File Organizer

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:34 PM UTC
• Version: 1.0.0

Overview

This file-organizing skill is not malicious, but it needs review because some examples could move or permanently delete many files if run from the wrong folder.

Review commands before use, run dry runs first, restrict operations to a specific target directory, make a backup or clean git checkpoint before restructuring, and require explicit confirmation before any delete or broad move operation. Treat the `.env` mention as normal `.gitignore` scaffolding, not credential access.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/patterns.md:184

Finding

Destructive cleanup and flattening commands can cause irreversible data loss

Content

View full analysis

Vulnerability Details

File Location: references/patterns.md:184-194
Vulnerability Type: Unsafe destructive file operations
Risk Level: High

Vulnerable Code

bash

### Flatten Nested Directories
# Move all files from subdirs to parent
find . -type f -exec mv {} . \;
# Remove empty dirs
find . -type d -empty -delete

### Remove Empty Files
find . -type f -empty -delete

Technical Analysis

The documented flattening operation recursively moves every discovered file into the current directory without checking for destination-name collisions. If files in different directories have identical names, a later move may overwrite an earlier file, depending on the platform and mv implementation.

The subsequent commands permanently delete empty directories and empty files by using find -delete. They do not provide a dry run, request explicit user approval, or use a recoverable trash mechanism. This directly conflicts with the safety rule in SKILL.md:66, which states that deletion requires explicit permission.

Because these commands operate recursively from ., their effective scope depends on the Agent's current working directory. Running them from the workspace root can affect the entire accessible project tree.

Attack Path

1. A user asks the Agent to flatten nested directories or clean up empty files.
2. The Agent loads references/patterns.md as directed by the Skill.
3. The Agent executes the documented find commands from a broad directory such as the workspace root.
4. All nested files are moved into one directory without collision checks.
5. Empty files and directories are permanently deleted without a mandatory preview or confirmation step.
6. Same-named files may be overwritten, while intentionally empty placeholder files and directories may be lost.

No privilege escalation is involved; exploitation is limited to filesystem objects writable by the Agent's existing ope ...[truncated 518 chars]

Remediation

View remediation

Remediation Suggestions

• Remove direct -delete recipes or require explicit user approval immediately before executing them.
• Perform a mandatory dry run first:

  bash

  find "$validated_root" -type f -empty -print
  find "$validated_root" -type d -empty -print
  

• Use a recoverable trash mechanism instead of permanent deletion where available.
• Resolve and validate the target root before execution, and reject paths outside the approved workspace.
• For flattening, calculate every source and destination pair in advance and stop if any duplicate destination names are detected.
• Use no-clobber behavior such as mv -n, while also checking its availability and semantics on the host platform.
• Exclude version-control metadata, backup directories, and destination directories from recursive traversal.
• Require a backup or clean version-control checkpoint before a large restructuring operation.
• Report each proposed deletion and collision to the user and obtain explicit confirmation before making changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

Unsafe recursive bulk-move recipes can move or overwrite unintended files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-46; references/patterns.md:58-63; references/patterns.md:143-148
Vulnerability Type: Unsafe recursive file selection and filename handling
Risk Level: Medium

Vulnerable Code

From SKILL.md:42-46:

bash

mkdir -p images docs code
find . -name "*.png" -o -name "*.jpg" | xargs -I {} mv {} images/
find . -name "*.md" -o -name "*.txt" | xargs -I {} mv {} docs/
find . -name "*.py" -o -name "*.js" | xargs -I {} mv {} code/

From references/patterns.md:58-63:

bash

# Group by type
mkdir -p images docs code
find . -maxdepth 1 -name "*.png" -o -name "*.jpg" -o -name "*.gif" | xargs -I {} mv {} images/
find . -maxdepth 1 -name "*.md" -o -name "*.txt" -o -name "*.pdf" | xargs -I {} mv {} docs/
find . -maxdepth 1 -name "*.py" -o -name "*.js" -o -name "*.ts" | xargs -I {} mv {} code/

From references/patterns.md:143-148:

bash

# Always preview first
echo "Would move these files:"
find . -name "*.txt"
# Review output, then execute
find . -name "*.txt" -exec mv {} dest/ \;

Technical Analysis

The recipes use multiple find predicates without grouping them as \( ... -o ... \). In find, logical operators have precedence rules; therefore, constraints such as -maxdepth are not clearly and consistently applied to the full intended expression. The commands also omit -type f, allowing matching directories or other filesystem objects to be selected.

The commands in SKILL.md and the dry-run example recurse through the complete tree. They do not prune destination directories, so files already present under images/, docs/, code/, or dest/ can be rediscovered. None of the examples checks whether a destination filename already exists before calling mv.

The xargs pipelines are line-oriented rather than NUL-delimited. Filenames containing newline characters cannot be represented safely by this interface ...[truncated 1651 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict selection to regular files and group alternative predicates explicitly:

  bash

  find "$validated_root" -maxdepth 1 -type f \
    \( -name '*.png' -o -name '*.jpg' -o -name '*.gif' \) -print0
  

• Use NUL-delimited processing with -print0 and xargs -0, or use a carefully quoted loop that reads with read -r -d ''.
• Prune all destination directories from recursive searches.
• Resolve and validate source and destination paths so both remain inside the approved workspace.
• Generate and display exact source-to-destination mappings during the dry run, rather than displaying source files alone.
• Detect duplicate basenames and existing destination files before execution.
• Use no-clobber moves such as mv -n where supported, or abort on every collision.
• Require explicit approval after the complete dry-run mapping has been reviewed.
• Add tests covering spaces, newlines, leading hyphens, symbolic links, nested destinations, duplicate basenames, and empty input sets.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/patterns.md (reported line 124)May include surrounding context.

md

cat > .gitignore << EOF
node_modules/
dist/
.env
*.log
.DS_Store
EOF

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The command find . -type f -empty -delete permanently deletes files and is presented without an adjacent caution, preview step, or safer dry-run alternative. In a file-organization skill, users may run snippets verbatim in the wrong directory or on unintended paths, causing irreversible data loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.