Cat

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This cat-care skill is coherent and local-first, with disclosed optional memory storage and no evidence of external data sending or hidden execution.

Install only if you are comfortable storing cat-care records locally under ~/cat/. Avoid putting highly sensitive documents or contact details in memory unless needed, and use simple cat folder names without slashes, dot-dot sequences, or path-like characters.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:36
• Finding: Unsanitized Cat Name Used in Filesystem Paths## Vulnerability Details **File Location**: `memory-template.md:36-39` **Vulnerability Type**: Path traversal through an unsanitized user-controlled directory name **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Create `~/cat/cats/{name}/profile.md` with this structure: ```markdown # {Name} ``` The value substituted for `{name}` originates from roster collection in `setup.md:25-29`: ```markdown 4. Identify the current roster: - each cat's name - age or age range - indoor or outdoor status - major conditions, meds, or allergies already known ``` ### Technical Analysis The Skill instructs the Agent to place each cat's records in a directory derived directly from the cat's user-provided name. It does not require validation, canonicalization, or a containment check before using that value as a path component. A crafted name containing path separators, `..` traversal components, or an absolute-path-like value could cause an implementing Agent to resolve the destination outside `~/cat/cats/`. This conflicts with the declared storage boundary in `SKILL.md:175-176`, which states that the Skill does not access files outside `~/cat/` for storage. The issue is contingent on the hosting Agent performing filesystem writes by directly substituting the supplied name into the documented path. No executable implementation is included in the project, so successful exploitation depends on how the host interprets these instructions. ### Attack Path 1. The user approves local memory storage during setup. 2. The Skill asks for each cat's name as part of roster collection. 3. An attacker supplies a crafted name containing traversal components, such as `../../target-directory`. 4. The Agent substitutes that value into `~/cat/cats/{name}/profile.md`. 5. The filesystem resolves the traversal components and produces a destination outside the intended `~/cat/cats/` directory. 6. The Agent creates or overwrites a file at that unintended location, subje ...[truncated 641 chars]
• Remediation: ## Remediation Suggestions - Convert display names into separate filesystem-safe identifiers rather than using names directly. - Restrict identifiers to a conservative allowlist such as `[A-Za-z0-9_-]+`. - Reject absolute paths, path separators, null bytes, `.` and `..` components, and platform-specific reserved names. - Resolve the complete destination to a canonical path before every filesystem operation. - Verify that the canonical destination remains strictly beneath the canonical `~/cat/cats/` directory. - Refuse the write and request a different identifier if validation or containment checks fail. - Preserve the original cat name only as content inside `profile.md`, not as an unchecked path component. - Define collision handling for different names that normalize to the same identifier. - Add explicit instructions to `setup.md`, `memory-template.md`, and `records.md` requiring these controls for every per-cat file operation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly directs storage of durable identity, health, logistics, insurance, contact, and document information for pets and households, but it provides no notice about privacy sensitivity, retention limits, or user controls. This creates a real privacy and data-governance risk because users may disclose sensitive household data without understanding how long it is kept, who can access it, or whether storage is optional and scoped.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
mkdir -p ~/cat/cats ~/cat/sitter-packs
touch ~/cat/memory.md ~/cat/shopping.md
chmod 700 ~/cat
```
3. If approved and `memory.md` is empty, initialize from `memory-template.md`.
4. Identify the current roster:

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The example preference "Use cat automatically whenever I talk about Luna or cat care" would activate on any mention of a specific cat or general cat care, which could occur in ordinary conversation beyond intended skill use. Although the file asks the user to choose an activation mode, this example still demonstrates an overly broad automatic trigger without clear exclusions or negative examples.

Static analysis

No suspicious patterns detected.