Windows Terminal Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This skill is a broad Windows command runner, but it does not include the runner it tells agents to execute and makes unsupported security claims.

Review before installing. Only use this skill if you understand that it may run commands with your normal Windows account permissions, and do not rely on the stated timeout, sanitization, workspace, or interactive-command protections unless a trusted run-command.ps1 implementation is provided and invoked by a verified path.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:19
• Finding: Unqualified Invocation of an Absent Command Runner Permits Tool Spoofing## Vulnerability Details **File Location**: `SKILL.md`, lines 19-25 **Vulnerability Type**: Unqualified tool resolution and missing trusted implementation **Risk Level**: Medium ```powershell # Check git status run-command.ps1 -Command "git status" -WorkingDirectory "C:\Users\kanja\projects\my-app" # Install dependencies run-command.ps1 -Command "npm install" -WorkingDirectory "C:\Users\kanja\projects\my-app" -TimeoutSeconds 60 # Run a dev server (non-blocking) run-command.ps1 -Command "npm run dev" -WorkingDirectory "C:\Users\kanja\projects\my-app" ``` ### Technical Analysis The skill repeatedly instructs an agent to invoke `run-command.ps1` by an unqualified command name. However, the audited project contains only `SKILL.md`; no trusted implementation of `run-command.ps1` is included. Consequently, command resolution depends on the surrounding PowerShell environment, including commands available through configured search paths or other resolvable command definitions. An attacker who can introduce a malicious command with this name into a location or scope searched before the intended implementation could cause legitimate-looking skill invocations to execute attacker-controlled logic. The document also claims that the runner provides input sanitization, timeout enforcement, interactive-command blocking, permission controls, and output limits. Because the implementation is absent, none of those safeguards can be verified or guaranteed by this package. The same unqualified invocation pattern recurs at lines 83 and 95-108. ### Attack Path 1. An attacker gains the ability to place or register a command named `run-command.ps1` in a location or command scope resolved by PowerShell. 2. An agent loads this skill and follows one of its documented examples. 3. PowerShell resolves the unqualified name to the attacker-controlled implementation. 4. The malicious runner receives the requested command, working directory, and ti ...[truncated 1123 chars]
• Remediation: ## Remediation Suggestions 1. Include the reviewed `run-command.ps1` implementation in the skill package rather than relying on an externally resolved command. 2. Invoke the script through a canonical, package-relative path that is resolved and validated by trusted loader code. Do not rely on `PATH`, aliases, functions, or other ambient command-resolution mechanisms. 3. Verify the runner's integrity before execution using a trusted signature or pinned cryptographic hash. 4. Reject execution if the resolved path is outside the expected package directory, is a symbolic or reparse-point redirection, or has insecure write permissions. 5. Implement the documented safeguards in code and test them, including strict argument handling, timeout enforcement, output limits, non-interactive execution, and process-tree termination. 6. Avoid attempting to secure arbitrary shell text solely with dangerous-pattern blocklists. Prefer structured executable and argument parameters, allowlisted commands where feasible, and direct process invocation without shell reinterpretation. 7. Update all examples at lines 19-25, 83, and 95-108 to use the verified runner path and accurately describe the remaining trust boundaries.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use the skill whenever you need to run terminal commands, manage dev servers, check git status, install dependencies, or automate command-line workflows. This is a very broad activation scope for a manifest/markdown file and does not provide clear trigger constraints or exclusion conditions, increasing the risk of unintended invocation.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Core Capabilities

- **Run Commands:** Execute any command-line tool or script (`git`, `npm`, `pip`, `node`, `python`, etc.)
- **Capture Output:** Read stdout and stderr from commands with proper encoding support
- **Timeout Protection:** Commands automatically timeout after 30 seconds (configurable) to prevent hangs
- **Working Directory Control:** Execute commands in specific project folders

• Confidence: 95% confidence
• Finding: Advertising the ability to execute any command-line tool or script represents unrestricted shell access under the user's Windows account. In this skill context, that is inherently dangerous because any invoking agent can run destructive filesystem, network, package-manager, or credential-access commands, and the file itself notes the environment is not sandboxed.

Session Persistence

Medium

• Category: Rogue Agent

Content

✅ Execute PowerShell commands  
✅ Read command output and errors  
✅ Operate in any directory you have access to  
✅ Start background processes  
✅ Handle output up to 100KB  

### What This Skill CANNOT Do

• Confidence: 90% confidence
• Finding: The ability to start background processes enables persistence within the user session beyond the immediate command invocation. In the context of an unrestricted terminal skill, this can be abused to launch long-lived listeners, miners, exfiltration jobs, or recurring scripts that evade the normal timeout model.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### What This Skill CANNOT Do
❌ Run interactive commands (vim, nano, ssh, etc.)  
❌ Run commands requiring Administrator privileges without approval  
❌ Access other users' files or system directories outside your workspace  
❌ Run indefinitely (30-second default timeout)  
❌ Execute commands with dangerous patterns (sanitization blocks known attack vectors)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation makes contradictory security claims: it says the skill cannot access files outside the workspace, while elsewhere it explicitly allows operation in any directory the user can access. This can mislead users and downstream agents into overtrusting the skill's boundaries, causing commands to be issued against sensitive local paths under the current user's permissions.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The file claims dangerous command patterns are blocked by sanitization, but it also states the skill trusts command input and advertises arbitrary command execution. This inconsistency is dangerous because users or agents may assume meaningful injection prevention exists when the capability is effectively a general-purpose shell executor, increasing the chance of destructive or exfiltrative command execution.