Whoami Tool

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

The skill is small and not destructive, but its identity check is misleading because it claims to report the effective user while reading a spoofable environment variable.

Review before installing. This skill should not be used for authorization, privilege checks, auditing, or automation that depends on the real effective OS user until it is changed to use kernel-backed identity APIs such as os.geteuid()/pwd and its documented options are implemented or removed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/whoami.py:2

Finding

Spoofable Effective-User Identity Check

Content

View full analysis

Vulnerability Details

File Location: scripts/whoami.py, lines 2-3
Vulnerability Type: Reliance on an untrusted environment variable for identity verification
Risk Level: Medium

python

import os
print(os.environ.get('USER', 'unknown'))

Technical Analysis

The script reports the value of the process-controlled USER environment variable rather than querying the effective operating-system identity. A caller can arbitrarily override this variable, so it is not authoritative evidence of the process's effective username or privileges.

This contradicts the documented purpose of returning the “current effective username” for permission and access-control verification. The implementation also ignores command-line arguments, meaning the documented --full, --uid, --groups, --json, and --check USER behaviors are not implemented.

Attack Path

1. An attacker or untrusted caller runs the tool while setting a forged environment value:

   bash

   USER=root scripts/whoami.py
   

2. The script reads USER without validating it against the process's effective UID.
3. The script prints root, even if the process is running as a non-root user.
4. A wrapper or automation script that trusts this output for an authorization decision may incorrectly execute a branch intended only for root.

Impact Assessment

An attacker can spoof the identity reported by this utility within any process context where they can control inherited environment variables. This does not itself grant operating-system privileges or change the effective UID. However, consumers that use the output for permission checks, access-control decisions, auditing, or conditional execution may be misled.

The resulting scope depends on the consuming application. If a privileged wrapper treats the reported username as authoritative, the flaw could cause unauthorized privileged operations. No such wrapper is present in the audited project, so direct privilege escalat ...[truncated 45 chars]

Remediation

View remediation

Remediation Suggestions

Resolve identity from kernel-backed process credentials rather than environment variables:

python

import os
import pwd

effective_uid = os.geteuid()
effective_username = pwd.getpwuid(effective_uid).pw_name
print(effective_username)

Additionally:

1. Implement command-line parsing for every documented option, or remove unsupported options from SKILL.md.
2. Implement --check USER by comparing the requested username against the username derived from os.geteuid(), with exit status 0 for a match and 1 otherwise.
3. Obtain UID and GID values through os.geteuid() and os.getegid().
4. Resolve group information through trusted OS identity APIs rather than environment values.
5. Add tests that run the script with forged values such as USER=root and verify that the reported identity still matches the effective UID.
6. Warn callers not to use display-oriented output as the sole authorization boundary; privileged operations should independently verify effective credentials.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.