Security audit

Acorn Prover

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Acorn proof work, but its setup flow can turn user-supplied path values into executable shell code when the generated config file is sourced.

Review before installing. Use only trusted, ordinary local paths for ACORN_LIB and ACORN_PROJECT, avoid paths containing shell metacharacters or newlines, and inspect config.env before it is sourced. A safer version should quote or data-encode configuration values and avoid sourcing user-influenced files as shell code.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:37
Finding: Arbitrary Shell Command Execution Through Unsafely Generated Configuration
Content: View full analysis
"$CONFIG_FILE" <
Remediation: View remediation
"$CONFIG_FILE" ``` 2. Reject control characters, particularly carriage returns and newlines, before writing values: ```bash if [[ "$ACORN_LIB" == *$'\n'* || "$ACORN_LIB" == *$'\r'* || "$ACORN_PROJECT" == *$'\n'* || "$ACORN_PROJECT" == *$'\r'* ]]; then echo "Error: Paths must not contain newline characters." >&2 exit 1 fi ``` 3. Canonicalize and revalidate both paths with an appropriate mechanism such as `realpath`, while preserving strict quoting. 4. Write the configuration atomically with restrictive permissions, such as mode `0600`, to reduce local tampering risks. 5. Do not use `source` for attacker-influenced files. If possible, read expected keys as data and reject unknown or duplicate entries. 6. Add regression tests covering spaces, quotes, semicolons, command substitutions, backslashes, and newline characters in path arguments. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.