Security audit

Context Cleanup

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent cleanup purpose, but its script contains unsafe JSON-generation code that can execute attacker-controlled JavaScript in some workspace or filename conditions.

Review this skill before installing or running it. Avoid using --json in workspaces or memory trees that may contain untrusted path or file names, and use plan or --dry-run before archive. Be aware that archive can move memory files permanently within the workspace and may overwrite archived files with duplicate basenames.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: cleanup.sh:82
Finding: Arbitrary JavaScript Execution Through Unsafe JSON Generation
Content: View full analysis
/dev/null || true fi ``` ### Technical Analysis The script constructs JavaScript source code inside a double-quoted shell argument and directly embeds environment-controlled paths and filesystem-derived filenames. These values are not encoded or escaped as JavaScript string literals. At line 82, `$WORKSPACE` is inserted between JavaScript single quotes. A workspace path containing a single quote and additional JavaScript syntax can terminate the string and inject statements into the program evaluated by `node -e`. At line 119, entries in `low_list` and `medium_list` are interpolated directly into generated JavaScript. Since filenames can contain quotes and other JavaScript syntax characters, a maliciously named Markdown file can alter the evaluated program. This is source-code injection rather than ordinary malformed JSON. Injected JavaScript can access Node.js APIs such as `require("child_process")`, `fs`, and networking modules. The `2>/dev/null || true` behavior at line 119 can additionally conceal parser errors or other evidence of exploitation. ### Attack Path 1. An attacker controls the `WORKSPACE` environment variable and prepares a corresponding workspace directory whose path contains JavaScript syntax, or creates a ...[truncated 1267 chars]
Remediation: View remediation
/dev/null || true`; return a nonzero status so malformed output and attacks are visible. - Add regression tests containing filenames and workspace paths with single quotes, double quotes, backslashes, newlines, Unicode, and JavaScript metacharacters. A safer pattern for a scalar value is: ```bash WORKSPACE_VALUE="$WORKSPACE" \ FILE_COUNT="$file_count" \ TOTAL_LINES="$total_lines" \ ARCHIVE_COUNT="$archive_count" \ AGENTS_LINES="$agents_lines" \ SPECS_COUNT="$specs_count" \ node -e ' const output = { mode: "analyze", workspace: process.env.WORKSPACE_VALUE, memory: { files: Number(process.env.FILE_COUNT), lines: Number(process.env.TOTAL_LINES), archived: Number(process.env.ARCHIVE_COUNT) }, agentsLines: Number(process.env.AGENTS_LINES), specsCount: Number(process.env.SPECS_COUNT) }; console.log(JSON.stringify(output, null, 2)); ' ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: cleanup.sh:166
Finding: Archive Filename Collisions Can Overwrite Existing Memory Files
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi mv -- "$file" "$destination" moved=$((moved + 1)) done ``` ]]>

T09 · Insecure Skill Coding Practices

Note

Location: cleanup.sh:75
Finding: Filename-Unsafe xargs Usage Produces Unintended File Operands
Content: View full analysis
/dev/null | wc -l | tr -d ' ')" ``` The input is produced by: ```bash collect_files() { find "$MEMORY_DIR" -type f -name '*.md' -not -path '*/archive/*' | sort } ``` ### Technical Analysis `find` emits newline-delimited paths, while `xargs` parses whitespace, quotes, and backslashes rather than treating each input line as an opaque filename. Valid filenames containing spaces, quotes, backslashes, tabs, or newlines can therefore be split or transformed into different arguments to `cat`. This can make the analysis count the wrong files or attempt to read unintended paths represented by the parsed fragments. Standard error is discarded, which hides evidence that operands were split or that unintended files could not be opened. The shell does not directly evaluate these filenames as commands, so this issue is not shell command injection. Its primary security effects are incorrect analysis and unintended local file reads by `cat`. ### Attack Path 1. An attacker or local process creates a Markdown file under the memory directory with whitespace, quote, backslash, or newline characters in its filename. 2. `collect_files` writes the path using newline-delimited output. 3. `xargs` interprets portions of the filename as separators or quoting syntax. 4. `cat` receives operands different from the actual filename. 5. The reported total line count becomes inaccurate, or `cat` reads another path represented by the resulting operands. 6. Any errors are hidden by `2>/dev/null`, reducing the likelihood that the behavior is noticed. ### Impact Assessment The principal impact is loss of integrity in the analysis report, which can mislead later cleanup decisions. Under a carefully constructed directory and filename layout, the command may also read uninten ...[truncated 303 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and the body of the skill are written in Chinese, including required workflow and output template text, which effectively constrains use to a specific language/locale. The file does not offer an alternative language, user choice, or a documented justification for the locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script's user-facing messages and confirmation prompt context are presented exclusively in Chinese, including the analysis report, cleanup plan, archive confirmation, and completion messages. This imposes a specific language on users without opt-in or documentation that the tool is intended only for a Chinese-speaking context, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file presents all operational safety instructions exclusively in Chinese, which can impose a language constraint on users who do not read that language. The policy-violation rule applies to all file types and specifically covers forced language or locale without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.