Security audit

Test Patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent testing-guidance skill, but users should pin tools and avoid copying the unsafe Bash eval and temporary-file examples as-is.

Install only if you want general test-pattern guidance. Treat its package install commands as examples, pin versions or use existing lockfiles, and do not copy the Bash eval helper or tempfile.mktemp fixture into security-sensitive repositories without rewriting them safely.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:453
Finding: Arbitrary Shell Command Execution Through eval-Based Test Helper
Content: View full analysis
/dev/null 2>&1 assert_eq "$?" "$expected" "$label" } ``` ### Technical Analysis The helper accepts a command as a string and passes it to Bash's `eval` builtin. `eval` reparses its argument as shell source code rather than treating it as a fixed executable and argument list. Consequently, shell metacharacters, command substitutions, redirections, variable expansions, pipelines, and command separators embedded in `cmd` are interpreted as executable syntax. Quoting `"$cmd"` when passing it to `eval` does not prevent this second parsing stage. The examples currently pass fixed strings, but the helper is presented as a reusable test pattern. It becomes directly exploitable if a test constructs the command from user input, fixture content, repository-controlled metadata, filenames, environment variables, or other untrusted data. ### Attack Path 1. A test author reuses `assert_exit_code` and includes attacker-controlled content in its first argument. 2. The attacker supplies shell syntax such as a command separator or command substitution through that content. 3. `local cmd="$1"` stores the malicious string without neutralizing its shell syntax. 4. `eval "$cmd"` reparses the entire string as Bash code. 5. The injected command executes before the exit code is checked. 6. Output is redirected to `/dev/null`, which can conceal visible evidence of exploitation. For example, if an untrusted value is concatenated into a command string, a value containing `; ` would cause the added command to be evaluated rather than passed as ordinary data. ### Impact Assessment Exploitation permits arbitrary command execution with the privileges of the test runner. In a developer environment, this can expose or modi ...[truncated 342 chars]
Remediation: View remediation
/dev/null 2>&1 local actual=$? assert_eq "$actual" "$expected" "$label" } assert_exit_code "0" "help flag exits 0" ./my-script.sh --help ``` Additional hardening measures: - Never construct executable command strings by concatenating untrusted values. - Pass untrusted values only as quoted arguments to a fixed executable. - If only a small set of programs is required, enforce an explicit executable allowlist. - Use shell static-analysis tooling such as ShellCheck. - Run tests under a least-privileged account in an isolated environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:238
Finding: Predictable Temporary-File Race Caused by tempfile.mktemp
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.