PrivateBin Upload Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:19 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent PrivateBin upload purpose, but it can send user content to an external share link too easily and gives unsafe shell-command examples.

Only install this if you are comfortable with an agent uploading selected content to a PrivateBin server and producing a link that can grant access. Before use, require explicit confirmation of the target instance and sharing settings, avoid uploading secrets or proprietary files, prefer a trusted self-hosted instance, pin reviewed dependency versions, and ensure the agent invokes the CLI without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: package.json:20
• Finding: Unpinned Third-Party Installation and Dependency Versions## Vulnerability Details **File Location**: `README.md:14-18`; `package.json:20-22` **Vulnerability Type**: Supply-chain exposure through mutable third-party dependencies **Risk Level**: Medium **Complete Code Snippets**: `README.md:14-18` ```bash ## Install Skill npx skills add KafCoppelia/privatebin-upload-skill ``` `package.json:20-22` ```json "dependencies": { "privatebin-cli": ">=1.0.0" }, ``` ### Technical Analysis The documented `npx skills add` command retrieves and processes a remotely maintained project without pinning an immutable commit or verified artifact. In addition, the `privatebin-cli` dependency accepts every version from `1.0.0` onward. Consequently, the code installed in the future can differ from the code reviewed during this audit. This does not establish that either current upstream project is malicious. The risk is that a compromised maintainer account, repository, registry package, or later release could introduce malicious installation behavior. Depending on the package manager and installation workflow, lifecycle scripts or equivalent setup logic may execute during installation. The external badge links in `README.md:9-10` do not themselves download or execute an executable. The prebuilt-download link at `README.md:34` points to the declared CLI project's GitHub releases rather than a pastebin or an opaque direct executable. The substantive concern is the absence of version and integrity pinning, not evidence of a currently malicious payload. ### Attack Path 1. An attacker compromises the relevant repository, package registry entry, maintainer account, or a future accepted dependency release. 2. The attacker publishes malicious code under a version accepted by `>=1.0.0`, or changes the repository state resolved by the unpinned installation command. 3. A user follows the documented installation instructions. 4. The package manager or skill installer retrieves the chang ...[truncated 627 chars]
• Remediation: ## Remediation Suggestions 1. Replace the dependency range with an exact, reviewed version, for example `"privatebin-cli": "1.0.0"`. 2. Commit a lockfile containing integrity hashes where the relevant package manager supports them. 3. Pin skill installation to a reviewed immutable commit or signed release rather than a mutable repository reference. 4. Verify release signatures or published checksums before installing prebuilt CLI artifacts. 5. Document the expected package publisher and repository identity so users can detect dependency confusion or impersonation. 6. Review package lifecycle scripts and, where practical, install with lifecycle scripts disabled until their contents have been verified. 7. Run installation without administrative privileges and in a constrained environment.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:52
• Finding: Unsafe Shell Command Templates Permit Command Injection## Vulnerability Details **File Location**: `SKILL.md:52-59` **Vulnerability Type**: Shell command injection through unsafe interpolation of content, paths, and flags **Risk Level**: High **Complete Code Snippet**: ```bash 4. **Run upload** — Use `--output=json` as global flag (before `create`): ```bash # Text/code via stdin printf '%s' "<content>" | privatebin --output=json create [flags] # From file privatebin --output=json create --filename=/path/to/file [flags] ``` The immediately following attachment command uses the same unsafe filename and flag pattern: ```bash # File attachment privatebin --output=json create --attachment --filename=/path/to/file [flags] ``` ### Technical Analysis The Skill instructs an agent to construct shell commands containing user-controlled content, filenames, and inferred flags. Merely placing a placeholder between double quotes is not a safe execution boundary if the agent replaces that placeholder by generating a command string. For example, content containing a double quote followed by shell operators can terminate the intended quoted argument and introduce another command. Shell substitutions inside double quotes may also be evaluated if copied into the command text. Filenames can similarly be dangerous when inserted into `--filename=/path/to/file` without argument-safe process invocation. The open-ended `[flags]` placeholder creates an additional injection surface unless every flag and value is selected from a strict allowlist. The Skill only needs to execute the PrivateBin CLI and send data to its standard input. Invocation through a shell with interpolated data therefore exceeds the minimum mechanism necessary for the declared upload functionality. ### Attack Path 1. A user supplies text containing shell metacharacters, quote termination, or command substitution syntax, or identifies a file with a maliciously constructed path. 2. The agent follo ...[truncated 1139 chars]
• Remediation: ## Remediation Suggestions 1. Do not build a shell command by interpolating content, filenames, passwords, hosts, or option values. 2. Invoke the `privatebin` executable through a process API using a fixed argument array and with shell processing disabled. 3. Send paste content directly to the child process's standard input as raw data. 4. Pass filenames as individual arguments. Use an end-of-options marker where supported and reject NUL characters or invalid paths. 5. Construct options only from strict allowlists. In particular, validate expiry and formatter values against the documented enumerations and represent Boolean options as fixed flags. 6. Treat instance names and host values as data, validate their expected syntax, and never concatenate them into shell text. 7. Avoid passing passwords on the command line where they may appear in process listings or logs. Prefer a protected standard-input or environment mechanism supported by the CLI. 8. Update `SKILL.md` to explicitly prohibit shell interpolation and provide an argument-array example appropriate to the agent runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The description says the skill uploads content to any PrivateBin instance and returns a shareable link, but it does not prominently warn that user data leaves the local environment and is transmitted to an external server. This omission is particularly dangerous here because the core purpose of the skill is external sharing, so users or agents may disclose secrets, proprietary code, personal data, or internal reports without informed consent.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
privatebin init                                        # default: privatebin.net
privatebin init --host https://bin.example.com         # custom host
privatebin init --host https://bin.example.com --force # overwrite existing
```

Config file (`~/.config/privatebin/config.json`):

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are very broad and overlap with common user requests to share reports, code, or files, increasing the chance the agent invokes this skill automatically without clearly surfacing that data will be sent to an external paste service. In this skill's context, unintended activation is more dangerous because it can cause exfiltration of potentially sensitive content to a third-party PrivateBin instance and generate a shareable link.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly facilitates uploading user-provided text or files to an external PrivateBin server, but the description does not warn that this transfers potentially sensitive content and related metadata off the local system. Users may unknowingly disclose secrets, proprietary code, personal data, or internal reports to a third-party service because the skill presents the action as a normal sharing workflow without any privacy warning.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to extract and return the paste URL and references password usage, but it does not warn that the paste URL fragment, password, and delete token are effectively sensitive access/control secrets. Mishandling these values in logs, chat history, screenshots, or follow-on automation could allow unauthorized access to the paste or deletion of the shared content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The description says the skill uploads content and returns a link, but it does not clearly warn that data is sent to an external PrivateBin instance and becomes accessible through a shareable URL. This lack of disclosure is risky because users may provide sensitive text, code, reports, or files assuming local handling, when the skill actually publishes them to a third-party service.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad phrases such as 'upload deliverable' and 'generate shareable link' that can activate the skill for generic sharing requests, not just explicit PrivateBin use. In a skill that exfiltrates user-provided content to an external service, overbroad activation increases the chance of unintended uploads of sensitive data without clear user awareness or consent.

Static analysis

No suspicious patterns detected.