Automate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:42 PM UTC
• Version: 1.0.0

Overview

The skill is a disclosed automation guide, but its reusable templates include risky file-changing, credential-using, network, and Git-publishing commands without enough guardrails.

Review this skill before installing. It does not appear to install or run hidden code, but users should treat its templates as unsafe drafts: add dry-runs and confirmations, inspect git status before any push, pin npx dependencies, avoid automatic credential retrieval, and restrict network requests to trusted destinations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: templates.md:42

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: templates.md, lines 42-45
Vulnerability Type: Unpinned package retrieval and execution
Risk Level: Medium

Vulnerable Code

bash

### JSON Schema Check
```bash
# Usage: ./validate.sh data.json schema.json
npx ajv validate -s "$2" -d "$1"

Technical Analysis

The template invokes npx ajv without an exact package version, project lockfile, integrity verification, or the --no-install option. If the required executable is not already installed locally, npx can retrieve a package from the configured package registry and execute its code.

This makes the effective executable dependent on mutable external registry state rather than reviewed project content. It also creates package-selection ambiguity because the expected executable and package are not explicitly pinned. A compromised package release, registry account, registry configuration, or dependency chain could therefore introduce arbitrary code during what appears to be a local validation operation.

Attack Path

1. A user copies the JSON schema validation template into an executable script.
2. The expected package is not installed in the local project.
3. The user runs the script to validate a JSON document.
4. npx resolves and downloads the unpinned package or associated dependencies from the configured registry.
5. Package installation hooks or the selected CLI execute under the user's account.
6. If the retrieved package is compromised, it can perform arbitrary actions available to that account.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the script. The accessible scope may include project files, source repositories, environment variables, user-readable credentials, and network resources available to that user. The template does not itself elevate privileges, so the direct impact remains bounded by the invoking ac ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

• Add the intended CLI package to a reviewed project manifest using an exact version.
• Commit and enforce the corresponding lockfile and package integrity metadata.
• Invoke only the locally installed executable, such as with npx --no-install.
• Use the explicit, verified package name rather than relying on executable-name resolution.
• Disable package lifecycle scripts during installation where operationally possible.
• Perform dependency scanning and review version upgrades before deployment.
• Run validation in a restricted environment without sensitive credentials or unnecessary filesystem access.

T09 · Insecure Skill Coding Practices

Error

• Location: templates.md:31

Finding

Unsafe User Input Interpolation into a sed Program

Content

View full analysis

Vulnerability Details

File Location: templates.md, lines 31-34
Vulnerability Type: Command-language injection and unsafe file modification
Risk Level: High

Vulnerable Code

bash

### Find and Replace
```bash
# Usage: ./replace.sh 'old' 'new' '*.md'
find . -name "$3" -exec sed -i '' "s/$1/$2/g" {} +

Technical Analysis

The search value in $1 and replacement value in $2 are interpolated directly into a dynamically constructed sed program. Neither value is escaped for the selected delimiter, regular-expression syntax, replacement-string syntax, or additional sed commands.

An input containing /, backslashes, newlines, command separators, flags, or implementation-specific sed syntax can change the generated program rather than being processed as literal text. At minimum, this can cause syntax errors or unintended replacement behavior across every file matched beneath the current directory. On sed implementations that support commands or flags capable of invoking the shell, carefully crafted input may turn the program alteration into command execution.

The use of sed -i '' is also platform-dependent. It follows BSD-style in-place editing syntax and may behave differently or fail on other implementations, increasing the probability of unsafe or unexpected file handling.

Attack Path

1. An attacker influences the search string, replacement string, or instructions given to a user adopting the template.
2. The user invokes the script with the attacker-controlled value.
3. Shell expansion inserts that value directly into the quoted sed expression.
4. Embedded delimiters or sed syntax terminate or alter the intended substitution command.
5. The modified program is applied in place to every file selected by find.
6. This corrupts matched files or, where supported by the local sed implementation, invokes commands with the user's privileges.

Impact Assessment

The ...[truncated 529 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a sed program from untrusted input.
• For literal replacement, use a language API that accepts search and replacement values as data, such as a carefully implemented Python script.
• If regular expressions are required, validate them separately and escape delimiters, backslashes, replacement metacharacters, and line breaks correctly.
• Reject unsupported control characters and implementation-specific command syntax.
• Restrict processing to an explicit base directory and reviewed file extensions.
• Preview changes before applying them and create recoverable backups.
• Use a platform-specific, tested in-place-editing implementation rather than assuming that sed -i syntax is portable.
• Run the operation with least privilege and fail immediately if any input or file operation is invalid.

T09 · Insecure Skill Coding Practices

Warning

• Location: templates.md:24

Finding

Unsafe Batch Rename Permits Unintended Paths and File Replacement

Content

View full analysis

Vulnerability Details

File Location: templates.md, lines 24-27
Vulnerability Type: Unsafe pathname handling and destructive file operations
Risk Level: Medium

Vulnerable Code

bash

### Batch Rename
```bash
# Usage: ./rename.sh '*.txt' 'prefix_'
for f in $1; do mv "$f" "$2$f"; done

Technical Analysis

The first parameter is deliberately expanded without quotes, causing shell word splitting and pathname expansion. This does not safely preserve filenames containing spaces, tabs, newlines, or wildcard characters. The destination is then assembled from the unvalidated prefix in $2 and the expanded filename.

The script does not constrain either argument to an intended directory, reject path separators, detect destination collisions, prevent replacement of existing files, or use -- to terminate command options. Consequently, crafted parameters or hostile filenames can make the operation target unintended paths, overwrite existing files depending on platform and configuration, or cause filenames beginning with a hyphen to be interpreted as options.

Attack Path

1. An attacker creates specially named files in the processed directory or influences the pattern or prefix supplied to the script.
2. The shell applies word splitting and glob expansion to the unquoted $1.
3. The script constructs destination paths from the unchecked $2 value and expanded filenames.
4. mv receives unintended arguments, option-like filenames, or destinations that already exist.
5. Files are renamed to unintended locations, replace existing writable files, or are processed inconsistently.

Impact Assessment

Exploitation can cause loss, replacement, or relocation of files writable by the invoking user. The affected scope includes files selected by expansion and destination paths constructible from the supplied prefix. The script does not grant additional privileges, so it cannot directly modify files un ...[truncated 34 chars]

Remediation

View remediation

Remediation Suggestions

• Validate the source pattern and reject unexpected path separators or traversal components.
• Validate the prefix against a strict allowlist appropriate to filenames.
• Preserve filenames safely with null-delimited input, arrays, or a controlled find -print0 loop.
• Invoke mv with an option terminator, such as mv -- "$source" "$destination".
• Refuse to replace an existing destination by using explicit collision checks or supported no-clobber behavior.
• Constrain source and destination paths to an explicitly resolved base directory.
• Log each planned rename and provide a dry-run mode before making changes.
• Exit on the first error and report partial completion clearly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The link checker extracts URLs from a file and pipes them directly into curl, creating an SSRF-style chaining pattern where untrusted document content controls outbound network requests. If used on attacker-influenced files, this can trigger requests to internal services, metadata endpoints, or tracking URLs, causing network exposure or information leakage.

Content

Scanner excerpt · templates.md (reported line 57)May include surrounding context.

bash

#!/bin/bash
# Usage: ./check-links.sh file.md
grep -oE 'https?://[^ ]+' "$1" | xargs -I {} curl -s -o /dev/null -w "%{http_code} {}\n" {}

Git Workflows

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file defines triggers such as noticing yourself doing the same task twice, writing similar prompts repeatedly, or formatting output the same way, but it does not bound these cues to a specific context or provide exclusion conditions. Because these are common everyday work patterns, the trigger scope is overly broad and could cause unintended invocation of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The batch rename and find-and-replace templates can modify many files in place and do not include backups, previews, quoting-safe iteration, or user warnings. In a template library intended for reuse, such patterns can lead to destructive bulk changes, accidental renames, or corruption when applied to unexpected filenames or broad glob patterns.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Git automation examples stage all changes, commit, and push to a remote, as well as create pull requests, without any warning or verification. These are high-consequence operations that can leak accidental changes, publish sensitive content, or modify production repositories if reused carelessly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The PR automation template performs git push and creates a pull request against a remote repository, enabling external state changes beyond simple local automation examples. Because the skill is positioned as general token-saving automation, including repository-modifying remote actions without guardrails can normalize risky use in sensitive repos or unintended branches.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The authenticated API template retrieves a stored credential from the macOS keychain and immediately uses it in a network request to an external endpoint. In an automation-focused skill, providing credential-access and outbound authenticated request patterns without strong scoping, warnings, or justification increases the chance of secret misuse or overbroad exfiltration workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API templates access a stored token and send authenticated requests over the network with no warning, approval step, or restriction on use. This materially raises the risk of secret exposure, unintended access to sensitive APIs, and normalization of automation patterns that combine local credential retrieval with outbound requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.