Audit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:04 PM UTC
• Version: 1.4.1

Overview

This skill is mostly a normal knowledge-base audit helper, but it tells the agent to run any project-provided link-checking script without review or user approval.

Install only if you are comfortable with the agent potentially running link-checking scripts from the repository being audited. For untrusted or shared repositories, ask the agent to inspect any script first and get your explicit approval before running it, or disable Bash/script execution for this skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:35

Finding

Unreviewed Execution of Project-Controlled Link-Checking Scripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10 and 35
Vulnerability Type: Unsafe execution of untrusted repository scripts
Risk Level: High

Vulnerable Code

yaml

allowed-tools: Read, Grep, Bash, Glob, mcp__solograph__kb_search

markdown

- If a link-checking script exists in the project (e.g., `scripts/check_links.py`), run it as well

Technical Analysis

The skill instructs the agent to execute a link-checking script supplied by the project being audited. It does not require the script to be inspected, verified, sandboxed, or explicitly approved by the user before execution. Because the skill also grants access to Bash, a repository-controlled script can execute arbitrary operating-system commands with the permissions available to the agent process.

The advertised knowledge-base audit can be performed through read-only operations such as Read, Grep, and Glob. Executing arbitrary project code is therefore unnecessary and violates least-privilege principles. The risk applies even if the script is named like a legitimate link checker, because its filename does not constrain its actual behavior.

Attack Path

1. An attacker creates or modifies a knowledge-base repository.
2. The attacker places malicious code in a plausible file such as scripts/check_links.py.
3. The victim requests a knowledge-base audit using this skill.
4. The skill discovers the purported link-checking script and directs the agent to run it through Bash.
5. The malicious script executes with the agent process's local permissions.
6. Depending on the environment's access controls, the script can read accessible secrets, modify project or user files, invoke installed tools, contact external systems, or establish additional execution mechanisms.

Impact Assessment

Successful exploitation provides arbitrary command execution within the privilege scope of the agent process. Potential consequences include:

• Reading credentials, ...[truncated 608 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to execute repository-provided link-checking scripts automatically.
2. Implement internal-link validation using read-only operations such as Read, Grep, and Glob.
3. Remove Bash from allowed-tools if no remaining audit operation requires shell execution.
4. If execution is genuinely necessary, first display the exact script path and request explicit informed user approval.
5. Inspect the entire script and any imported local modules before execution; do not rely on its filename or location as evidence of safety.
6. Run approved scripts in a sandbox with:
   • Read-only access to the audited repository.
   • No access to user credentials or unrelated filesystem paths.
   • Network access disabled by default.
   • Resource and execution-time limits.
   • A disposable working directory.
7. Prefer a trusted, bundled link parser with a pinned and reviewed implementation rather than executing code supplied by the target repository.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.