Security audit

cycle-history-viewer

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for viewing local cycle logs, but its file-reading code can follow symlinks and expose unrelated readable JSON files from the machine.

Use this only on workspaces whose logs directory you trust. Before installing broadly, the publisher should harden status-file reads by rejecting symlinks, requiring regular files, enforcing exact status filename patterns, and verifying resolved paths stay inside the workspace logs directory. Review generated reports or JSON exports before sharing them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:27
Finding: Symbolic Link Following Allows Unauthorized Local JSON File Disclosure
Content: View full analysis
f.startsWith('status_') && f.endsWith('.json')) .sort() .reverse(); return files.map(f => { const match = f.match(/status_(\d+)\.json/); const cycle = match ? parseInt(match[1], 10) : 0; const filepath = path.join(logsDir, f); let data = null; try { data = JSON.parse(fs.readFileSync(filepath, 'utf8')); ``` The same unsafe file-reading behavior is present in `get`: ```javascript function get(workspacePath, cycle) { const filepath = path.join(workspacePath, HISTORY_DIR, `status_${String(cycle).padStart(4, '0')}.json`); if (!fs.existsSync(filepath)) { return null; } return JSON.parse(fs.readFileSync(filepath, 'utf8')); } ``` ### Technical Analysis The implementation trusts entries under the workspace's `logs` directory based only on their names. It accepts entries matching the `status_*.json` naming convention and then reads them using `fs.readFileSync`. Node.js file-reading operations follow symbolic links. The code does not use `lstatSync` to reject symbolic links, confirm that entries are regular files, resolve their canonical paths, or verify that the resolved targets remain inside the intended `logs` directory. Consequently, a user who can create or modify entries in the workspace can place a symbolic link such as `logs/status_0001.json` that points to a JSON-formatted file elsewhere on the local filesystem. The linked target will then be read and parsed as if it were an ordinary cycle history file. The affected APIs include: - `listFiles`, which returns the parsed object in each entry's `data` field. - `get`, which directly returns the entire parsed JSON object. - `search`, which can expose selected fields from the parsed object. - `summary` and `generateRep ...[truncated 1647 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The search logic only checks en and zh fields, and later functions also derive intent specifically from English and Chinese text. This imposes a fixed language scope in the skill behavior without any visible user opt-in or documented locale constraint, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file documents generateReport and exportJson, both of which produce shareable outputs from cycle history data, but it does not include any warning about potentially sensitive project information being included in those outputs. Under the markdown criteria for missing user warnings, descriptions should disclose behaviors that could affect privacy or data handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.