T09 · Insecure Skill Coding Practices
Error
- Location
deploy.js:71- Finding
PowerShell Command Injection Through Unsafely Interpolated Deployment Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Node Transfer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real node-to-node file transfer tool, but its remote deployment, integrity check, and plaintext transfer design have safety issues that need review before use.
Install only in trusted, controlled node environments. Avoid using it for sensitive files over untrusted networks, restrict sender exposure with firewall or interface controls, validate source and destination paths, and treat deploy.js and ensure-installed.js as privileged operations until the PowerShell quoting and executable manifest issues are fixed.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T07 · Tool Hijacking and Spoofing
Error
- Location
ensure-installed.js:86- Finding
Integrity Checker Executes an Untrusted Version Manifest
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
send.js:275- Finding
Unauthenticated Plaintext File Transfer Allows Token Disclosure and Content Substitution
- Content
View full analysis
{ const address = server.address(); const port = address.port; // Get network interfaces const interfaces = os.networkInterfaces(); let ip = '127.0.0.1'; // Find first non-internal IPv4 address for (const name of Object.keys(interfaces)) { for (const iface of interfaces[name]) { if (iface.family === 'IPv4' && !iface.internal) { ip = iface.address; break; } } if (ip !== '127.0.0.1') break; } const url = `http://${ip}:${port}/transfer`; ``` The receiver places the bearer token in the query string and permits plaintext HTTP: ```javascript // Build full URL with token const fullUrl = `${args.url}?token=${encodeURIComponent(args.token)}`; // Choose http or https module const client = parsedUrl.protocol === 'https:' ? https : http; ``` Transfer integrity is checked only by comparing the received byte count to the peer-provided content length: ```javascript writeStream.on('finish', () => { const duration = (Date.now() - startTime) / 1000; const speed = receivedBytes / duration / 1024 / 1024; // MB/s // Verify received bytes match expected if (totalBytes > 0 && receivedBytes !== totalBytes) { logError('SIZE_MISMATCH', `Received ${receivedBytes} bytes, expected ${totalBytes}`); cleanupAndExit(1); return; } const output = { success: true, bytesReceived: receivedBytes, totalBytes: totalBytes || receivedBytes, duration: Math.round(duration ...[truncated 2359 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Sender** (`send.js`):
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Sender** (`send.js`):
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Sender** (`send.js`):
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **Receiver** (`receive.js`):
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **Receiver** (`receive.js`):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The API examples and problem statement discuss transferring files but do not clearly warn that the destination path will be written and may overwrite existing data. In practice, file-transfer primitives that omit overwrite/creation semantics can lead to unintended data loss or destructive writes when used by agents or automation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Auto-deployment on first use is an autonomous action that causes code to be installed on remote nodes without a clear interactive authorization step. In security-sensitive infrastructure, this behavior can bypass normal approval workflows and make accidental or unauthorized lateral changes easier.
- Content
Implementation:
- Include
send.js,receive.js,ensure-installed.jsin core resources - Add
nodes.transfer()method to SDK - Auto-deploy scripts on first transfer attempt
- Cache installation status in node metadata
javascript - Include
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The proposal explicitly recommends auto-deploying helper scripts to remote nodes on first transfer attempt, which changes remote systems without an explicit consent or warning boundary. In an agent environment, silent deployment expands the blast radius of a single transfer request and can violate operator expectations, change-management controls, or node-hardening policies.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Describing scripts as 'auto-deployed' normalizes autonomous remote modification as part of the feature design. In the context of an agent skill, that increases risk because the feature can initiate software placement on additional systems beyond the user's immediate intent of moving a file.
- Content
md **Pros:** - Core knows about transfers - Scripts auto-deployed - Clean API for users ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The migration plan includes auto-deployment on first use, which preserves a pattern of autonomous remote changes as the system evolves. This is dangerous because it embeds remote installation into routine file-transfer operations, making privilege misuse or accidental deployment more likely at scale.
- Content
md 1. Add `nodes.transfer()` to SDK (wrapper around skill) 2. Include scripts in core distribution 3. Auto-deployment on first use 4. Deprecate manual installation ### Phase 3: Native Protocol
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The recommendation endorses auto-deployment of helper scripts as the preferred integration path, reinforcing unattended remote code placement as a standard workflow. In an agent-driven environment, that can facilitate broader unintended system modification and weakens the principle of least surprise for operators.
- Content
md 3. **Performance**: 100x+ improvement over current methods 4. **Safety**: Token-based security, automatic cleanup **Recommendation:** Integrate as `nodes.transfer()` with auto-deployment of helper scripts, planning for native protocol implementation in future releases. ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The report explicitly instructs operators to run PowerShell with
-ExecutionPolicy Bypass, including sending the script body for remote execution vianodes.invoke. Even though this is documentation rather than executable code, it normalizes disabling a Windows safety control and provides no warning, signature verification, or trust validation for the deployed script, which increases the chance that tampered or incorrect content will be executed remotely.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file documents deploying scripts to a node and transferring files between nodes, including writing to a destination path. While these actions are the skill's purpose, the README does not include any explicit warning about network data transmission, destination-file overwrite risk, or operational impact on target nodes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly shows
receive.jswriting attacker- or operator-specified data to an arbitraryoutputPath, but it does not clearly warn that this path can target sensitive filesystem locations or overwrite existing files depending on implementation and privileges. In an agent/node environment, users may copy-paste examples into automation, so missing safety guidance increases the chance of unintended file placement, destructive overwrites, or persistence via dropped files in privileged locations.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script calls require(versionPath) on a file located inside a user-supplied target directory, which executes arbitrary JavaScript from that directory during what is documented as a simple installation check. This creates a code-execution primitive if an attacker can control or influence the target directory contents, and the understated documentation increases the chance that operators will run it in unsafe contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example invokes a receiver that writes transferred data directly to a caller-supplied destination path with no validation, overwrite confirmation, or safety guardrails shown in this workflow. In an agent context, this can lead to unintended file overwrite or modification of sensitive paths if the destination path is wrong, attacker-influenced, or resolves to an important file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The package metadata presents the skill as only providing file transfer functionality, but the published file list includes installation and deployment-related scripts such as ensure-installed.js and deploy.js. This scope mismatch can mislead reviewers and users about the package's real capabilities, increasing supply-chain risk because higher-impact behaviors may be overlooked or implicitly trusted during installation or use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script binds an HTTP file server to 0.0.0.0 and prints a usable URL and bearer-style token, which makes the file reachable from any network that can access the host. While the random token provides access control, there is no explicit warning, interface restriction, TLS, or narrowing of allowed clients, so sensitive local files could be exposed unintentionally or intercepted on untrusted networks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The natural-language content and examples center on Windows-specific conventions, including explicit acknowledgment that deployment currently uses PowerShell. Because the document does not clearly frame this as an intentionally Windows-only or region-specific tool, it risks an unjustified platform/locale constraint.
- Content
Static analysis
No suspicious patterns detected.