T09 · Insecure Skill Coding Practices
Error
- Location
scripts/organize.py:245- Finding
Untrusted Undo Log Permits Arbitrary File Relocation and Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
File Organizer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real file organizer, but its broad file-moving authority and unsafe undo/dry-run behavior make it appropriate for Review.
Install only if you are comfortable with a tool that can move and rename many local files. Use it on a small test directory first, keep backups, do not run undo against log files you did not create and control, and prefer pinned installation commands where possible.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/organize.py:188- Finding
Dry-Run Mode Performs an Unintended Filesystem Write
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README promotes automatic sorting, renaming, and moving of user files, but it does not prominently warn that running the tool will modify filesystem state and may relocate or rename important files. In an agent-skill context, this increases the risk of accidental destructive actions or user surprise, especially if the skill is invoked on broad directories like Downloads without explicit confirmation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill instructs users to install and execute tooling via
npx clawhubwithout pinning an exact version or integrity source. This creates a supply-chain risk: users may fetch an unexpected or newly compromised package version at execution time, and because this is part of installation guidance, exploitation could lead to arbitrary code execution on the user's machine.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation examples use broad natural-language commands such as organizing Downloads or undoing prior actions without clear scoping, confirmation, or path constraints. In a file-management skill that performs bulk moves and renames, ambiguous activation increases the chance of unintended execution against sensitive directories or destructive reorganization triggered by casual user phrasing or agent misinterpretation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The configuration enables automatic sorting of files from a broad user-controlled directory (~/Downloads) into a target location without any explicit activation constraints, review step, or narrowing of scope. This can cause unintended movement or renaming of files, and if the skill is triggered implicitly or frequently, it may process sensitive or transient downloads in ways the user did not intend.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code moves user files with shutil.move, changing their location on disk, and later writes an undo log to disk. Although the module docstring describes organizing files, the runtime path performs these safety-relevant file modifications without an explicit warning, confirmation prompt, or user-facing disclosure immediately before execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The undo path moves files back to their original locations and can remove now-empty category directories with os.rmdir. These are filesystem-modifying operations, but there is no confirmation prompt or explicit warning that invoking --undo will alter files and delete empty folders.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file demonstrates running a script against
~/Downloadsand shows that files are moved into a new structure and at least one filename is changed. Although undo and dry-run are documented later, there is no upfront user warning near the invocation that the operation modifies user data and filenames.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This Python file exercises safety-relevant filesystem behavior including creating files, moving them via organize_directory, writing a JSON log, and restoring files via undo_operation. While comments/docstrings describe the behavior for developers, there is no user-facing confirmation, warning, or disclosure in this file about these file-modifying actions.
- Content