Security audit

Diff Wizard

Security checks for vulnerabilities and agentic risk

Overview

This diff tool is mostly purpose-aligned, but it makes stronger safety claims than the code enforces when reading directories, sensitive files, and output paths.

Review this skill before installing. Use it only on files and directories you intentionally choose, avoid secret-bearing paths such as .env, keys, and credentials, and do not rely on its documented path restriction, sensitive-file confirmation, or terminal escape filtering until those controls are actually enforced. Treat generated reports or merge outputs as potentially containing sensitive diff content.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/diff-engine.js:163
Finding: Sensitive files are read and processed without the documented confirmation
Content: View full analysis
0 ? sensitiveFiles : undefined, format_detected: result.format_detected || resultA.format || 'text', }; } ``` Directory mode automatically submits every common readable file for comparison: ```js for (const relPath of allFiles) { const hasA = mapA.has(relPath); const hasB = mapB.has(relPath); if (!hasA && hasB) { added.push(relPath); } else if (hasA && !hasB) { deleted.push(relPath); } else { // Both exist — compare them const pathA ...[truncated 2693 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/diff-wizard.js:192
Finding: Working-directory path restrictions are defined but never enforced
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/output-renderer.js:119
Finding: Untrusted file content is rendered to terminals without escape-sequence sanitization
Content: View full analysis
>>>>>> theirs')}\n`; if (conflict.ai_suggestion) { output += ` ${c(colors.cyan, '🤖 AI suggestion:')} ${conflict.ai_suggestion}\n`; } output += '\n'; } ``` A sanitizer is defined but never used by the terminal renderer: ```js function sanitizeTerminal(content) { if (!content) return ''; // Only all ...[truncated 2435 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code chunk is narrowly focused on CSV/TSV parsing and two-way row/column diffing. It detects TSV, parses CSV or TSV, and compares two tabular datasets, returning added/deleted/modified rows/cells plus stats. The declared description is substantially broader, claiming a general smart text comparison tool with format-aware diffing across multiple formats, AI explanation, and 3-way merge. None of those broader capabilities are evidenced in this code chunk. While CSV support aligns partially with the description, the actual code does not match the claimed overall scope and key features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code generally aligns with a format-aware diff engine, but the declared description overstates functionality in several material ways. It does support auto-detection and comparison for JSON, CSV/TSV, and generic text/code-like formats, so the core diffing purpose is accurate. However, this chunk does not implement any AI explanation or 3-way merge behavior. Additionally, support for YAML, code, TOML, XML, and HTML is not truly format-specific here; those formats are routed to a generic text diff. The code also reads files from disk via compareFiles/readAndDetect and inspects file sensitivity, which is a resource-accessing capability not reflected in the declared permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a text comparison tool focused on format-aware diffing, AI explanations, and 3-way merge across multiple content types. The supplied code chunk instead implements a directory scanner and directory comparison orchestrator. It traverses directories, applies exclusion patterns, skips symlinks, checks file readability, maps relative paths, and invokes a file diff engine for matching files. This is a materially different and broader behavior than a simple smart text comparison tool because it adds undeclared filesystem directory enumeration and batch comparison capabilities. Also, the advertised AI explanation and 3-way merge features are not implemented or evidenced in this code chunk. While use of a diff engine and format detector suggests the broader skill may do file comparisons, this specific code does not accurately match the declared feature set.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a full text comparison/diff tool with AI explanation and 3-way merge across multiple structured/plain-text formats. The supplied code does not implement comparison, diffing, merge, or any AI behavior. Instead, it is a helper module for identifying file formats, reading file contents from disk, and detecting binary files. Format-awareness is consistent as a supporting component, but the primary purpose of this chunk is materially narrower and different from the declared end-user functionality. Additionally, the code accesses local files via fs despite no declared permissions, which is an undeclared capability/resource access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code is narrowly scoped to JSON structured comparison. It parses JSON, recursively compares values, handles arrays/objects/primitives, and returns structured changes and stats. There is no evidence of AI-based explanation, 3-way merge logic, or support for YAML, CSV, source code, or plain text formats in this chunk. Because the declared description presents a broader multi-format diff tool with additional major features, while the actual code only provides JSON diffing, the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk is a narrow plain-text diff library. It splits input into lines, computes a line-based edit script with Myers diff, builds unified diff hunks, and returns stats. While this is consistent with a basic text comparison component, it does not implement the broader declared functionality of a smart comparison tool covering structured formats, AI-generated explanations, or 3-way merge. No suspicious undeclared resource access or triggers are present; the mismatch is that the declared feature set materially exceeds the actual behavior shown.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
📁 Comparing ./env/dev/ ↔ ./env/staging/ (recursive) 🔴 Only in dev/: local-overrides.yaml 🟢 Only in staging/: production-secrets.yaml 🟡 Modified: config.yaml (12 changes) 🟡 Modified: docker-compose.yaml (3 changes) ✅ Unchanged: 47 files

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/lib/ai-explainer.js (reported line 98)May include surrounding context.
js
'[Analysis]', ].join('\n'); return prompt; } /**

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/lib/format-detector.js (reported line 55)May include surrounding context.
js
'.conf': 'text', '.ini': 'text', '.properties': 'text', '.env': 'text', '.gitignore': 'text', '.dockerfile': 'text', 'dockerfile': 'text',

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/lib/security.js (reported line 26)May include surrounding context.
js
/shadow/i, /tokens?\b/i, /\.htpasswd$/i, /\.netrc$/i, ]; // Credential patterns to redact in AI explanation content

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill advertises AI explanation features that imply external model access, yet the manifest declares no explicit tool scope or permissions. This creates a trust and governance gap: operators cannot reliably enforce or review whether network access is intended, which can lead to unapproved data egress when users compare sensitive files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation makes mutually inconsistent privacy claims: it says processing is local and no external content sharing occurs, while also stating that diff hunks are sent to an LLM. For a diff tool likely to process secrets, configs, and source code, this misrepresentation can cause users to expose sensitive data under false assumptions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Claiming that raw file content is never sent externally while diff hunks are sent to an LLM is materially misleading, because diff hunks can still contain secrets, proprietary code, and credentials. Users may rely on the safety section when comparing confidential files, creating a realistic risk of unintended data leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: AI explanation is enabled by default, and the tool processes local files and pasted content that may contain secrets, proprietary code, or personal data. If aiExplainer sends this content to an external model or service, users may unknowingly exfiltrate sensitive material because there is no clear warning, consent gate, or privacy disclosure at the point of use.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest emphasizes text comparison, AI explanation, and 3-way merge, which are primarily analytical/display functions. This code persists rendered output to an arbitrary file path, introducing file-modification behavior not stated in the description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: While '3-way merge' implies producing merged content, the manifest does not say the skill writes merged results back to the filesystem. The implementation performs a write operation to a chosen path or default file, which is a broader behavior than a purely comparison-oriented diff tool suggests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This module prepares diff content for AI transmission and returns the redacted prompt without any user-facing consent or warning at the disclosure point. Even though it only sends diff hunks and applies credential redaction, diffs can still contain proprietary code, personal data, secrets not caught by redaction, or sensitive business context, making unintended data exfiltration to an LLM plausible.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The generated user-facing explanation states that 'Semantic code diff' is enabled and that whitespace-only and comment changes are filtered, but this module does not perform or verify that filtering before making the claim. Since the surrounding documentation presents this function as generating explanations from diff results, this is an active contradiction between the explanatory text and what the code here actually does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The banner line hard-codes Chinese text in the primary CLI help display, while the rest of the tool is otherwise English-oriented and no language preference is requested from the user. This can violate language/locale policy when a skill forces a specific language presentation without opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The code directs the assistant to auto-detect response language from content when no language is specified. This can force a locale/language choice implicitly rather than offering an explicit user opt-in or neutral default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The branch condition checks that 'theirs' has added lines while 'ours' remains at base length, but the returned guidance says 'Theirs added lines while theirs kept the base.' This is an active contradiction in the inline guidance and could mislead consumers of the merge suggestion output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.