Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
File Hasher
Security checks for vulnerabilities and agentic risk
Overview
This is a local file-hashing utility whose behavior matches its stated purpose, with a caution that it presents weak hash algorithms without warning.
Reasonable to install for local checksum work. Prefer SHA-256 or SHA-512 for security-sensitive verification, avoid relying on MD5 or SHA-1 except for legacy compatibility, and only run recursive directory hashing on folders you intend the tool to read.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (22)
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
python3 scripts/file_hasher.py hash myfile.txt
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Missing User Warnings
Medium
- Confidence
- 91% confidence
- Finding
- The file advertises MD5 and SHA-1 alongside stronger algorithms for integrity verification, but nowhere warns users that MD5 and SHA-1 are collision-broken and inappropriate for security-sensitive verification. Because this is a hashing/integrity tool, presenting these algorithms without disclosure can mislead users into unsafe use.
Static analysis
No suspicious patterns detected.