hgbvhjgfvgh

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:05 AM UTC
• Version: 1.0.4

Overview

The skill appears to be a simple test coverage reporting helper, but it asks for shell access that its own instructions do not justify.

Install only if you are comfortable granting shell capability to a coverage-reporting skill, or ask the publisher to remove shell permission and keep it to read-only filesystem access. There is no evidence of exfiltration or destructive behavior in the inspected files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:8

Finding

Unnecessary Shell Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–13
Vulnerability Type: Excessive shell capability
Risk Level: Medium

Vulnerable configuration:

yaml

permissions:
  filesystem:
    - read
  network: false
  shell: true

Technical Analysis

The skill requests shell access even though its documented functionality only requires reading source and test files to identify coverage gaps. None of the reviewed instructions or examples require command execution.

Granting an unnecessary shell capability violates the principle of least privilege and expands the consequences of prompt injection, malicious repository content, or future unsafe changes to the skill. An agent operating with this permission could potentially execute arbitrary local commands under the privileges of its host process.

Attack Path

1. A user invokes the skill against a repository containing attacker-controlled text or instructions.
2. The agent reads that content while performing the requested coverage analysis.
3. Crafted content influences the agent to invoke its available shell capability.
4. Commands execute with the operating-system privileges of the agent process.
5. Depending on host permissions, those commands could inspect or alter files and invoke locally available programs.

This path is conditional on the runtime exposing the declared shell capability and the agent being induced to misuse it. No direct command-execution instruction or malicious payload was found in the audited files.

Impact Assessment

Successful exploitation could permit command execution within the security context of the host agent. The accessible scope would depend on the operating-system account, sandbox boundaries, and filesystem controls applied by the runtime. Potential effects include unauthorized access to local files, modification or deletion of writable data, and execution of installed programs.

The configuration ...[truncated 169 chars]

Remediation

View remediation

Remediation Suggestions

• Set shell: false or remove the shell permission entirely.
• Retain only read-only filesystem access required for coverage analysis.
• Restrict filesystem access to the selected project directory when the runtime supports path-scoped permissions.
• If shell execution becomes necessary in a future version, document the required commands, use an explicit allowlist, avoid shell-string interpolation, and run commands inside a restricted sandbox.
• Add a permission-review check to release procedures so new capabilities must be justified by documented functionality.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.