T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xargs.py:3- Finding
Documented Execution Safety Controls Are Not Implemented
- Content
View full analysis
- Remediation
View remediation
Security audit
Xargs Tool
Security checks for vulnerabilities and agentic risk
Overview
This skill is an xargs-style command runner, but it advertises safety and control options that the included script does not implement.
Review this before installing. Treat it as a very small command-execution wrapper, not a full xargs replacement. Do not rely on --dry-run, -p, -0, -P, -n, or delimiter options unless the implementation is fixed, and avoid using it with destructive commands or untrusted pipeline input.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xargs.py:3- Finding
Empty Standard Input Still Triggers Command Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code does perform command execution based on standard input and supports simple '{}' argument substitution, which partially matches the description. However, the declared purpose claims broader xargs-style capabilities including batch processing, parallel execution, and delimiter control, none of which are present in the supplied code. The code only processes newline-delimited input sequentially, one invocation per line. This is a material description-to-behavior mismatch because several prominently declared capabilities are absent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill clearly documents shell-command execution behavior, but it declares no explicit tool scope or permissions boundary. In an agent environment, that omission can cause the skill to be invoked without clear execution constraints, increasing the risk of arbitrary or overly broad shell access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to construct and execute arbitrary commands from stdin, but the description does not warn that untrusted or malformed input can directly affect command execution and system state. That omission is dangerous because it normalizes using the tool in pipelines where attacker-controlled filenames, arguments, or command targets may be passed into sensitive operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation includes destructive examples like piping filenames into rm -f without any warning about irreversible data loss or the danger of untrusted input. In an agent or automation context, users may copy these patterns directly, leading to accidental mass deletion if input expansion or upstream command output is broader than expected.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
This script directly builds and executes subprocess arguments from untrusted sources: the command template comes from argv and each stdin line is substituted into command arguments without validation or restrictions. Although it does not invoke a shell, it still enables arbitrary command execution and dangerous argument injection if the skill is exposed to attacker-controlled input, which is especially risky because the stated purpose of the skill is to execute generated command lines.
- Content
python lines = sys.stdin.read().strip().split('\n') cmd = sys.argv[1:] for line in lines: subprocess.run([c.replace('{}', line) for c in cmd])
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code executes external commands with no warning, confirmation, logging, or explanatory guardrails, which increases the chance that users or higher-level agents will trigger destructive operations unintentionally. In this skill context, silent execution is more dangerous because the tool is specifically designed to batch-process untrusted stdin into repeated subprocess invocations, amplifying the effect of mistakes or abuse.
- Content