Security audit

ia-debugging

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent debugging workflow skill, with the main practical risk being accidental sharing of diagnostic details unless users redact them.

Install only if you want Codex to follow a structured debugging process that may run tests, inspect project state, make narrow authorized fixes, and collect local diagnostics. Review any diagnostic report before sharing it, especially git remotes, paths, usernames, stack traces, environment values, hostnames, IPs, SQL fragments, and customer data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/collect-diagnostics.sh:20
Finding: Diagnostic reports expose sensitive local and repository metadata<![CDATA[ ## Vulnerability Details **File Location**: `scripts/collect-diagnostics.sh:20-53` **Vulnerability Type**: Sensitive information exposure through diagnostic collection **Risk Level**: Medium ### Vulnerable Code ```bash # --- System --- buf+="## System"$'\n\n' buf+="| Property | Value |"$'\n' buf+="|----------|-------|"$'\n' buf+="| OS | $(uname -s) $(uname -r) |"$'\n' buf+="| Arch | $(uname -m) |"$'\n' buf+="| Shell | ${SHELL:-unknown} |"$'\n' if command -v bash &>/dev/null; then buf+="| Bash | $(bash --version | head -1) |"$'\n' fi buf+="| User | $(whoami) |"$'\n' buf+="| PWD | $(pwd) |"$'\n' buf+=$'\n' # --- Disk / Memory --- buf+="## Resources"$'\n\n' buf+='```'$'\n' buf+="Disk (pwd): $(df -h . 2>/dev/null | tail -1 | awk '{print $4 " available of " $2}')"$'\n' if command -v free &>/dev/null; then buf+="Memory: $(free -h 2>/dev/null | awk '/^Mem:/{print $7 " available of " $2}')"$'\n' fi buf+='```'$'\n\n' # --- Git --- if git rev-parse --is-inside-work-tree &>/dev/null; then buf+="## Git"$'\n\n' buf+="| Property | Value |"$'\n' buf+="|----------|-------|"$'\n' buf+="| Branch | $(git branch --show-current 2>/dev/null || echo 'detached') |"$'\n' buf+="| Last commit | $(git log -1 --format='%h %s' 2>/dev/null || echo 'none') |"$'\n' buf+="| Dirty files | $(git status --porcelain 2>/dev/null | wc -l | tr -d ' ') |"$'\n' buf+="| Remote | $(git remote get-url origin 2>/dev/null || echo 'none') |"$'\n' buf+=$'\n' fi ``` The associated sharing guidance in `references/specialized-patterns.md:5-12` states: ```markdown Before investigating, capture the environment state using [collect-diagnostics.sh](../scripts/collect-diagnostics.sh): ```bash bash collect-diagnostics.sh # print to stdout bash collect-diagnostics.sh diag.md # write to file ``` Collects system info, language ...[truncated 2521 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the username, absolute working directory, and Git remote URL from the default report. 2. Make sensitive fields opt-in through explicit flags such as `--include-paths` and `--include-remote`. 3. If the remote URL is needed, parse and sanitize it before output: - Remove URL user information. - Replace internal hostnames with a placeholder. - Retain only a provider classification or sanitized repository identifier. 4. Replace the absolute working directory with a neutral value such as the project directory basename, or omit it. 5. Add a prominent warning to stdout and generated files stating that reports must be reviewed before external sharing. 6. Produce a sanitized sharing mode by default and reserve a clearly labeled local-only mode for full diagnostics. 7. Add automated tests covering HTTPS remotes with embedded credentials, SSH remotes, internal hostnames, usernames, and absolute paths. 8. Continue requiring final output redaction at the Skill-instruction level, but do not rely on that manual control as the primary safeguard. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/reproduction-and-investigation.md:40
Finding: Unbounded environment-variable logging can leak credentials into logs and transcripts<![CDATA[ ## Vulnerability Details **File Location**: `references/reproduction-and-investigation.md:40` and `references/defense-in-depth.md:82-85` **Vulnerability Type**: Unsafe diagnostic logging guidance **Risk Level**: Medium ### Vulnerable Guidance `references/reproduction-and-investigation.md:40`: ```markdown **Multi-component systems** (CI -> build -> deploy, API -> service -> DB): before proposing fixes, log what data enters and exits each component boundary and verify env/config propagation across it. Run once to see WHERE it breaks, then investigate that component. Write probes unbuffered to stderr (`console.error`, `fwrite(STDERR, ...)`, `print(..., file=sys.stderr)`); application loggers may be suppressed in tests. Log BEFORE the dangerous operation, not after it fails. Include context: cwd, env vars, `new Error().stack`. ``` `references/defense-in-depth.md:82-85`: ```markdown Use `console.error()` in tests (not logger, which may be suppressed). Log BEFORE the dangerous operation, not after it fails. Include context: cwd, env vars, timestamps, stack trace. ``` ### Technical Analysis The instruction to include “env vars” is not restricted to a safe allowlist. Application, cloud, deployment, and CI environments commonly contain API keys, database connection strings, repository tokens, signing credentials, session secrets, and private endpoint information. Directing probes to unbuffered stderr increases the likelihood that these values will be captured by CI systems, test runners, terminal recordings, agent conversations, and centralized log collectors. Stack traces and current working directories can additionally expose private source paths and internal implementation details. Other files in the Skill require redaction, and the bundled diagnostic script uses a limited environment-variable allowlist. However, the quoted instrumentation guidance is broader and can reasonably be interpreted as permission to dump an entire environment or log sens ...[truncated 1645 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace “env vars” with an explicit allowlist of non-secret diagnostic fields. 2. State that agents must never dump `env`, `printenv`, `process.env`, `os.environ`, or equivalent complete environment objects. 3. Log whether a sensitive variable is present rather than its value, for example `DATABASE_URL: configured`. 4. Where comparison is necessary, log a non-reversible digest or a short configuration classification rather than plaintext. 5. Explicitly denylist common secret-bearing names and patterns, including: - `*_TOKEN` - `*_SECRET` - `*_PASSWORD` - `*_KEY` - `DATABASE_URL` - `AUTHORIZATION` - Cloud-provider credential variables 6. Sanitize stack traces and working directories before they enter stderr, CI logs, or conversations. 7. Require diagnostic probes to be removed after verification, consistent with the existing cleanup guidance. 8. Add safe instrumentation examples that construct a small object from approved variable names rather than serializing an environment object. 9. Apply the same restricted wording consistently in both `reproduction-and-investigation.md` and `defense-in-depth.md`. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description implies an active debugging/root-cause analysis capability with verification of issues. The supplied code does not perform debugging, reproduce failures, analyze stack traces, run tests, or verify root causes. Instead, it gathers diagnostic context about the local environment and project. While such diagnostics can support debugging, the actual code's primary purpose is environment/report collection, which is narrower and materially different from the declared systematic debugging capability. It also accesses and outputs repository metadata and environment information that are not specifically reflected in the description.

Hidden Instructions

High

Category: Prompt Injection
Content: Out of scope: - Acting as the runtime instructions themselves (those live in `SKILL.md`). - Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER). -  ## Trigger Context
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Context Leakage

High

Category: Data Exfiltration
Content: ### Layer 4: Debug Instrumentation Capture context for forensics when the other layers fail. ```typescript async function gitInit(directory: string) {
Confidence: 75% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guidance recommends running a diagnostics script that explicitly collects environment variables and suggests writing the output to a file or attaching it to bug reports, but it provides no warning that secrets may be included. In a debugging workflow, this creates a realistic risk of credential, token, or internal system detail disclosure through logs, local files, or shared tickets.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: Watch for these signs from the user -- they indicate you've left the systematic process: - "Is that not happening?" -- you assumed behavior without checking - "Will it show us...?" -- you're not gathering enough evidence - "Stop guessing" -- you're proposing fixes without root cause - "We're going in circles" -- same hypothesis repackaged, not a new approach
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script includes `git remote get-url origin`, which can disclose sensitive repository metadata such as private Git hostnames, organization names, usernames, and embedded credentials or tokens if the remote URL is configured unsafely. For a debugging helper, collecting and later sharing this value is not clearly necessary and increases the risk of unintended information disclosure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: When an output path is provided, the script writes collected diagnostics—including user, working directory, git metadata, runtime versions, and environment details—to a file without warning about sensitivity or restricting file permissions. In a debugging workflow, such reports are often attached to tickets or shared externally, making accidental data exposure more likely.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: Labeling the environment-variable section as a 'safe subset' can create a false sense of safety even though the script prints raw values directly into the report. While the listed variables are commonly non-secret, they may still reveal deployment mode, CI context, terminal details, or internal environment naming conventions that should not be casually disclosed.

Static analysis

No suspicious patterns detected.