skills-firewall

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:01 AM UTC
• Version: 1.0.0

Overview

This looks like an advisory skill scanner rather than malware, but its firewall claims are stronger than its actual safety controls.

Treat this as a review-required advisory scanner, not as an enforcement firewall. It is not showing hidden exfiltration or destructive behavior, but do not rely on its allow/block result as a security boundary until fail-open handling, package identity binding, symlink containment, and HTML escaping are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan_skill.py:171

Finding

Scan failures and missing targets are treated as safe

Content

View full analysis

0: threat_level = ThreatLevel.CRITICAL is_safe = False recommendations.append("CRITICAL: Immediate review required. Critical security threats detected.") elif high_count > 0: threat_level = ThreatLevel.HIGH is_safe = False recommendations.append("HIGH: Review recommended. High-risk patterns detected.") elif medium_count > 0: threat_level = ThreatLevel.MEDIUM is_safe = True recommendations.append("MEDIUM: Consider reviewing medium-risk patterns.") elif all_threats: threat_level = ThreatLevel.LOW is_safe = True recommendations.append("LOW: Minor concerns detected. Review optional.") else: threat_level = ThreatLevel.SAFE is_safe = True recommendations.append("No security concerns detected.") ``` ```python # scripts/scan_skill.py:232-239 try: with open(fi ...[truncated 3005 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/firewall_check.py:174

Finding

Basename-only allowlisting bypasses all content inspection

Content

View full analysis

FirewallDecision: skill_path = Path(skill_path) skill_name = skill_path.name if skill_name in self.config.allowed_skills: return FirewallDecision( skill_name=skill_name, action=ActionType.ALLOW.value, reason="Skill is in allowed list", matched_rules=[], confidence=1.0 ) ``` ```python # scripts/firewall_check.py:254-263 def add_allowed_skill(self, skill_name: str): self.config.allowed_skills.add(skill_name) if skill_name in self.config.blocked_skills: self.config.blocked_skills.remove(skill_name) def add_blocked_skill(self, skill_name: str): self.config.blocked_skills.add(skill_name) if skill_name in self.config.allowed_skills: self.config.allowed_skills.remove(skill_name) ``` ```python # scripts/firewall_check.py:303-309 self.config.allowed_skills = set(config_dict.get("allowed_skills", [])) self.config.blocked_skills = set(config_dict.get("blocked_skills", [])) self.config.quarantine_dir = config_dict.get("quarantine_dir", "./quarantine") rules = [] for r in config_dict.get("rules", []): rules.append(FirewallRule( ``` ### Technical Analysis Allowlist membership is determined only from `Path(skill_path).name`, which is the final path component. The path, content digest, publisher, signature, and package provenance are not used to establish identity. The allowlist check occurs before `_read_skill_content` and before any security rules are evaluated. Therefore, matching an allowlisted basename produces an unconditional `ALLOW`, regardless of the supplied Skill’s contents. Directory basenames are attacker-controlled in normal package and fil ...[truncated 1183 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:297

Finding

Unescaped Skill names permit stored HTML injection in generated reports

Content

View full analysis

Threat Categories

{''.join(f'

{cat}{count}

' for cat, count in sorted(report.summary['by_category'].items(), key=lambda x: -x[1]))}

Detailed Findings

{''.join(f'

{d["skill_name"]} - {d["threat_level"].upper()} ({d["threats_count"]} threats)

' for d in report.details)}

Recommendations

{''.join(f'
1. {rec}
' for rec in report.recommendations)}

``` ### Technical Analysis Dynamic report values are directly interpolated into an HTML document without contextual escaping. In particular, `d["skill_name"]` originates from the scanned directory’s basename, which can contain HTML metacharacters on supported filesystems. An attacker-controlled name can terminate the intended markup and insert arbitrary elements, including event-handler attributes that execute JavaScript when the report is viewed. The generated report does not include a restrictive Content Security Policy that would mitigate inline script execution. The category and recommendation fields are currently generated primarily from internal constants, but they should also be escaped to preserve the security boundary if future rules or imported configuration make them attacker-controlled. ### Attack Path 1. An attacker creates or distributes a Skill directory with an HTML payload in its basename, such as a name containing an image element with an error event handler. 2. An auditor scans the parent directory and requests HTML output. 3. `generate_report.py` cop ...[truncated 946 chars]

Remediation

View remediation

`, `"`, `'`, `&`, closing tags, and event-handler payloads. 7. Keep the bundled and generated reports free of inline executable content so that a strict policy can be applied. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/scan_skill.py:186

Finding

Symlinked source files allow scanning outside the requested Skill directory

Content

View full analysis

List[Dict]: threats = [] try: with open(file_path, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() lines = content.split('\n') for indicator in patterns: matches = re.finditer(indicator.pattern, content, re.IGNORECASE) for match in matches: line_num = content[:match.start()].count('\n') + 1 line_content = lines[line_num - 1].strip() if line_num <= len(lines) else "" threats.append({ "pattern": indicator.pattern, "description": indicator.description, "level": indicator.level.value, "category": indicator.category, "file": file_path, "line": line_num, "matched_text": match.group()[:100], "line_content": line_content[:200] }) except Exception as e: pass return threats ``` ```python # scripts/firewall_check.py:147-161 def _read_skill_content(self, skill_path: str) -> str: content_parts = [] skill_path = Path(skill_path) for root, dirs, files in os.walk(skill_path): for file in files: if file.endswith(('.py', '.sh', ...[truncated 2365 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence

Finding

This is the same core issue in slightly different wording: the skill claims automatic firewall behavior, but the visible implementation context shows heuristic scanning/reporting rather than actual prevention or installation/execution controls. In a security product, overstating protection is dangerous because operators may skip other controls based on inaccurate expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

This is the same core issue in slightly different wording: the skill claims automatic firewall behavior, but the visible implementation context shows heuristic scanning/reporting rather than actual prevention or installation/execution controls. In a security product, overstating protection is dangerous because operators may skip other controls based on inaccurate expectations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

python scripts/firewall_check.py /path/to/skill

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/malicious_patterns.md (reported line 24)May include surrounding context.

Subprocess with Shell

python

subprocess.call(cmd, shell=True)   # HIGH: Command injection
subprocess.run(cmd, shell=True)    # HIGH: Command injection
subprocess.Popen(cmd, shell=True)  # HIGH: Command injection

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/malicious_patterns.md (reported line 25)May include surrounding context.

Subprocess with Shell

python

subprocess.call(cmd, shell=True)   # HIGH: Command injection
subprocess.run(cmd, shell=True)    # HIGH: Command injection
subprocess.Popen(cmd, shell=True)  # HIGH: Command injection

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/malicious_patterns.md (reported line 26)May include surrounding context.

python

subprocess.call(cmd, shell=True)   # HIGH: Command injection
subprocess.run(cmd, shell=True)    # HIGH: Command injection
subprocess.Popen(cmd, shell=True)  # HIGH: Command injection

OS System Calls

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/malicious_patterns.md (reported line 26)May include surrounding context.

python

subprocess.call(cmd, shell=True)   # HIGH: Command injection
subprocess.run(cmd, shell=True)    # HIGH: Command injection
subprocess.Popen(cmd, shell=True)  # HIGH: Command injection

OS System Calls

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security_rules.md (reported line 123)May include surrounding context.

md

- **Severity**: HIGH
- **Rationale**: Privilege escalation is a security risk.

#### RULE-018: Block chmod 777
- **Pattern**: `chmod\s+777`
- **Action**: BLOCK
- **Severity**: MEDIUM

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

FirewallRule(
        name="block_privilege_escalation",
        description="Block privilege escalation attempts",
        patterns=["sudo ", "su ", "chmod 777", "chown "],
        action=ActionType.BLOCK,
        enabled=True
    ),

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/malicious_patterns.md (reported line 121)May include surrounding context.

md

FirewallRule(
        name="block_privilege_escalation",
        description="Block privilege escalation attempts",
        patterns=["sudo ", "su ", "chmod 777", "chown "],
        action=ActionType.BLOCK,
        enabled=True
    ),

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/firewall_check.py (reported line 113)May include surrounding context.

python

FirewallRule(
        name="block_privilege_escalation",
        description="Block privilege escalation attempts",
        patterns=["sudo ", "su ", "chmod 777", "chown "],
        action=ActionType.BLOCK,
        enabled=True
    ),

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/firewall_check.py (reported line 279)May include surrounding context.

python

enabled=enabled
        )
        self.config.rules.append(rule)
        return rule
    
    def export_config(self, output_path: str):
        config_dict = {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

| Network Communication | HTTP requests, socket connections | MEDIUM |
| File Operations | File deletion, modification | MEDIUM |
| Deserialization | pickle.loads, unsafe yaml.load | HIGH |
| Privilege Escalation | sudo, chmod 777 | HIGH |
| Obfuscation | Base64 decoding, encoding | LOW |

## Configuration

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/security_rules.md (reported line 123)May include surrounding context.

md

| Network Communication | HTTP requests, socket connections | MEDIUM |
| File Operations | File deletion, modification | MEDIUM |
| Deserialization | pickle.loads, unsafe yaml.load | HIGH |
| Privilege Escalation | sudo, chmod 777 | HIGH |
| Obfuscation | Base64 decoding, encoding | LOW |

## Configuration

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/firewall_check.py (reported line 113)May include surrounding context.

python

| Network Communication | HTTP requests, socket connections | MEDIUM |
| File Operations | File deletion, modification | MEDIUM |
| Deserialization | pickle.loads, unsafe yaml.load | HIGH |
| Privilege Escalation | sudo, chmod 777 | HIGH |
| Obfuscation | Base64 decoding, encoding | LOW |

## Configuration

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/malicious_patterns.md (reported line 114)May include surrounding context.

Sudo/Su Commands

python

os.system('sudo ...')    # HIGH: Privilege escalation
subprocess.run(['sudo', ...])  # HIGH: Privilege escalation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/malicious_patterns.md (reported line 121)May include surrounding context.

Permission Changes

python

os.chmod(file, 0o777)    # MEDIUM: Insecure permissions
chmod 777 file           # MEDIUM: Insecure permissions

Risk Level Classification

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/security_rules.md (reported line 13)May include surrounding context.

md

- **Pattern**: `eval(`
- **Action**: BLOCK
- **Severity**: HIGH
- **Rationale**: eval() can execute arbitrary code from strings, leading to code injection vulnerabilities.

#### RULE-002: Block exec() Usage
- **Pattern**: `exec(`