Security audit

Simple File Tree

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple file-tree viewer, but its helper script can treat a crafted folder name as a destructive find action, so it needs Review before use.

Install only if you are comfortable reviewing or fixing the helper script first. A safer version should normalize the directory to an absolute path, use cd -- or reject leading-hyphen paths, and make the find action explicitly read-only with -print.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: run.sh:14
Finding: Find Expression Injection Through a Leading-Hyphen Directory Argument
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi if [[ ! "$DEPTH" =~ ^[1-9][0-9]*$ ]]; then echo "ERROR: DEPTH must be a positive integer, got: $DEPTH" >&2 exit 1 fi DIR_PATH="$(cd -- "$DIR_PATH" && pwd -P)" find "$DIR_PATH" -maxdepth "$DEPTH" -print | sort | sed 's|[^/]*/| |g' ``` Additional hardening measures include: 1. Reject directory arguments beginning with `-`, unless they have first been normalized into an absolute path. 2. Use `cd -- "$DIR_PATH"` so a leading-hyphen path cannot be interpreted as an option by `cd`. 3. Explicitly include `-print` to make the intended read-only `find` action clear. 4. Test the script against adversarial names such as `-delete`, `-exec`, spaces, newlines, wildcard characters, and names beginning with multiple hyphens. 5. Run the skill with the least-privileged account necessary and avoid invoking it from attacker-writable working directories. 6. Use a null-delimited pipeline if reliable handling of filenames containing newlines is required, although this is separate from the destructive expression-injection issue. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manual consistently presents all headings and instructions in English and Korean, which reflects a fixed language/locale choice rather than an explicit user-selectable preference. Under the policy rule, locale constraints should be optional or clearly justified if the skill is not specifically region-bound.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.