btw command

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

The skill is a local question-asking helper, but its documentation overstates privacy and non-blocking behavior while the code logs raw context and can silently use timeout defaults in sensitive workflows.

Review before installing. This does not show malware, exfiltration, or persistence, but callers should not place secrets or regulated personal data in context, should assume questions and context may appear in logs, and should use fail-safe defaults such as no, skip, or escalate for production, data-changing, or security-sensitive decisions. Also treat the primary call as waiting for an answer or timeout, not as a truly background non-blocking interaction.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: handler.ts:68

Finding

Unrestricted Context Data Is Written to Application Logs

Content

View full analysis

Vulnerability Details

File Location: handler.ts, lines 68-70
Vulnerability Type: Sensitive information exposure through logging
Risk Level: Medium

Vulnerable Code:

typescript

if (Object.keys(context).length > 0) {
  console.log(`  Context:`, context);
}

Technical Analysis

The context input is an unrestricted, caller-controlled object intended to carry additional workflow information. The implementation writes the entire object to standard output without filtering, redaction, size limits, or an explicit debug-mode requirement.

Agent workflows may include credentials, access tokens, customer information, internal deployment details, file paths, or other sensitive values in this object. Standard output is frequently retained by process supervisors, CI/CD systems, container platforms, or centralized logging services. These logs may have broader readership and longer retention than the original in-memory data.

This issue does not independently transmit information over the network or grant system access. Exploitation requires a sensitive value to be supplied in context and an attacker or unauthorized operator to have access to the resulting logs.

Attack Path

1. A caller or integrated agent invokes run() with sensitive information in the context object.
2. The implementation accepts the object without restricting or classifying its fields.
3. Lines 68-70 pass the complete object to console.log.
4. The runtime, process supervisor, or hosting platform stores or forwards standard output.
5. A user or service with access to those logs retrieves the exposed information.
6. If the logged data includes active credentials, the recipient may use the privileges already associated with those credentials.

Impact Assessment

The direct impact is loss of confidentiality for data supplied through context. The affected scope includes the local console and any downstream logging, r ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove wholesale logging of the context object from normal operation.
2. If diagnostic logging is necessary, require an explicit debug configuration that is disabled by default in production.
3. Allowlist fields that are safe to log rather than attempting to block only known secret names.
4. Apply recursive redaction to credential-like fields such as password, secret, token, apiKey, authorization, cookie, and private-key material.
5. Limit the permitted depth, field count, and serialized size of context data to reduce accidental disclosure and log abuse.
6. Log only metadata when possible, such as the names or count of context fields, rather than their values.
7. Document that callers must not place secrets or regulated personal data in diagnostic fields.
8. Configure deployment logs with least-privilege access, suitable retention limits, and secure deletion practices.
9. Add automated tests confirming that representative secrets are absent from captured standard output.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill documentation claims non-blocking, local, privacy-preserving behavior, but the static finding indicates the actual implementation may block, expose extra queue-management operations, and rely on console/log interaction not disclosed in the description. This is security-relevant because agents may invoke the skill in sensitive workflows under incorrect assumptions about execution semantics, visibility of prompts/answers, and available operations, which can cause unsafe automation decisions or leakage of sensitive context to logs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says the skill should ask clarifying questions without halting execution, but run() awaits waitForAnswer() and does not return until an answer arrives or the timeout expires. This makes the primary API blocking for up to the configured timeout rather than non-blocking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages automatic timeout defaults for deployment, data handling, and security decisions without prominently warning that this can trigger actions without contemporaneous human approval. In safety-sensitive contexts, a timeout can silently become authorization, leading to unintended deployments, risky data operations, or missed security responses depending on the configured default.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code intentionally exposes question context both in console output and through the pending-question listing API, creating a built-in data disclosure path for arbitrary user-supplied context. Because this skill is meant for agent workflows involving deployment, code review, validation, and security checks, the context is especially likely to contain sensitive operational metadata, secrets, or private business information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill logs the supplied context object directly to the console, which can expose sensitive user-provided data such as tokens, file paths, internal decisions, or personal information to logs and other observers. In an agent workflow, clarifying-question context often contains precisely the operational details that should be minimized or redacted, making this more dangerous than ordinary debug logging.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file-level comment presents the implementation as entirely local, but later documentation says answerQuestion() 'can be called externally'. While the code does not itself make network calls, the inline documentation creates an intent-level contradiction about whether interaction is purely local or involves external actors.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.