Security audit
Security checks for vulnerabilities and agentic risk
The skill is a real disk-usage reporter, but it needs Review because its read-only framing includes a sudo installer that can take a password from stdin.
Install only if you are comfortable with a disk-audit tool writing raw exports and reports that may contain sensitive path names. Do not pipe sudo passwords into the helper installer; install ncdu manually or review scripts/linux/install_ncdu.sh first, and prefer narrow scan paths over whole drives unless you explicitly want full-machine metadata captured.
The documented behavior includes helper scripts that prepare files and may change permissions, which contradicts the skill's repeated claim that it never changes files automatically. In security-sensitive automation, hidden repository maintenance or permission changes are dangerous because they expand the blast radius beyond simple disk-usage inspection.
The documented behavior includes helper scripts that prepare files and may change permissions, which contradicts the skill's repeated claim that it never changes files automatically. In security-sensitive automation, hidden repository maintenance or permission changes are dangerous because they expand the blast radius beyond simple disk-usage inspection.
The documented behavior includes helper scripts that prepare files and may change permissions, which contradicts the skill's repeated claim that it never changes files automatically. In security-sensitive automation, hidden repository maintenance or permission changes are dangerous because they expand the blast radius beyond simple disk-usage inspection.
The documented behavior includes helper scripts that prepare files and may change permissions, which contradicts the skill's repeated claim that it never changes files automatically. In security-sensitive automation, hidden repository maintenance or permission changes are dangerous because they expand the blast radius beyond simple disk-usage inspection.
The plan explicitly instructs modification of skills/DirStat_Skill/SKILL.md, which is a form of self-modification of the agent's own skill definition. Even though the apparent purpose is documentation upkeep, allowing a skill or its execution plan to rewrite its own operational guidance can weaken trust boundaries, enable persistence of unsafe behavior, or permit future instruction drift if a compromised plan is followed.
- [ ] **Step 2: Update skill workflow**
```md
Read `review_report.md` first, then `review_candidates.csv`, then `candidates.json` for machine-readable detail.
The plan includes SSH-based execution on a DGX host even though the skill is described as a local disk-audit tool. Introducing remote execution expands the trust boundary, can expose filesystem metadata from another machine, and creates a path for unintended access to sensitive infrastructure if an operator follows the instructions blindly.
The script performs privileged package installation even though the skill is described as a non-modifying disk-usage auditing capability. This expands the trust boundary from read-only analysis to system modification and can surprise operators or downstream automation that expected no privileged changes.
The script reads a sudo password from stdin and reuses it to execute privileged commands, creating a credential-handling anti-pattern that can expose secrets through pipelines, orchestration logs, process monitoring, or accidental reuse. This is especially dangerous because the skill's stated purpose does not justify collecting administrator credentials.
The pipeline sends a captured password directly into sudo, chaining secret input to privileged execution in a way that bypasses normal interactive safeguards. This is dangerous because it enables hidden elevation flows and increases exposure of administrative credentials across tooling boundaries.
exit 5
fi
printf '%s\n' "$SUDO_PASSWORD" | sudo -S -p '' apt-get update
printf '%s\n' "$SUDO_PASSWORD" | sudo -S -p '' apt-get install -y ncdu
This chained pipeline combines password handling and root-level installation in a single opaque command, making misuse and credential leakage more likely. Within a disk-auditing skill, this is especially inappropriate because the context does not justify hidden privileged execution.
fi
printf '%s\n' "$SUDO_PASSWORD" | sudo -S -p '' apt-get update
printf '%s\n' "$SUDO_PASSWORD" | sudo -S -p '' apt-get install -y ncdu
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def test_python_module_cli_writes_summary_files(tmp_path: Path) -> None:
export_path = Path("tests/fixtures/ncdu_minimal_export.json")
output_dir = tmp_path / "module-run"
env = os.environ.copy()
env["PYTHONPATH"] = str(Path.cwd() / "src")
result = subprocess.run(
The skill declares shell, environment, file-read, and file-write capabilities through its documented workflow, but it does not define any explicit tool scope or permission boundaries. In an agent setting, this increases the risk that the skill can be invoked with broader execution authority than intended, especially since several commands write outputs and run helper scripts.
The plan instructs the agent to perform git push and an ssh command against a remote host, which are actions unrelated to the stated DirStat skill purpose of local disk-usage auditing and review-only reporting. Including networked state-changing operations in a skill plan expands authority beyond least privilege and could cause unintended code publication or remote command execution if followed automatically.
The plan claims a read-only audit pipeline, yet later includes privileged package installation. This mismatch is dangerous because operators or downstream agents may trust the read-only claim and approve execution without recognizing that the skill can alter the host.
The skill is described as a read-only disk-audit tool, but its file structure explicitly includes an installer script for ncdu. That expands scope from inspection to host modification and introduces package-management side effects that are unnecessary for a reporting skill, increasing the chance of unintended system changes or abuse.
Referencing a guarded installer that depends on sudo indicates the skill includes a root-capable execution path. In the context of a disk-audit skill, that privilege is not operationally necessary and increases risk if the skill is triggered in an automated or loosely supervised environment.
- `Z:\Repositories\DirStat_Skill\scripts\dgx\verify_ncdu.sh`
- fail-fast verification of `ncdu` presence on DGX
- `Z:\Repositories\DirStat_Skill\scripts\dgx\install_ncdu.sh`
- guarded installer that stops if unattended sudo is unavailable
- `Z:\Repositories\DirStat_Skill\scripts\dgx\run_audit.sh`
- live read-only export launcher
- `Z:\Repositories\DirStat_Skill\tests\fixtures\ncdu_minimal_export.json`
This section adds a privileged package-install path using sudo apt-get for a tool that only needs to read disk usage. Even with a sudo availability check, the script still performs system modification under elevated privileges, which contradicts least privilege and creates an unnecessary escalation path in an agent skill.
The sudo -n true probe is part of a privilege-gated installation flow, confirming the skill actively checks for root-capable execution. Such checks normalize privilege escalation inside a tool whose stated function is only to inspect and summarize disk usage.
exit 0
fi
if ! sudo -n true >/dev/null 2>&1; then
echo "ERROR: sudo password required; installation must be performed with operator input" >&2
exit 4
fi
This line itself is only an error message about requiring operator input for sudo, so it is not independently dangerous. The underlying risk comes from the surrounding installer logic, but the message text alone does not add exploitability.
fi
if ! sudo -n true >/dev/null 2>&1; then
echo "ERROR: sudo password required; installation must be performed with operator input" >&2
exit 4
fi
Running sudo apt-get update performs a privileged system change and network-facing package metadata refresh. Embedding this in a disk-audit skill creates unnecessary root execution and broadens the blast radius from read-only analysis to host administration.
exit 4 fi
sudo apt-get update sudo apt-get install -y ncdu
Running sudo apt-get install -y ncdu directly modifies the host under elevated privileges. For a skill advertised as non-changing/read-only, this is an unjustified privileged action that could be misused or accidentally executed on sensitive systems.
fi
sudo apt-get update sudo apt-get install -y ncdu
```bash
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
bash scripts/dgx/verify_ncdu.shbash scripts/dgx/install_ncdu.shbash scripts/dgx/run_audit.shscripts/dgx/install_ncdu.sh exits 4, pause and request operator sudo input
- [ ] **Step 7: Commit**
The plan describes the skill as 'public' and 'read-only', but it explicitly writes exports, reports, and log files to disk. While this does not automatically imply destructive behavior, it is a security-relevant mismatch because operators may assume no filesystem side effects and inadvertently expose sensitive file metadata in generated artifacts.
The plan instructs users to audit entire system drives such as C:\ and D:, and to run Linux audits, without prominent warnings about scan scope, runtime cost, permission errors, or the fact that reports and logs may capture sensitive file names and paths. In a disk-audit context this is especially risky because broad scans can reveal metadata across user profiles, applications, and system areas.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## Naming
- repository identity: `DirStat_Skill`
- skill path: `skills/DirStat_Skill/SKILL.md`
- Python package: `dirstat_skill`
- review outputs: `review_report.md` and `review_candidates.csv`
No suspicious patterns detected.