Security audit

Backup Rotator

Security checks for vulnerabilities and agentic risk

Overview

This backup skill appears purpose-built rather than malicious, but its automatic deletion and weak verification could cause users to lose or trust bad backups.

Review before installing. Use only on dedicated backup directories, run dry-run first, avoid shared destinations, do not rely on its verify command as proof that backups are intact, and be especially careful with cron because it can permanently delete backup files unattended.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup_rotator.py:120
Finding: Tar Option Injection Through an Attacker-Controlled Source Directory Name
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backup_rotator.py:70
Finding: Incorrect Retention Classification and Overly Broad File Matching Can Delete Unintended Backups
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backup_rotator.py:272
Finding: Checksum Verification Does Not Compare Against a Trusted Integrity Baseline
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior overstates safety and correctness: 'verify' only prints hashes instead of validating against a trusted manifest, and some backup forms may not be discovered or rotated as claimed. This can create a false sense of protection, causing operators to believe backups are intact and governed by retention policy when they may be silently excluded or unverifiable.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises and instructs use of a script that writes backup files and deletes old ones, yet the skill metadata does not declare any tool scope or permission boundaries. In an agent setting, missing explicit permissions increases the chance of over-broad file access or shell use without adequate review, especially because backup and rotation operations are inherently destructive and touch arbitrary paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill describes automated rotation and deletion of old backups without an explicit warning about irreversible data loss from misconfigured retention values, prefixes, or target directories. In backup tooling, destructive actions are especially sensitive because mistakes can remove the very recovery data users depend on.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/backup_rotator.py (reported line 120)May include surrounding context.
python
# Compress directory to tar.gz backup_path = backup_dir / f"{src_name}_{ts}.tar.gz" print(f" Compressing {source} → {backup_path} ...") result = subprocess.run( ["tar", "-czf", str(backup_path), "-C", str(source.parent), source.name], capture_output=True, text=True )

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises backup integrity verification with SHA256, but the implementation only computes and prints hashes of current files; it does not compare them to a previously trusted checksum, verify signatures, or validate archive contents. This can mislead users into believing backups are verified and trustworthy when corruption or tampering would go undetected unless manually noticed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The tool deletes files automatically during rotation without an explicit confirmation barrier or stronger safety guardrails. In the context of a backup-management skill, destructive behavior is expected, but a misconfigured backup name, directory, or retention policy could cause unintended deletion of backup data and reduce recovery capability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.