Steal List

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This is a legitimate reference-research skill, but it needs Review because it grants Bash/write/network authority and includes an unsafe shell-command template for dynamic GitHub searches.

Before installing, be comfortable with the skill reading limited project context, doing external web/GitHub research, and writing reports under .scout/. Avoid using untrusted or adversarial project text as a scouting target unless the agent treats search queries as inert arguments rather than shell source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:193

Finding

Shell Command Injection Through an Untrusted Repository Search Query

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 193
Vulnerability Type: Shell command injection caused by unsafe interpolation of context-derived input
Risk Level: Medium

Vulnerable Code

bash

gh search repos "[targeted query from table above]" --sort stars --limit 10 2>/dev/null

Technical Analysis

The Skill instructs the Agent to construct a shell command by replacing the quoted placeholder with a targeted query derived from project context or user input. Placing an untrusted value inside double quotes does not make it safe for shell evaluation. Bash still evaluates command substitutions such as $(command) and backtick expressions inside double-quoted strings.

If the Agent copies attacker-controlled project text or a user-provided research target into this template without strict validation, embedded shell syntax may be evaluated by Bash. The resulting command would execute under the same operating-system identity and permissions as the Agent process.

This is an insecure command-construction pattern rather than evidence that the Skill intentionally executes a malicious payload. Exploitation depends on untrusted content being transferred into the query and then passed to Bash as shell source.

Attack Path

1. An attacker places a crafted domain, feature name, or research instruction in project context read during Phase 0, or supplies it as the requested scouting target.
2. The crafted value contains shell substitution syntax, such as $(malicious_command).
3. The Agent derives the targeted repository-search query from that value.
4. The Agent replaces the placeholder in the documented command with the crafted query.
5. Bash parses the generated command and evaluates the embedded substitution despite the surrounding double quotes.
6. The injected command executes with the Agent process's local permissions before or while gh search repos runs.

Impact Assessment

Successf ...[truncated 744 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct executable shell source by inserting context-derived or user-controlled text into a command template.

• Prefer a structured GitHub or API tool that accepts the search query as a distinct argument without invoking a shell.

• If Bash is unavoidable, pass the query through a positional parameter rather than generating a command string. For example:

  bash

  query="$1"
  gh search repos "$query" --sort stars --limit 10
  

  The surrounding harness must pass the value directly as an argument and must not build or execute the command through eval, bash -c, or equivalent reparsing mechanisms.

• Validate generated search queries against a strict allowlist appropriate for repository searches. Reject shell metacharacters, control characters, command-substitution syntax, and unexpected newlines.

• Explicitly instruct the Agent to treat README content, planning documents, user-provided targets, repository text, and web results as untrusted data.

• Avoid suppressing all standard error output with 2>/dev/null, because doing so can conceal malformed commands and hinder detection. Capture and report errors safely instead.

• Add adversarial tests covering values containing $(...), backticks, quotes, semicolons, newlines, redirections, and shell operators to confirm that they remain inert arguments.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises very broad trigger phrases such as "find references," "show me examples," and "what's out there," plus proactive suggestion behavior. That can cause the skill to activate in situations the user did not clearly intend, leading the agent to perform web research and create files in the workspace unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The metadata description explains the research behavior but does not prominently warn that the skill writes a structured document into the project workspace at .scout/. This can surprise users and downstream agents, especially in repositories where automated writes may be undesirable or sensitive.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.