Ini Align

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent INI alignment tool, but its script can overwrite source, target, or other writable files if the output path is unsafe.

Review before installing. Use this only with explicit source, target, and fresh output paths, and avoid running it on important configuration files without backups until the output path handling is hardened to reject existing files and input-path aliases.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ini_align.py:127

Finding

Input Files Can Be Truncated Through Unsafe Output Path Handling

Content

View full analysis

Vulnerability Details

File Location: scripts/ini_align.py:127-128
Vulnerability Type: Unrestricted file overwrite and input/output path aliasing
Risk Level: Medium

Vulnerable Code

python

# Write output
with open(output_path, 'w', encoding='utf-8') as f:
    f.write('\n'.join(lines))

The command-line entry point passes the user-provided output path directly into this operation:

python

align_ini(sys.argv[1], sys.argv[2], sys.argv[3])

Technical Analysis

The output file is opened in w mode without verifying that it is distinct from the source and target files. Opening an existing file in this mode truncates it before writing the generated result.

This conflicts with the documented guarantee in SKILL.md that the source and target are never modified and that the output must never overwrite either input. The script does not enforce that guarantee.

A direct string comparison would not be sufficient because different path strings can identify the same file. Aliasing can occur through:

• Identical path arguments
• Relative and absolute forms of the same path
• Symbolic links
• Hard links
• Paths containing components such as ..

The output operation also overwrites any other existing file writable by the current process. There is no exclusive-creation or no-follow protection.

Attack Path

1. An attacker or user supplies valid source and target INI files.

2. The output argument is set to the source path, target path, or an alias of either file. For example:

   bash

   python scripts/ini_align.py source.ini target.ini target.ini
   

3. Both inputs are parsed before the output is opened, so execution appears to proceed normally.

4. At line 127, the aliased input is opened in w mode and immediately truncated.

5. The generated content is written over the original input, causing irreversible loss of comments, formatting, duplicate entries, and pot ...[truncated 750 chars]

Remediation

View remediation

Remediation Suggestions

• Reject an output path that identifies the same file as either input. For existing paths, use os.path.samefile() so symbolic links and hard links are detected.
• Refuse to overwrite any existing output file if the documented behavior requires creation of a new file.
• Open the output using exclusive creation, such as mode x, rather than mode w.
• For stronger race-condition resistance on supported platforms, use os.open() with O_CREAT, O_EXCL, and O_NOFOLLOW, then wrap the resulting descriptor with os.fdopen().
• Validate and normalize paths before processing, while recognizing that normalization alone does not detect hard links.
• Emit a clear error and exit without writing when the output collides with an input or already exists.
• Add regression tests covering identical paths, relative path aliases, symbolic links, hard links, and pre-existing output files.

A minimal defensive check for existing files could include:

python

import os

for input_path in (source_path, target_path):
    if os.path.exists(output_path) and os.path.samefile(output_path, input_path):
        raise ValueError("Output path must not refer to a source or target file")

with open(output_path, 'x', encoding='utf-8') as f:
    f.write('\n'.join(lines))

Production hardening should prefer descriptor-based exclusive creation to reduce time-of-check to time-of-use race conditions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill performs file read/write operations but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to overbroad file system access, making it easier for the skill to read or write unintended files if invoked with unsafe paths or if the runtime grants default access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest lists several specific trigger phrases but then adds "or similar needs," which makes activation scope ambiguous and potentially broad. This catch-all wording does not define clear boundaries or exclusions, so the skill could match ordinary requests beyond the intended INI-reordering use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains multiple natural-language strings shown to users in Chinese, including section labels, completion messages, and warnings. Because the skill does not offer localization, language selection, or any justification that it is intentionally region-specific, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.