Disk Sweeper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

This disk cleanup skill is mostly purpose-aligned, but its safety guarantees are not reliably enforced before scanning, hashing, or deleting files.

Review this skill carefully before installing. Use preview-only behavior unless you have inspected the paths yourself, avoid running it with elevated privileges, and do not rely on its protected-path or no-content-reading claims as written.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/scanner.py:58

Finding

Protected-Path Scan Restrictions Can Be Bypassed with Direct Files and Symbolic Links

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cleaner.py:103

Finding

Cleanup Executor Trusts Caller-Controlled Safety Labels for Destructive Operations

Content

View full analysis

CleanupResult: """Execute cleanup on the given items. Returns CleanupResult tracking what was done. """ result = CleanupResult() for i, item in enumerate(items): path = item.get("path", "") size = item.get("size", 0) safety = item.get("safety", "UNKNOWN") if progress_callback: progress_callback(i + 1, len(items), path) if safety == "PROTECTED": result.add_error(path, "PROTECTED - cannot delete") continue if not os.path.exists(path): result.add_error(path, "Path does not exist") continue if dry_run: result.add_success(path, size, use_trash) continue if use_trash: if move_to_trash(path): result.add_success(path, size, True) else: result.add_error(path, "Failed to move to trash") else: if permanently_delete(path): result.add_success(path, size, False) else: result.add_error(path, "Failed to delete") return result ``` A verification function exists but is not invoked by the cleanup executor: ```python def verify_path_is_safe_to_clean(path: str) -> bool: """Double-check that a path is safe to clean before deletion.""" level, _ = grade_path(path) if level == PROTECTED: return False if not os.path.exists(path): return False return True ``` ### Technical Analysis `execute_cleanup()` treats the `safety` value in each caller-provided dictionary as authoritative. It blocks an ...[truncated 2193 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/duplicates.py:30

Finding

Duplicate Detection Reads Complete File Contents Despite a No-Content-Reading Guarantee

Content

View full analysis

Optional[str]: """Phase 2: Hash first 4KB of a file.""" try: with open(filepath, "rb") as f: head = f.read(bytes_to_read) return hashlib.sha256(head).hexdigest() except (OSError, PermissionError): return None def hash_full(filepath: str) -> Optional[str]: """Phase 3: Full file SHA-256 hash (streaming).""" try: h = hashlib.sha256() with open(filepath, "rb") as f: while True: chunk = f.read(CHUNK_SIZE) if not chunk: break h.update(chunk) return h.hexdigest() except (OSError, PermissionError): return None ``` The security documentation states: ```markdown - **No content reading**: Only filename/size/hash, never file content ``` ### Technical Analysis Computing a cryptographic hash requires reading file content. The implementation first reads the initial 4 KB and then reads the complete contents of every candidate that survives the initial filters. No network transmission or raw-content retention was identified. Nevertheless, the stated privacy boundary is inaccurate: candidate contents are accessed in full, and stable SHA-256 fingerprints are returned in duplicate-group results. This issue becomes more significant when combined with the scanner's protected-path and symbolic-link bypass. A protected or out-of-scope target accepted by the scanner can subsequently be opened and read by `hash_head()` and `hash_full()`. ### Attack Path 1. Include a sensitive file in the scanner output, directly or through a symbolic link. 2. Ensure another candidat ...[truncated 1004 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If behavior is limited to generic file scanning while marketed as intelligent cleanup with app-specific recognition and safety controls, the skill can drive poor operator decisions based on incomplete understanding. In a disk cleanup context, even benign overstatement is dangerous because it affects what users decide to remove or trust the tool to protect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If behavior is limited to generic file scanning while marketed as intelligent cleanup with app-specific recognition and safety controls, the skill can drive poor operator decisions based on incomplete understanding. In a disk cleanup context, even benign overstatement is dangerous because it affects what users decide to remove or trust the tool to protect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

If behavior is limited to generic file scanning while marketed as intelligent cleanup with app-specific recognition and safety controls, the skill can drive poor operator decisions based on incomplete understanding. In a disk cleanup context, even benign overstatement is dangerous because it affects what users decide to remove or trust the tool to protect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If behavior is limited to generic file scanning while marketed as intelligent cleanup with app-specific recognition and safety controls, the skill can drive poor operator decisions based on incomplete understanding. In a disk cleanup context, even benign overstatement is dangerous because it affects what users decide to remove or trust the tool to protect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If behavior is limited to generic file scanning while marketed as intelligent cleanup with app-specific recognition and safety controls, the skill can drive poor operator decisions based on incomplete understanding. In a disk cleanup context, even benign overstatement is dangerous because it affects what users decide to remove or trust the tool to protect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If behavior is limited to generic file scanning while marketed as intelligent cleanup with app-specific recognition and safety controls, the skill can drive poor operator decisions based on incomplete understanding. In a disk cleanup context, even benign overstatement is dangerous because it affects what users decide to remove or trust the tool to protect.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises filesystem scanning and cleanup behavior but does not declare any explicit tool scope such as permissions or allowed-tools. For a skill that implies file access and possible shell execution, missing capability boundaries increases the chance of over-broad host access, unsafe agent behavior, and accidental destructive actions beyond what users expect.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Selecting an external model/provider can introduce data governance and supply-chain risk, particularly for a skill that may analyze local filesystem metadata and potentially sensitive filenames or paths. Even if the skill claims zero network behavior, declaring an external model dependency creates ambiguity about whether data could be sent to a third-party provider.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- disk-analysis
  - system-tool
  - utility
model: deepseek
created_at: 2026-06-14
---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring explicitly frames the skill as "Chinese app cache recognition," which imposes a language/locale-specific scope in natural language without indicating user choice or a documented regional justification. The policy requires flagging language or locale constraints when they are forced rather than offered as an opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cleaner.py (reported line 20)May include surrounding context.

python

"""
    try:
        # Try macOS `trash` command first
        subprocess.run(["trash", path], check=True, capture_output=True)
        return True
    except (FileNotFoundError, subprocess.CalledProcessError):
        pass

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description advertises 'Chinese app cache recognition,' which encodes a locale-specific focus in the skill's behavior. The file does not state that this is optional, user-selected, or required for a region-specific compliance purpose, so it may conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment says hidden directories are skipped unless explicitly scanned, but the code returns False for hidden directories, meaning they are not skipped at all. This is a direct contradiction between inline intent documentation and actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.