Compress

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:20 PM UTC
• Version: 1.0.0

Overview

This skill is a documentation-only text compression guide with one unsafe temporary-file example users should avoid or harden.

Install is reasonable for normal use, but do not run the /tmp validation snippet on confidential text as written. If using those checks, compare in memory or use a private mktemp-created directory with restrictive permissions and cleanup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: validation.md:40

Finding

Predictable Temporary Files Permit Symlink-Based File Clobbering

Content

View full analysis

Vulnerability Details

File Location: validation.md, lines 40–41
Vulnerability Type: Predictable temporary-file creation and unsafe shell redirection
Risk Level: Medium

Vulnerable Code

bash

extract_entities "$original" > /tmp/orig_ents
extract_entities "$reconstructed" > /tmp/recon_ents

Technical Analysis

The documented validation commands write to fixed, globally predictable paths in /tmp. On a shared system, an attacker can pre-create either path as a symbolic link to another file writable by the user running the skill.

Standard shell output redirection follows symbolic links and opens the linked target with truncation enabled. Consequently, running either command can overwrite the symlink target with the output of extract_entities. The fixed names also allow concurrent validation runs to overwrite one another, potentially corrupting or manipulating validation results.

Although these commands appear in documentation rather than an executable script, an agent or user following the skill instructions may execute them directly.

Attack Path

1. The attacker has local access to the same host and can write to /tmp.
2. The attacker predicts the documented path, such as /tmp/orig_ents.
3. Before validation begins, the attacker creates a symbolic link:

   bash

   ln -s /path/to/victim-writable-file /tmp/orig_ents
   

4. The victim or agent executes the documented validation command.
5. Shell redirection follows the symbolic link and truncates or overwrites the linked file using the victim's privileges.
6. Alternatively, the attacker races or replaces the temporary files to inject fabricated entity data and influence the subsequent comparison.

Impact Assessment

Successful exploitation permits file clobbering within the permissions of the account running the validation procedure. It does not independently grant higher privileges, but it can corrupt user-owned data, application configuration, or other writable ...[truncated 318 chars]

Remediation

View remediation

Remediation Suggestions

Create a unique private temporary directory, store all intermediate files inside it, and ensure cleanup occurs on every exit path:

bash

tmpdir="$(mktemp -d)" || {
    printf '%s\n' "Failed to create a temporary directory" >&2
    exit 1
}
chmod 700 "$tmpdir"
trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM

extract_entities "$original" > "$tmpdir/orig_ents"
extract_entities "$reconstructed" > "$tmpdir/recon_ents"
diff -- "$tmpdir/orig_ents" "$tmpdir/recon_ents"

Additional hardening measures:

• Do not use fixed filenames in shared temporary directories.
• Check the exit status of mktemp, extraction commands, and diff.
• Run the validation process with least privilege.
• Prefer in-memory pipelines where persistent intermediate files are unnecessary.
• If direct file creation is unavoidable, use exclusive creation semantics and reject symbolic links.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes shell-based validation steps and process substitution that are outside the core role of semantic text compression and encourage handling user-derived content via OS commands. In an agent setting, this can normalize or induce execution of external tooling on potentially sensitive text, creating risk of command misuse, data exposure, or unsafe operational behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented workflow writes extracted entities from original and reconstructed text into /tmp, which may expose sensitive content in a shared or recoverable filesystem location. Because compression inputs may contain confidential data, these temporary files can leak information to other local users, logs, backups, or later processes if not securely controlled and deleted.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: metrics.md:64