Self-Correct

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

This skill is a snapshot/self-correction helper, but it includes unsafe recursive deletion and shared temporary snapshot handling that could cause data loss or expose copied files.

Install only if you are comfortable reviewing and hardening the shell snippets first. Replace the shared /tmp snapshot location with a private per-user directory, make snapshot creation fail closed, validate and confirm any deletion target, and avoid wiring cleanup into an automatic heartbeat until retention behavior is explicit and safe.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/snapshot.sh:6

Finding

Predictable Shared Temporary Directory Enables Snapshot Disclosure and Manipulation

Content

View full analysis

Vulnerability Details

File Location: scripts/snapshot.sh:6-18; duplicated in SKILL.md:56-68
Vulnerability Type: Unsafe temporary-file and directory handling
Risk Level: Medium

Vulnerable Code

bash

SNAP_DIR="/tmp/nova-snapshots"

create_snapshot() {
    local desc="${1:-unnamed}"
    local target="${2:-.}"
    
    mkdir -p "$SNAP_DIR"
    local stamp=$(date +%s)
    local snap_path="$SNAP_DIR/${stamp}_${desc}"
    
    if [ -e "$target" ]; then
        cp -r "$target" "$snap_path" 2>/dev/null
        echo "[$(date '+%H:%M:%S')] snapshot created: $snap_path"
        
        # Keep the last three snapshots
        ls -dt "$SNAP_DIR"/*/ 2>/dev/null | tail -n +4 | xargs rm -rf 2>/dev/null

The corresponding implementation documented in SKILL.md is:

bash

nova-snapshot() {
    local desc="${1:- unnamed}"
    local target="${2:-.}"
    local snap_dir="/tmp/nova-snapshots"
    
    mkdir -p "$snap_dir"
    local stamp=$(date +%s)
    local snap_path="$snap_dir/${stamp}_${desc}"
    
    if [ -e "$target" ]; then
        cp -r "$target" "$snap_path" 2>/dev/null
        echo "[$(date '+%H:%M:%S')] snapshot: $snap_path"
        
        # Keep the last three snapshots
        ls -dt "$snap_dir"/*/ 2>/dev/null | tail -n +4 | xargs rm -rf 2>/dev/null
    fi
}

Technical Analysis

The snapshot implementation stores copies in the fixed, globally predictable path /tmp/nova-snapshots. It creates that path with mkdir -p but does not verify that it is a genuine directory owned by the current user, reject symbolic links, or set restrictive permissions.

Snapshot names are based on second-resolution timestamps and a caller-provided description. The implementation does not validate the description or create the destination atomically. A local attacker able to monitor or predict invocation parameters may pre-create the directory or destination entr ...[truncated 1883 chars]

Remediation

View remediation

Remediation Suggestions

• Create a private snapshot root with mktemp -d or use a per-user state directory rather than a shared fixed path.
• Set a restrictive umask, such as umask 077, and enforce directory mode 0700.
• Before every operation, use lstat-equivalent checks to reject symbolic links and verify that the snapshot root is a directory owned by the invoking user.
• Create each snapshot destination atomically with mktemp -d instead of using a second-resolution timestamp.
• Restrict descriptions to a safe character set, such as [A-Za-z0-9._-], and reject path separators and control characters.
• Check the exit status of mkdir and cp; do not print a success message if either operation fails.
• Replace the ls | tail | xargs rm -rf pipeline with controlled iteration over validated entries beneath the verified snapshot root.
• Apply the same corrected implementation to the example in SKILL.md so users are not instructed to reproduce the vulnerability.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:116

Finding

Recursive Deletion Continues When the Protective Snapshot Fails

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:56-68 and SKILL.md:116-122
Vulnerability Type: Unchecked backup failure before destructive operation
Risk Level: High

Vulnerable Code

The snapshot function suppresses copy errors and does not return a reliable failure status:

bash

nova-snapshot() {
    local desc="${1:- unnamed}"
    local target="${2:-.}"
    local snap_dir="/tmp/nova-snapshots"
    
    mkdir -p "$snap_dir"
    local stamp=$(date +%s)
    local snap_path="$snap_dir/${stamp}_${desc}"
    
    if [ -e "$target" ]; then
        cp -r "$target" "$snap_path" 2>/dev/null
        echo "[$(date '+%H:%M:%S')] snapshot: $snap_path"
        
        # Keep the last three snapshots
        ls -dt "$snap_dir"/*/ 2>/dev/null | tail -n +4 | xargs rm -rf 2>/dev/null
    fi
}

The destructive wrapper invokes that function but does not check whether the snapshot succeeded:

bash

batch-rm() {
    local target="$1"
    nova-snapshot "pre_rm_$(date +%Y%m%d_%H%M%S)" "$target"
    rm -rf "$target"
    echo "[$(date '+%H:%M:%S')] batch-rm completed: $target"
}

Technical Analysis

batch-rm presents snapshot creation as protection before recursive deletion, but no control-flow dependency exists between successful backup creation and rm -rf.

Within nova-snapshot, errors from cp -r are hidden by redirecting standard error to /dev/null. The function then prints a snapshot message regardless of whether copying succeeded. It does not explicitly return the copy operation's status. The caller likewise does not test a return value and unconditionally runs rm -rf.

Snapshot creation can fail because of insufficient permissions, exhausted disk space or inodes, invalid destinations, filesystem errors, naming collisions, or manipulation of the shared temporary directory. In each case, the original target can still be deleted without a usable recovery copy. ...[truncated 1484 chars]

Remediation

View remediation

Remediation Suggestions

• Make snapshot creation fail closed and propagate all errors:

bash

nova-snapshot() {
    # Validate inputs and securely create the destination first.
    if ! cp -a -- "$target" "$snap_path"; then
        echo "Snapshot creation failed; deletion aborted" >&2
        return 1
    fi
    return 0
}

• Require explicit success before deletion:

bash

batch-rm() {
    local target="${1:?target is required}"

    if ! nova-snapshot "pre_rm_$(date +%Y%m%d_%H%M%S)" "$target"; then
        echo "Deletion aborted because the snapshot failed" >&2
        return 1
    fi

    rm -rf -- "$target"
}

• Do not suppress snapshot errors; preserve actionable diagnostics for the user or audit log.
• Verify that the snapshot exists, is complete, and is stored on a usable filesystem before deleting the source.
• Canonicalize and validate the target. Reject empty values, /, critical system paths, and paths outside an explicitly approved scope.
• Use -- before path arguments to prevent option interpretation.
• Require explicit user confirmation or a dedicated authorization flag before recursive deletion.
• Consider using a recoverable quarantine or trash operation instead of immediate rm -rf.
• Ensure cleanup failures cannot overwrite the successful status of snapshot creation, and test failure scenarios such as full disks, permission errors, and interrupted copies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

Using ls ... | tail ... | xargs rm -rf to prune snapshots is unsafe because filenames can contain spaces, newlines, or leading dashes, causing incorrect path parsing and unintended deletion. Since the snapshot path incorporates an unsanitized desc parameter, an attacker or caller can craft names that make cleanup delete the wrong targets.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

echo "[$(date '+%H:%M:%S')] snapshot: $snap_path"
        
        # 保留最近3个
        ls -dt "$snap_dir"/*/ 2>/dev/null | tail -n +4 | xargs rm -rf 2>/dev/null
    fi
}

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The cleanup routine uses find ... | xargs rm -rf without null delimiting or additional validation, which is vulnerable to pathname parsing issues and can delete unintended directories if names contain whitespace, newlines, or option-like prefixes. In a shared /tmp location, this raises risk because directory names are less trustworthy and may be influenced by other local users or processes.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

local snap_dir="/tmp/nova-snapshots" [ -d "$snap_dir" ] || return 0 # 删除超过24小时的快照 find "$snap_dir" -maxdepth 1 -type d -mmin +1440 | xargs rm -rf 2>/dev/null echo "[$(date '+%H:%M:%S')] snapshots cleaned" }

text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The pipeline ls ... | tail ... | xargs rm -rf is dangerous because it performs recursive deletion using pathnames derived from shell output without robust delimiting or validation. Since snapshot names incorporate user-controlled desc, crafted names containing whitespace, newlines, or option-like prefixes can cause unintended arguments to be passed to rm, leading to deletion of the wrong paths within the current execution context.

Content

Scanner excerpt · scripts/snapshot.sh (reported line 21)May include surrounding context.

sh

echo "[$(date '+%H:%M:%S')] snapshot created: $snap_path"
        
        # 保留最近3个
        ls -dt "$SNAP_DIR"/*/ 2>/dev/null | tail -n +4 | xargs rm -rf 2>/dev/null
        echo "[$(date '+%H:%M:%S')] cleanup complete (kept last 3)"
    else
        echo "[$(date '+%H:%M:%S')] target not found: $target"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a self-correction/snapshot framework, yet the skill also provides a wrapper around rm -rf. Embedding destructive deletion in a resilience-oriented skill creates a misleading trust boundary and makes accidental or abusive data destruction more likely, especially if consumers assume the skill is only protective.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The batch-rm example performs rm -rf on a caller-provided path with no confirmation, no path validation, and no safety interlocks. Even with a prior snapshot, this can irreversibly delete sensitive data, and snapshots stored in /tmp may be incomplete, inaccessible, or cleaned before recovery.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s stated purpose is self-correction and snapshotting, but it also includes a generic external HTTP request helper using curl. That expands capability beyond the declared scope and can be abused for unintended outbound network access, data exfiltration, or interaction with untrusted endpoints under the guise of recovery logic.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a lightweight self-correction/snapshot mechanism focused on preserving state before risky actions. This script not only creates snapshots but also deletes prior snapshot directories automatically, which is a materially broader behavior than simple snapshot preservation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script automatically removes older snapshot directories using rm -rf, but there is no prior warning, confirmation prompt, or comment/disclosure indicating that creating a snapshot will also delete older ones. Although a post-action log is printed, the user is not clearly warned before the destructive operation occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description emphasizes saving state snapshots before high-risk operations, but the cleanup function removes existing snapshots based on age. Deleting historical recovery data is a distinct lifecycle-management behavior that should be declared if it is part of the skill’s intended scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cleanup_snapshots function uses find ... -exec rm -rf to delete snapshot directories older than 24 hours. The script does not provide a clear warning or confirmation before performing this irreversible cleanup, and the brief usage text does not disclose that cleanup deletes data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's description and operational instructions are presented exclusively in Chinese, which effectively forces a specific language on users. There is no indication that the user can choose another language or that the locale restriction is intentionally justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language strings in comments and usage guidance include Chinese-only phrasing, which can impose a language expectation without user opt-in. The policy allows locale constraints when explicitly documented and justified, but this file does not explain or offer a language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.