DFMEA - Design Failure Mode and Effects Analysis

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:07 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent DFMEA helper, but its CLI can write files to user-controlled paths and overwrite matching files outside an intended output area.

Review before installing if you expect to run the CLI on untrusted project names or through automation. Use simple project names without slashes, backslashes, absolute paths, or .. components, and avoid running it from sensitive directories until the output path is restricted to a safe folder and overwrite behavior is controlled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: dfmea.js:145

Finding

User-Controlled Path Traversal and Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: dfmea.js, lines 145–148
Vulnerability Type: Path traversal and unsafe file creation
Risk Level: Medium

Vulnerable Code

js

const projectName = args[1] || 'New DFMEA Project';
const teamMembers = args.slice(2);
const template = dfmea.generateTemplate(projectName, teamMembers);
const outputFile = `${projectName.replace(/\s+/g, '_')}_dfmea.json`;
dfmea.exportToJson(template, outputFile);

The resulting path is passed to the following file-writing method at lines 126–128:

js

exportToJson(dfmea, filename) {
  fs.writeFileSync(filename, JSON.stringify(dfmea, null, 2));
}

Technical Analysis

The create command constructs an output filename directly from the user-controlled projectName argument. The only transformation replaces whitespace with underscores. It does not reject:

• Absolute paths
• / or \ path separators
• .. traversal components
• Paths outside an intended output directory

The constructed value is passed to fs.writeFileSync, which follows the supplied path and overwrites an existing file by default. Consequently, a caller can direct generated JSON outside the current working directory.

This issue requires permission to invoke the CLI and is limited by the operating-system permissions of the process. The fixed _dfmea.json suffix restricts which filenames can be targeted, but it does not prevent writing outside the intended directory or overwriting matching files.

Attack Path

1. An attacker or untrusted automation invokes the CLI with a project name containing traversal components or an absolute path.

2. For example:

   bash

   dfmea create "../../target"
   

3. The application constructs this output path:

   text

   ../../target_dfmea.json
   

4. fs.writeFileSync resolves that path relative to the process working directory.

5. If the destination directory is writable, the application creates or overwrites target_dfmea.json outside the i ...[truncated 729 chars]

Remediation

View remediation

Remediation Suggestions

1. Write generated files into a fixed, application-controlled output directory.
2. Treat the project name as a display value rather than a filesystem path.
3. Convert it to a safe filename using a strict allowlist, such as ASCII letters, digits, hyphens, and underscores.
4. Reject path separators, absolute paths, . components, and .. components.
5. Resolve the final destination and verify that it remains inside the approved output directory.
6. Use exclusive creation, such as the wx flag, if overwriting existing files is not explicitly intended.
7. Return a clear error when a name is invalid or the destination already exists.

Example hardening approach:

js

const outputDir = path.resolve(process.cwd(), 'dfmea-output');
fs.mkdirSync(outputDir, { recursive: true });

const safeName = projectName
  .normalize('NFKC')
  .replace(/[^A-Za-z0-9_-]+/g, '_')
  .replace(/^_+|_+$/g, '');

if (!safeName) {
  throw new Error('Project name does not contain a valid filename');
}

const outputFile = path.resolve(outputDir, `${safeName}_dfmea.json`);
const relativePath = path.relative(outputDir, outputFile);

if (
  relativePath.startsWith(`..${path.sep}`) ||
  relativePath === '..' ||
  path.isAbsolute(relativePath)
) {
  throw new Error('Invalid output path');
}

fs.writeFileSync(outputFile, JSON.stringify(template, null, 2), {
  encoding: 'utf8',
  flag: 'wx'
});

Add automated tests covering absolute paths, Windows and POSIX separators, nested traversal sequences, Unicode edge cases, empty sanitized names, and attempts to overwrite existing files.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's activation criteria are broad enough to trigger on generic engineering, quality, or product design discussions that may not specifically require DFMEA support. Over-broad triggering can cause inappropriate activation, irrelevant guidance, or unintended access to user context, though this skill's described functionality is limited and not inherently high risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents invocation-like example phrases such as 'Create a DFMEA...' and 'Perform DFMEA...' but does not specify whether these are the exact triggers, examples only, or what kinds of similar requests should not activate the skill. That ambiguity can increase the chance of unintended invocation from ordinary engineering discussion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The inline comment and user-facing behavior indicate that 'add-item' would add a DFMEA item, but the code only prints a placeholder message and performs no modification. This is an active contradiction between documented/advertised functionality and actual behavior, not merely missing detail.

Content

No source excerpt is available for this finding.