Security audit

Cn Batch File Renamer

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local batch file renamer, but its pattern handling can move or rename files outside the intended scope.

Install only if you are comfortable with a local script that can rename files in place. Use dry-run first, run it only on disposable or backed-up directories, and avoid prefixes or suffixes containing slashes, backslashes, absolute paths, or '..' until the implementation validates names and confines output to the selected directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/batch_rename.py:8
Finding: Destination Path Traversal Through Unsanitized Rename Patterns
Content: View full analysis
/../outside/001.txt ``` An absolute prefix can cause `os.path.join()` to discard the supplied base directory entirely. Consequently, the destination is not guaranteed to remain beneath `args.dir`. The vulnerability does not grant additional operating-system privileges. However, it allows the process to move affected entries to any destination writable by the user running the script. ### Attack Path 1. An attacker controls or influences the command-line arguments used to invoke the renamer. 2. The attacker supplies a traversal-bearing or absolute prefix, such as `--prefix ../outside/`. 3. The script enumerates entries in the selected source directory. 4. It constructs destination paths without canonicalization or containment validation. 5. When run without `--dry-run`, `os.rename()` moves entries outside the selected directory. 6. The ...[truncated 543 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/batch_rename.py:19
Finding: Race Condition in the No-Overwrite Protection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/batch_rename.py:12
Finding: Batch Operation Renames Directories and Other Non-File Entries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
## Notes - Preserves file extensions - Does not overwrite existing files - Use --dry-run first to preview changes ## Exit Codes

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes and invokes a script that reads and renames files, but the manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch can cause consumers or enforcement layers to underestimate the file system access the skill requires, increasing the chance of unintended file modification when the skill is installed or reviewed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code performs in-place filesystem changes by renaming files when --dry-run is not set, but it provides no confirmation prompt, warning message, or explanatory comment about the destructive nature of the operation. Although renaming is the stated function of the script, the file itself lacks any user-facing disclosure that real changes will occur by default unless dry-run is used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown is primarily in English, but the closing promotional section switches to Chinese-only text and links without indicating that the skill is region-specific or giving the user a language option. This can violate language/locale policy expectations because it forces a specific language for part of the user-facing content without opt-in.
Content: No source excerpt is available for this finding.