-controlled regular expression and evaluates it against user-controlled text using Python's backtracking re engine. The search, findall, and sub operations have no execution timeout, input-size limit, pattern-complexity restriction, or isolation mechanism.

Patterns containing nested or ambiguous quantifiers can cause catastrophic backtracking. Processing time may grow exponentially with input length when such a pattern nearly matches a long input but fails near its end.

Attack Path

1. An attacker invokes the tool with a pathological expression, such as ^(a+)+$.
2. The attacker supplies a sufficiently long near-matching string consisting of repeated a characters followed by a non-matching character, either as the positional text argument or through standard input.
3. For example, the vulnerable matching path can be reached with:

   bash

   python3 scripts/regex.py '^(a+)+$' 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!'
   

4. regex.search(text) repeatedly explores overlapping backtracking states while attempting to prove that the input does not match.
5. Increasing the input length can cause the process to consume excessive CPU an ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a regular-expression implementation that supports a native per-operation timeout, and enforce a short maximum execution duration for every search, substitution, and global match.
2. If native timeouts are unavailable, execute regex processing in an isolated subprocess with strict wall-clock, CPU, and memory limits. Terminate the subprocess when any limit is exceeded.
3. Define conservative maximum lengths for both patterns and input text before compilation or evaluation.
4. Reject or separately review high-risk constructions such as nested quantifiers, ambiguous alternations, and quantified groups containing overlapping matches. Treat this only as defense in depth because static detection cannot identify every pathological expression.
5. Return a controlled error when a timeout or resource limit is reached.
6. Add regression tests using known catastrophic-backtracking patterns and long near-matching inputs to verify that processing terminates within the configured limit.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep