Security audit

Glasses to Social

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it asks users to expose smart-glasses photos through public Google Drive link sharing and lacks clear privacy boundaries for sensitive images.

Review before installing. Use a private, dedicated Google Drive folder containing only photos intentionally submitted for social posting, avoid public link sharing, review images for bystanders and sensitive information before analysis or drafting, and keep posting credentials separate with explicit approval required for every post.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:25
Finding: Public Link Sharing Exposes Potentially Sensitive Wearable-Camera Photos
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mark-processed.sh:17
Finding: Predictable Temporary State File Allows Symlink Overwrite and Concurrent Update Races
Content: View full analysis
"${PROCESSED_FILE}.tmp" mv "${PROCESSED_FILE}.tmp" "$PROCESSED_FILE" ``` ### Technical Analysis The script uses a predictable temporary filename derived directly from the state-file path. Shell redirection opens `${PROCESSED_FILE}.tmp` before `jq` executes and follows symbolic links by default. There is no exclusive file creation, symlink check, restrictive temporary-file permission, cleanup trap, or validation that the temporary path is a regular file owned by the expected user. If another local user can write to the state-file directory, that user can pre-create the predictable temporary path as a symbolic link to another file writable by the account running the script. The redirection can then truncate and replace the linked file's contents with JSON output. The implementation also lacks locking. Two simultaneous invocations can read the same original state, write to the same temporary path, and overwrite or move each other's output, causing lost updates or execution failures. ### Attack Path #### Symlink overwrite 1. An attacker obtains write access to the directory containing `processed.json`. 2. The attacker creates `processed.json.tmp` as a symbolic link to a target file writable by the script's execution account. 3. The victim or an automated process runs `mark-processed.sh`. 4. Shell redirection follows the symbolic link and truncates the target before writing the generated JSON. 5. The subsequent `mv` may replace the processing ledger with the attacker-selected link or fail after the target has already been modified. This path is conditional on the attacker having write access to the state directory and the target being writable by the script's ac ...[truncated 1004 chars]
Remediation: View remediation
"$LOCK_FILE" flock -x 9 STATE_DIR=$(dirname -- "$PROCESSED_FILE") TMP_FILE=$(mktemp "$STATE_DIR/.processed.XXXXXX") trap 'rm -f -- "$TMP_FILE"' EXIT jq --arg f "$FILENAME" \ 'if (.processed | index($f)) then . else .processed += [$f] end' \ "$PROCESSED_FILE" > "$TMP_FILE" mv -- "$TMP_FILE" "$PROCESSED_FILE" trap - EXIT ``` ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/check-new-photos.sh:39
Finding: Unsafe Filename Splitting and Substring Matching Break Photo-State Integrity
Content: View full analysis
/dev/null || true) if [ -z "$NEW_FILES" ]; then echo "No photos found in folder" exit 0 fi # Get list of already processed files PROCESSED=$(jq -r '.processed[]' "$PROCESSED_FILE" 2>/dev/null || echo "") FOUND_NEW=0 # Check each file for FILE in $NEW_FILES; do FILENAME=$(basename "$FILE") # Skip if already processed if echo "$PROCESSED" | grep -qF "$FILENAME"; then continue fi ``` ### Technical Analysis The result of `find` is stored in a shell variable and then expanded without quotes in `for FILE in $NEW_FILES`. Bash performs word splitting and pathname expansion on that value. Consequently, valid filenames containing spaces, tabs, newlines, or wildcard characters are not handled as single paths. The processed-state test also searches a newline-separated collection using `grep -qF`. This performs fixed-string substring matching rather than exact JSON-array membership. For example, a file named `photo.jpg` can be treated as processed when the ledger contains only `old-photo.jpg`. Conversely, malformed path splitting can result in the wrong basename being copied or emitted. The filenames originate from downloaded Google Drive content. Exploitation therefore requires the attacker or another participant to be able to place or rename a file in the monitored folder. The documented sharing setting grants view access rather than upload access, so public-link possession alone does not establish that capability. ### Attack Path 1. An attacker or untrusted collaborator with upload or rename permission places an image in the monitored folder with whitespa ...[truncated 976 chars]
Remediation: View remediation
/dev/null; then continue fi echo "NEW PHOTO FOUND: $FILENAME" cp -- "$FILE" "$DOWNLOAD_DIR/" printf 'NEW_PHOTO_PATH:%s/%s\n' "$DOWNLOAD_DIR" "$FILENAME" FOUND_NEW=1 done < <( find "$TEMP_DIR" -type f \ $ -iname '*.jpg' -o -iname '*.jpeg' -o -iname '*.png' \ -o -iname '*.heic' -o -iname '*.webp' $ -print0 ) ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description uses broad trigger language such as 'Use when setting up...' and 'creating hands-free content workflows,' which can cause the agent to invoke the skill in situations involving sensitive personal images without an explicit suitability check. Because this skill accesses smart-glasses photos and drafts public posts, ambiguous invocation increases the chance of unintended processing or disclosure of private visual data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill handles photos captured by smart glasses, which may contain bystanders, private spaces, documents, screens, or other sensitive content, yet the description provides no clear privacy warning or consent boundary. This omission is dangerous because the workflow encourages automated download, AI analysis, and drafting for publication, creating a meaningful risk of privacy violations or accidental exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This shell script performs a network operation by fetching folder contents from Google Drive, which can transfer remote data onto the local system. Although there is a status print at L34, it does not clearly warn the user about the download behavior or its implications; however, the script name and comments make the purpose fairly apparent, so this is low severity.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.