Little Steve Content Inbox

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:04 AM UTC
• Version: 0.1.5

Overview

This skill is a local content inbox that stores and manages user-saved links, notes, and image paths in its own data files, with no evidence of hidden network access, credential use, privilege escalation, or deceptive behavior.

Before installing, understand that saved inbox content is stored locally in the skill's data files and delete commands remove records without an undo or confirmation prompt. Avoid saving secrets or highly sensitive notes unless that local storage model is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/inbox.sh:178
• Finding: Predictable Temporary File Enables Symlink Overwrite and Concurrent Data Corruption## Vulnerability Details **File Location**: `scripts/inbox.sh:178`, `scripts/inbox.sh:296`, and `scripts/inbox.sh:317` **Vulnerability Type**: Predictable temporary file, symlink following, and missing update locking **Risk Level**: Low ### Vulnerable Code ```bash # scripts/inbox.sh:178 ' "$DB" > "$DB.tmp" && mv "$DB.tmp" "$DB" # scripts/inbox.sh:296 ' "$DB" > "$DB.tmp" && mv "$DB.tmp" "$DB" # scripts/inbox.sh:317 jq --argjson id "$id" '.items |= map(select(.id != $id))' "$DB" > "$DB.tmp" && mv "$DB.tmp" "$DB" ``` The same fixed temporary path, `data/items.json.tmp`, is used by the `add`, `status`, and `delete` operations. ### Technical Analysis Shell redirection opens the predictable `"$DB.tmp"` path before `jq` runs. The script does not create the temporary file exclusively, verify that it is a regular file, reject symbolic links, or hold a lock over the read-modify-write transaction. A local process with write access to the Skill's data directory can pre-create `items.json.tmp` as a symbolic link. The redirection may then follow that link and overwrite a target file writable by the account running the Skill. Concurrent legitimate invocations also share the same temporary file and read the database independently. Their writes can interfere with one another, producing lost updates, failed moves, or corrupted archive state. ### Attack Path 1. An attacker obtains local write access to the project's `data` directory. 2. The attacker creates the predictable path as a symbolic link: ```bash ln -s /path/to/user-writable-target data/items.json.tmp ``` 3. The victim invokes an operation that modifies the database: ```bash bash scripts/inbox.sh add --type note --title "Example" --content "Example" ``` 4. Shell redirection follows the symbolic link and writes generated JSON to the linked target. 5. The subsequent `mv` may fail or alter database state, depending on the filesystem and path state. Alternatively, two simultaneous `add`, `status ...[truncated 665 chars]
• Remediation: ## Remediation Suggestions - Create a unique temporary file in the database directory using `mktemp`: ```bash tmp_file="$(mktemp "$BASE_DIR/data/.items.json.XXXXXX")" ``` - Register a cleanup trap immediately: ```bash trap 'rm -f -- "$tmp_file"' EXIT ``` - Serialize the complete read-modify-write transaction with `flock` or an equivalent locking mechanism. - Write the transformed JSON to the unique file, verify it with `jq -e`, set restrictive permissions, and atomically rename it over the database: ```bash jq '...' "$DB" > "$tmp_file" jq -e . "$tmp_file" >/dev/null chmod 600 "$tmp_file" mv -f -- "$tmp_file" "$DB" trap - EXIT ``` - Ensure the `data` directory is not writable by untrusted users and has restrictive ownership and permissions. - Apply the same safe update helper consistently to the `add`, `status`, and `delete` operations.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script maps a simple natural-language command like '删除 #3' or 'delete #3' directly to an inbox deletion action with no confirmation, dry-run, or undo step visible in this file. In a chat-style interface, terse commands are easy to issue accidentally or trigger through misunderstanding, which can cause unintended data loss.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat > "$DB" <<JSON
{"items":[],"nextId":1}
JSON
    chmod 600 "$DB"
  fi
  if [[ ! -f "$VIEW_STATE" ]]; then
    cat > "$VIEW_STATE" <<JSON

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat > "$DB" <<JSON
{"items":[],"nextId":1}
JSON
    chmod 600 "$DB"
  fi
  if [[ ! -f "$VIEW_STATE" ]]; then
    cat > "$VIEW_STATE" <<JSON

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The delete command permanently removes an item from the JSON database and only prints a message after the operation completes. There is no confirmation prompt, pre-action warning, or descriptive comment/docstring disclosing that this is an irreversible data-deletion action.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: This markdown file includes a destructive operation (`delete --id 1`) but does not provide any caution about data removal, recoverability, or confirmation behavior. Under the markdown-specific missing-warning criterion, user-facing documentation should warn when actions may affect user data or be irreversible.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: The line `输入"更多"翻页` describes pagination using a Chinese-language command, which can imply a language-specific interaction pattern. Because the policy requires avoiding forced language/locale behavior without opt-in or justification, this should be documented as language-specific or accompanied by alternatives.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: This JSON file contains Chinese-language note content at L156-L157, while the rest of the dataset is primarily English-like identifiers and URLs. Under the stated policy, forcing or introducing a specific language without user choice or documented justification can be a locale-policy issue, and this file provides no such opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The usage text presents a mixed but fixed set of supported commands, including Chinese-first examples such as `未读列表` and `收录`, without any natural-language indication that users may choose their preferred language or locale. Under the policy, forcing a specific language or locale without explicit opt-in can be a natural-language policy concern.

Static analysis

No suspicious patterns detected.