Unzip Tool

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

This ZIP skill is small and not malicious, but its documentation promises safety controls and inspection features that the actual extractor does not provide.

Review before installing. Use this only in an empty temporary directory and inspect ZIP contents with another trusted tool first; do not rely on the documented -l, -n, -o, or selective extraction behavior because the bundled script does not implement them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/unzip.py:8

Finding

Unconditional Overwrite of Existing Files During ZIP Extraction

Content

View full analysis

Vulnerability Details

File Location: scripts/unzip.py, lines 8-9
Vulnerability Type: Uncontrolled file overwrite
Risk Level: Medium

python

with zipfile.ZipFile(args.file, 'r') as z:
    z.extractall(args.dir)

Technical Analysis

The application passes every member of a user-supplied ZIP archive directly to zipfile.ZipFile.extractall(). It does not inspect destination collisions or require explicit authorization before replacing existing regular files.

This behavior is also inconsistent with the overwrite controls documented in SKILL.md: the documentation advertises -o and -n, but the argument parser implements neither option. Consequently, overwriting is effectively always enabled, and users cannot request the documented never-overwrite behavior.

An attacker can construct an archive whose member names match predictable files in a destination directory. If a user extracts that archive into a populated directory, matching files can be replaced without warning. The issue does not independently grant privileges beyond those of the invoking process.

Attack Path

1. An attacker creates a ZIP archive containing files named after predictable project or configuration files.
2. The attacker persuades a user or automated process to extract the archive using this Skill.
3. The user selects a populated directory using -d, or extracts into the default current directory.
4. extractall() processes all archive members without checking whether their destination paths already exist.
5. Existing matching regular files are replaced using the permissions of the invoking process.
6. The replacement can cause data loss or modify project behavior when the affected files are subsequently used.

Impact Assessment

Exploitation can compromise the integrity and availability of files writable by the invoking user within the selected extraction destination. Potential consequences include loss of exist ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

1. Make refusal to overwrite existing files the default policy.
2. Implement mutually exclusive --overwrite and --never-overwrite options, matching the behavior documented in SKILL.md.
3. Inspect every archive member before extraction and calculate its final destination path.
4. Detect destination collisions before writing any files. Abort the operation or skip conflicting members unless overwrite permission was explicitly supplied.
5. Extract validated members individually instead of calling extractall() without policy enforcement.
6. Consider using a staging directory and moving validated files into the destination only after all archive members pass validation.
7. Return a nonzero exit status when validation or extraction fails so automated callers can reliably detect unsuccessful or partial extraction.
8. Add tests covering existing-file collisions, default behavior, explicit overwrite behavior, never-overwrite behavior, and partially conflicting archives.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description claims three capabilities: list, test, and extract ZIP archives. The actual code only performs extraction via zipfile.ZipFile(...).extractall(...). This is a partial implementation of the declared purpose, and the missing listing and testing capabilities are material because they are explicitly presented as supported behavior for inspecting archives. There is no evidence of unrelated or additional dangerous behavior, but the description overstates what the code can do.

Content

No source excerpt is available for this finding.