Security audit

lokaler-companion

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for building local monitoring apps, but it needs Review because it recommends unsafe wildcard CORS for a localhost API and includes durable background-service patterns.

Install only if you are comfortable with a skill that helps agents build local background monitors. Require generated companions to use same-origin APIs or a strict Origin allowlist instead of wildcard CORS, add authentication for any POST/control endpoints, approve persistence explicitly, and avoid storing secrets or sensitive internal status in unauthenticated localhost APIs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:99
Finding: Wildcard CORS exposes the local companion API to arbitrary websites
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/starter/start.ps1:53
Finding: Unvalidated PID files can terminate unrelated processes
Content: View full analysis
/dev/null && echo " $APP_NAME beendet." rm -f "$PIDF"; exit 0 ;; ``` ### Technical Analysis Both starters treat the integer stored in `data/companion.pid` as authoritative. They do not verify that the process represented by the PID is the companion process, that its executable is the expected Python runtime, or that its command line references the expected `server.py`. PID reuse creates a natural failure case: after the companion exits without removing its PID file, the operating system may assign that PID to another process. Deliberate replacement of the PID file creates the same condition. The Windows implementation then forcefully terminates the selected process. ### Attack Path 1. The companion exits unexpectedly and leaves a stale PID file, or a local party with write access to the project directory changes `data/companion.pid`. 2. The PID is set to the identifier of an unrelated process owned by the user. 3. The user invokes `Beenden.cmd`, `start.ps1 -Stop`, or `start.sh stop`. 4. The starter reads the untrusted PID without validating process identity. 5. The unrelat ...[truncated 616 chars]
Remediation: View remediation
/cmdline` and `/proc//stat` start-time data before calling `kill`. - On Windows, inspect the process path and command line through CIM before calling `Stop-Process`. - Prefer a graceful authenticated shutdown endpoint or an operating-system service manager over raw PID files. - Refuse to terminate the process if identity validation fails, and remove or quarantine the stale PID file. - Create the data directory and PID file with permissions limited to the current user. - Avoid recommending elevated execution for these starter scripts. ]]>

T08 · Insecure Dependencies

Note

Location: references/docker.md:13
Finding: Docker template uses a mutable, unverified base image
Content: View full analysis
Remediation: View remediation
``` - Use an automated dependency update process that proposes and reviews digest changes. - Generate `requirements.txt` with exact versions and hashes, then install with: ```bash pip install --require-hashes --no-cache-dir -r requirements.txt ``` - Build with provenance attestations and generate an SBOM. - Scan both the base image and final image for known vulnerabilities. - Document the reviewed image registry and avoid untrusted mirrors. - Preserve the existing non-root user and `no-new-privileges` controls. The flagged `sudo systemctl enable docker` instruction in `references/docker.md:122` is not itself a hidden persistence mechanism: it is a manual, documented step directly associated with the explicitly requested “run after reboot” container mode. Nevertheless, the documentation should prefer rootless Docker or a user service where practical and clearly state that enabling the rootful Docker daemon is a system-wide administrative change. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Die deklarierte Beschreibung handelt von einem dauerhaft laufenden lokalen Beobachtungs-Tool mit UI/Server/PWA/Benachrichtigungskomponenten. Der vorliegende Code implementiert stattdessen nur ein Kommandozeilenwerkzeug zur Qualitätssicherung: Es scannt Projektdateien nach vorgegebenen Textmustern ('--forbid'), überspringt bestimmte Verzeichnisse/Dateitypen und meldet Funde. Das ist ein materiell anderer Primärzweck und keine bloße Hilfsimplementierung des beschriebenen Companion-Systems. Es gibt keinerlei Hinweise auf Netzwerkserver, Monitoring externer Zustände, Hintergrundbetrieb, Browser-Integration oder Nutzerbenachrichtigungen.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation guidance is very broad and encourages using the skill for many loosely related requests such as background tools, status pages, notifications, and containers. Overbroad routing can cause the agent to invoke a powerful skill in contexts where a simpler or safer approach would suffice, increasing the chance of unnecessary local services, persistent processes, network polling, or container exposure being proposed or created.
Content: No source excerpt is available for this finding.

Internal Network Request

Medium

Category: Server-Side Request Forgery
Confidence: 70% confidence
Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content: Scanner excerpt · references/docker.md (reported line 57)May include surrounding context.
md
restart: unless-stopped healthcheck: test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8765/api/status', timeout=5).status==200 else 1)"] interval: 60s start_period: 20s security_opt: [ "no-new-privileges:true" ]

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/docker.md (reported line 122)May include surrounding context.
md
- **Docker Desktop (Windows, macOS)**: Settings → General → *Start Docker Desktop when you sign in*. Ohne diesen Haken startet nach der Anmeldung gar nichts, und `restart` bleibt wirkungslos. - **Linux**: `sudo systemctl enable docker` — auf den meisten Systemen ohnehin eingeschaltet. Das ist kein Detail, sondern der Unterschied zwischen „läuft dauerhaft" und

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/fallstricke.md (reported line 37)May include surrounding context.
Nicht raten, nachsehen:

bash
curl -sI "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=eur" # access-control-allow-origin: * → aus einer losen Datei erreichbar curl -sI "https://t.me/s/telegram"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guidance explicitly recommends launching PowerShell with -ExecutionPolicy Bypass, which weakens a native script safety control and normalizes bypassing policy protections on the endpoint. Even though it is scoped to a single invocation and framed as a usability workaround, it reduces defense-in-depth and could be reused to run modified or untrusted scripts with fewer barriers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all command-line descriptions are written in German, which imposes a specific language on users without offering a language choice or documenting a justified locale restriction. This matches the policy category for language or locale constraints in natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Argument descriptions, error messages, progress output, and remediation text are all emitted only in German. Because the file does not offer localization, opt-in language selection, or a documented locale-specific justification, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The generated service worker listens for message events of type 'notify' and calls showNotification, which can produce user-visible system notifications. In this Python file, that behavior is implemented indirectly via the generated SW string, but there is no user warning, confirmation, or explicit disclosure in the surrounding script output or comments that the skill adds notification capability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest sets "lang": "de", which forces a specific language/locale in the generated app metadata. The file does not offer a user option to choose the locale or document that the tool is intentionally limited to German-only use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The batch file launches PowerShell with -ExecutionPolicy Bypass, which disables an important safety control intended to prevent restricted script execution. In this skill's context, the script is a user-facing starter for a long-running local companion app, so double-click execution makes it easier for a modified or trojanized start.ps1 to run without policy friction or user awareness.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/docker.md (reported line 122)May include surrounding context.
md
if [ -z "$PY" ]; then echo " Python wurde nicht gefunden." echo " macOS: brew install python3" echo " Debian: sudo apt install python3" exit 1 fi echo " Python: $PY"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/starter/start.sh (reported line 32)May include surrounding context.
sh
if [ -z "$PY" ]; then echo " Python wurde nicht gefunden." echo " macOS: brew install python3" echo " Debian: sudo apt install python3" exit 1 fi echo " Python: $PY"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/starter.md (reported line 114)May include surrounding context.
md
echo " Laeuft bereits auf $URL — wird nicht erneut gestartet." else mkdir -p "$DATA" ( cd "$ROOT" && nohup "$PY" "$SCRIPT" --port "$PORT" \ --poll-interval "$INTERVAL" --no-browser > "$LOG" 2>&1 & echo $! > "$PIDF" ) echo " Gestartet (PID $(cat "$PIDF")), warte auf Antwort ..." ok=0

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/starter/start.sh (reported line 41)May include surrounding context.
sh
echo " Laeuft bereits auf $URL — wird nicht erneut gestartet." else mkdir -p "$DATA" ( cd "$ROOT" && nohup "$PY" "$SCRIPT" --port "$PORT" \ --poll-interval "$INTERVAL" --no-browser > "$LOG" 2>&1 & echo $! > "$PIDF" ) echo " Gestartet (PID $(cat "$PIDF")), warte auf Antwort ..." ok=0

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON file contains natural-language prompts and expectations exclusively in German across multiple eval entries. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless the regional constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Chaining Abuse

Low

Category: Tool Misuse
Confidence: 15% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/docker.md (reported line 26)May include surrounding context.
md
RUN mkdir -p /app/data RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin app \ && chown -R app:app /app USER app EXPOSE 8765

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file uses only German for all headings and instructions, and there is no indication that the skill is intentionally limited to German-speaking users or that users can opt into another language. Under the language/locale policy rule, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing instructional content exclusively in German, and there is no indication that the skill is intentionally region-specific or that users can opt into another language. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's docstrings, inline user-facing messages, and console output are entirely in German, which imposes a specific language on users without any opt-in or alternate locale. This matches the policy category for language or locale constraints expressed in natural language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language comment describing the script's behavior is only in German. This can violate language/locale policy when a skill forces a specific language without offering user opt-in or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The only user-facing natural-language text in the file is written in German, which imposes a specific language on users without any indication of language choice or opt-in. This matches the policy category for locale/language constraints in natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All user-facing comments and status messages in the script are in German, and the file provides no option for users to select another language or indication that the skill is intentionally limited to German-speaking users. This is a natural-language policy concern because it imposes a locale/language choice without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.