Share One-Time Link

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.2.0

Overview

The skill is a real public file-sharing tool, but it has implementation flaws that could expose or substitute shared files, so users should review it carefully before installing.

Install only if you are comfortable running a public file-sharing server. Use a strong SHARE_SECRET, avoid query-string secrets, confirm every file before sharing, do not place sensitive files in the shared directory unless intended, and fix the filename-collision and TTL-validation issues before relying on it for important files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/share-file.js:25

Finding

Shared filename collisions allow content substitution and cross-token deletion

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/server.js:47

Finding

Unvalidated TTL values can bypass expiration and disrupt status processing

Content

View full analysis

{ const { filename, ttl = 60 } = req.body || {}; if (!filename) { return res.status(400).json({ error: 'filename richiesto' }); } const filePath = path.join(SHARED_DIR, path.basename(filename)); if (!fs.existsSync(filePath)) { return res.status(404).json({ error: `File non trovato: ${filename}` }); } const token = crypto.randomBytes(32).toString('hex'); const expiresAt = new Date(Date.now() + ttl * 60 * 1000); ``` ### Technical Analysis The authenticated `/generate` endpoint accepts `ttl` without checking its type, finiteness, integer status, sign, or maximum value. JavaScript coercion is applied during multiplication. A nonnumeric string or an excessively large numeric value can produce an invalid `Date`. Comparisons such as `now > entry.expiresAt` evaluate to false for an invalid date, so the periodic cleanup process does not expire that token. The `/status` endpoint later calls `entry.expiresAt.toISOString()`, which throws a `RangeError` for an invalid date. Negative, zero, fractional, and extremely long TTL values are also accepted despite the endpoint describing TTL as a duration in minutes. ### Attack Path 1. An actor with the valid `SHARE_SECRET` identifies a file already present in `SHARED_DIR`. 2. The actor submits a request such as: ```json { "filename": "example.dat", "ttl": "invalid" } ``` 3. The expression used to construct `expiresAt` produces an invalid date. 4. Periodic cleanup fails to classify the entry as expired because comparisons against the invalid date are false. 5. Requests to `/status` encounter the malformed entry and can fail while serializing it with `toISOString()`. 6. The token and associated file can remain retained until another action removes them or the process ...[truncated 514 chars]

Remediation

View remediation

1440) { return res.status(400).json({ error: 'ttl must be an integer from 1 to 1440 minutes' }); } ``` - Validate the resulting timestamp with `Number.isFinite(expiresAt.getTime())` before storing the token. - Apply server-controlled maximum retention regardless of client input. - Add error-handling middleware so malformed state cannot disrupt endpoint availability. - Add tests for strings, `null`, negative values, zero, fractions, and values large enough to produce invalid dates. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/server.js:27

Finding

Management secret accepted through query parameters may leak through infrastructure logs

Content

View full analysis

`. 2. A reverse proxy, tunnel service, monitoring agent, shell history, or browser history records the complete URL. 3. An actor with access to that record retrieves the secret. 4. The actor sends authenticated requests to `/status` to enumerate active filenames and token prefixes. 5. The actor sends requests to `/generate` for files whose names are known and which are present in the shared directory. 6. The generated public download links can then be used to retrieve those files. ### Impact Assessment A leaked secret grants management-level access to the application's protected API. The holder can inspect active share metadata and ...[truncated 353 chars]

Remediation

View remediation

`. - Ensure reverse proxies and monitoring systems redact authorization headers. - Require HTTPS on the public route and avoid exposing management endpoints through the public tunnel where possible. - Restrict `/generate` and `/status` to localhost, a private network, Cloudflare Access, or mutually authenticated clients. - Rotate `SHARE_SECRET` if it has previously been used in URLs. - Consider constant-time comparison after validating equal buffer lengths to reduce unnecessary secret-comparison leakage. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/package.json:10

Finding

Dependency installation is not locked to an audited dependency graph

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment variable requirements, including a sensitive secret, but does not declare an explicit tool scope or permission boundary. In an agent environment, missing scope metadata can cause the skill to be invoked with broader-than-expected capabilities or without clear review of its access to secrets and local execution context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match common conversation like 'share', 'send link', or 'download link', which can activate the skill in situations the user did not clearly intend. Because this skill creates public internet-accessible links for local files, accidental invocation increases the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains hard-coded Italian user-facing strings such as error/download messages and explicitly formats timestamps with the 'it-IT' locale and 'Europe/Rome' timezone. This enforces a specific language/locale choice for all users, which matches the policy-violation category when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings and usage text exclusively in Italian, including the top-level description and CLI usage. That imposes a locale/language choice on users without offering an alternative or documenting that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is a real vulnerability: the script explicitly permits the service to start when SHARE_SECRET is unset and only prints a warning, which means administrative endpoints such as /generate and /status may be exposed without authentication. In this skill's context, the service is designed to create public file-sharing links and may be exposed through Cloudflare Tunnel, so unauthenticated access could let an external party generate links, enumerate shared files, or interfere with file lifecycle behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range (^5.2.1), which allows installation of newer compatible releases rather than a single verified version. In a security-sensitive file-sharing service exposed publicly via Cloudflare Tunnel, this weakens build reproducibility and can unexpectedly introduce vulnerable or unreviewed dependency updates into deployed environments.

Content

Scanner excerpt · scripts/package.json (reported line 12)May include surrounding context.

json

"author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^5.2.1"
  }
}

Unverifiable Dependency: express has 5 known advisory(ies) (CVE-2024-10491 (Express ressource injection); CVE-2014-6393 (No Charset in Content-Type Header in express); CVE-2024-9266 (Express Open Redirect vulnerability) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The manifest references express without an exact pinned version, and static analysis notes multiple known advisories affecting some Express releases. Because this skill provides public download links through an internet-exposed server, uncertainty about the exact installed version materially increases risk: a vulnerable Express release could be pulled in without visibility, potentially exposing redirect, injection, or other web-layer flaws.

Content

No source excerpt is available for this finding.