Archive Tool

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:17 AM UTC
• Version: 1.1.0

Overview

This archive utility is mostly purpose-aligned, but its extraction behavior can write files outside the chosen folder when handling crafted tar archives.

Install only if you are comfortable treating this as a review-needed archive tool. Avoid extracting untrusted archives with it, especially tar/tar.gz/tgz/tar.bz2/tar.xz files; list contents first, extract into a new empty directory, and do not pass sensitive archive passwords on the command line.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/archive.py:25

Finding

Arbitrary File Write Through Unsafe TAR Archive Extraction

Content

View full analysis

Vulnerability Details

File Location: scripts/archive.py, lines 25-29
Vulnerability Type: Path traversal and unsafe link handling during TAR extraction
Risk Level: High

Vulnerable Code

python

def extract_tar(filepath, output_dir):
    """Extract tar/tar.gz/tgz file using Python stdlib"""
    with tarfile.open(filepath, 'r:*') as tar_ref:
        tar_ref.extractall(output_dir)
    return True

Technical Analysis

The application passes every TAR member directly to tarfile.extractall() without enforcing a safe extraction filter or validating member paths and link targets.

On Python versions where a restrictive extraction filter is not the default, a malicious TAR archive can contain:

• Relative traversal paths such as ../../home/user/.config/application.conf
• Absolute paths targeting files outside the selected output directory
• Symbolic or hard links that redirect subsequent extraction operations outside the destination
• Special files or other unsafe TAR member types

Creating output_dir before extraction does not constrain archive members to that directory. The destination of every member must be resolved and verified independently.

Attack Path

1. An attacker creates a TAR, TAR.GZ, TGZ, TAR.BZ2, or TAR.XZ archive containing a member whose path traverses outside the intended extraction directory, or a link that points outside it.

2. The attacker provides the archive to a user or causes an agent to process it.

3. The user or agent runs a command such as:

   bash

   python3 scripts/archive.py extract malicious.tar -o ./extracted
   

4. extract_file() identifies the input as a TAR archive and calls extract_tar().

5. tar_ref.extractall(output_dir) processes the malicious member without an explicitly enforced safe filter.

6. On an affected Python runtime, the crafted member is written outside ./extracted.

Impact Assessment

The attacker m ...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

On supported Python versions, explicitly require the safe data filter rather than relying on runtime defaults:

python

def extract_tar(filepath, output_dir):
    destination = Path(output_dir).resolve()
    destination.mkdir(parents=True, exist_ok=True)

    with tarfile.open(filepath, "r:*") as tar_ref:
        tar_ref.extractall(destination, filter="data")

    return True

For compatibility with runtimes that do not support filter="data", implement validation before extraction:

1. Resolve the intended destination directory to an absolute canonical path.
2. Reject absolute member paths.
3. Resolve each member's prospective destination and verify that it remains beneath the extraction directory.
4. Reject traversal components that escape the destination.
5. Reject device files, FIFOs, and other special member types.
6. Reject symbolic and hard links, or separately verify that both their extraction locations and targets remain within the destination.
7. Extract only after all archive members have passed validation.
8. Add regression tests covering absolute paths, ../ traversal, symbolic-link pivots, hard-link pivots, and special files.

T09 · Insecure Skill Coding Practices

Warning

• Location: [-o OUTPUT] [--password PASS] ``` ```bash # Extract with password python archive.py extract archive.rar --password secret ``` ### Technical Analysis Command-line arguments are not an appropriate secret-input channel. Depending on the operating system, shell, agent framework, and logging configuration, a plaintext password supplied through `--password` may be exposed through: - Shell history files - Process listings or process-inspection interfaces - Parent-process telemetry - Agent ...[truncated 1670 chars]:181

Finding

Archive Password Disclosure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/archive.py, lines 181-185; SKILL.md, lines 76-78 and 92-94
Vulnerability Type: Sensitive information exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code

The command-line parser accepts an archive password directly as an argument:

python

# Extract command
extract_parser = subparsers.add_parser('extract', help='Extract archive')
extract_parser.add_argument('file', help='Archive file to extract')
extract_parser.add_argument('-o', '--output', default='.', help='Output directory')
extract_parser.add_argument('--password', help='Password for protected archives')

The documentation encourages users to place the password directly in the command:

bash

python archive.py extract <file> [-o OUTPUT] [--password PASS]

bash

# Extract with password
python archive.py extract archive.rar --password secret

Technical Analysis

Command-line arguments are not an appropriate secret-input channel. Depending on the operating system, shell, agent framework, and logging configuration, a plaintext password supplied through --password may be exposed through:

• Shell history files
• Process listings or process-inspection interfaces
• Parent-process telemetry
• Agent execution transcripts
• Terminal session recording
• Debugging and command audit logs

The application subsequently encodes the same password for ZIP extraction, but that does not remove copies already exposed through the original process argument.

Attack Path

1. A user follows the documented example and runs:

   bash

   python3 scripts/archive.py extract protected.zip --password secret
   

2. The shell may save the complete command in its history.

3. While the process is running, another local process with sufficient process-inspection access may read its argument vector.

4. An agent runtime, terminal rec ...[truncated 897 chars]

Remediation

View remediation

Remediation Suggestions

Avoid accepting passwords as ordinary command-line arguments.

1. Prompt interactively using getpass.getpass() when an encrypted archive requires a password:

   python

   import getpass
   
   password = getpass.getpass("Archive password: ")
   

2. If automation is required, support reading the password from a protected file descriptor or standard input, and clearly document the security implications.

3. Avoid environment variables as the preferred solution because they may also be exposed through process environments, diagnostics, or orchestration logs.

4. Remove examples containing literal passwords from SKILL.md.

5. Display a warning or reject --password after a deprecation period.

6. Ensure exceptions, debug output, and telemetry never include the password.

7. Document that users should rotate any password previously entered through the command line if execution history or logs may be accessible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes extraction and creation features but does not clearly warn that these operations write files to disk, may create directories, and could overwrite or modify data in the chosen output location. For archive handling, this omission is risky because users may invoke the skill without understanding the side effects, especially when extracting untrusted archives or targeting broad locations like the current directory.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation text is broad enough to trigger on many ordinary archive-related requests without clearly constraining what paths, files, or side effects are in scope. In a skill that can extract and create archives, overbroad activation increases the chance the agent performs filesystem write operations in situations where the user did not explicitly intend those actions or where a different, safer skill should handle the request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code extracts ZIP archives directly with zipfile.extractall and TAR archives elsewhere with tarfile.extractall, without validating member paths, symlinks, or overwrite behavior. A crafted archive can perform path traversal and write outside the target directory, potentially overwriting sensitive files or planting executables in user-controlled startup locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These functions call external binaries via subprocess.run to handle archive extraction, which is a safety-relevant operation for code files. Although the subprocess arguments are fixed and the behavior is part of archive handling, there is no explicit disclosure in help text or comments that extracting these formats depends on launching system tools.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/archive.py (reported line 46)May include surrounding context.

python

def extract_rar(filepath, output_dir):
    """Extract rar using unar (system tool)"""
    try:
        result = subprocess.run(
            ['unar', '-o', output_dir, filepath],
            capture_output=True, text=True
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/archive.py (reported line 58)May include surrounding context.

python

def extract_7z(filepath, output_dir):
    """Extract 7z using p7zip (system tool)"""
    try:
        result = subprocess.run(
            ['7z', 'x', f'-o{output_dir}', '-y', filepath],
            capture_output=True, text=True
        )