universal-file-ops

• Outcome: Review
• Latest audit: Jun 25, 2026 · 12:17 PM UTC
• Version: 1.3.0

Overview

This skill is purpose-aligned but needs Review because it can directly modify/delete files, install packages, and run tests without strong scoping or runtime confirmation.

Install only if you are comfortable with an agent tool that can read, overwrite, move, and delete user-specified files, create persistent backups/logs/venvs, install Python packages from the network, and execute tests. Use it in a constrained workspace, review paths before destructive operations, avoid --no-backup, and do not run sandbox-test or pip installs on untrusted code or packages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 3. Install dependencies
        pkgs_to_install = ["pytest"] + extra_pkgs
        pip_result = subprocess.run(
            [pip_exe, "install"] + pkgs_to_install,
            capture_output=True, text=True, timeout=120
        )

• Confidence: 97% confidence
• Finding: This subprocess call invokes pip to install packages derived from user-controlled --require inputs. Even though shell injection is avoided by passing an argument list, this still grants package installation and network-fetch capability, enabling execution of attacker-chosen package setup/build code or dependency side effects inside the sandbox.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 4. Run pytest from the sandbox directory so conftest.py is picked up
        test_path = os.path.join(sandbox_dir, test_basename)
        pytest_result = subprocess.run(
            [python_exe, "-m", "pytest", test_path, "-v", "--tb=short"],
            capture_output=True, text=True, timeout=120,
            cwd=sandbox_dir

• Confidence: 96% confidence
• Finding: This subprocess call executes pytest against attacker-controlled target and test files, which means arbitrary Python code in those files will run. A venv is not a security boundary by itself, so malicious test or import-time code can access the filesystem, environment, network, or consume resources on the host unless stronger sandboxing is in place.

Tainted flow: 'stdin_data' from sys.stdin.read (line 209, user input) → subprocess.run (code execution)

Critical

• Category: Data Flow

Content

))
            sys.exit(1)
        cmd = [sys.executable, str(script)]
        proc = subprocess.run(cmd, input=stdin_data, capture_output=True, text=True)
        # 透传脚本输出
        if proc.stdout:
            print(proc.stdout, end="")

• Confidence: 90% confidence
• Finding: External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares low sensitivity and no meaningful permissions, yet its documented capabilities include file read/write, package installation, environment modification, network retry behavior, and shell-like script execution. This mismatch can cause an agent or reviewer to under-trust-boundary the skill and allow high-impact operations without appropriate consent, gating, or sandbox assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill explicitly exposes arbitrary pip package installation through repeated --require arguments, extending its capabilities beyond file operations into package retrieval and code execution. In this skill context, that is especially risky because package installation commonly runs untrusted code during build/install and may reach external networks.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The rollback function restores files to whatever path is recorded in manifest.txt without validating that the destination stays within an approved workspace or backup scope. If an attacker can modify the manifest or influence backup entries, they can overwrite arbitrary files accessible to the process, which can lead to configuration corruption, code tampering, or persistence beyond the skill’s intended file-ops boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The test harness performs a real package installation of requests, which reaches outside ordinary file-operation testing into package-management and network-influenced behavior. In an agent skill context, that expands the attack surface by permitting dependency retrieval, execution of installer logic, and environment mutation during what appears to be a routine validation script.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad everyday requests such as handling files, checking scripts, generating tests, installing packages, or switching Python versions. In an agent ecosystem, overly broad triggers can invoke this powerful skill unexpectedly, leading to unintended file modification, dependency installation, or execution pathways in contexts where the user did not clearly consent to those actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises high-impact operations including atomic file writes, environment setup, dependency installation, sandbox execution, and workflow-enforced script generation, but does not present clear user-facing risk warnings or consent boundaries. This is dangerous because non-expert users may trigger system changes or code execution without understanding persistence, external downloads, or effects on existing files and environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The FAQ describes a `clean-reinstall` command that deletes the current virtual environment and reinstalls packages, but it does not prominently warn that this is destructive and may remove locally installed packages or environment state. In an agent-facing skill, insufficient warning increases the chance of accidental destructive execution, especially if an LLM selects the command automatically from documentation.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guide presents file deletion as a normal operation without an explicit warning about irreversible data loss, path sensitivity, or the limits of backups. In an agent-facing skill, concise examples can be copied directly into automation, so understated destructive actions materially raise the chance of accidental deletion of important user files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide documents environment removal and clean reinstall operations without clearly warning that they can delete an existing virtual environment, rebuild it, and potentially disrupt local development workflows. In a skill intended for LLM/agent use, this omission is risky because an automated system may invoke these commands based on high-level user intent without appreciating the destructive side effects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly states that high-risk operations such as delete, overwrite, and disabling backups execute directly without any runtime authorization or confirmation. In a file-operation skill, this weakens an important safety boundary: accidental, coerced, or maliciously prompted destructive actions can be performed immediately once the agent invokes the skill.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script recursively deletes a virtual-environment directory without confirmation or a strong safety check, which can destroy developer state or other files if the computed path is wrong. In an agent skill focused on file operations, unattended destructive behavior is more dangerous because it may be triggered automatically in broader workflows.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Batch mode loads a user-supplied JSON plan and immediately executes multiple file-affecting operations, potentially in parallel, with no confirmation, policy enforcement, or path restrictions visible in this orchestrator. In an agent setting, this increases the risk of prompt-driven or unreviewed bulk file modification, deletion, or copying, especially because the tool is explicitly designed to perform filesystem actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The switch workflow deletes the existing virtual environment before fully validating that the target Python version is available and before obtaining any confirmation. A user error or bad input can therefore cause irreversible loss of the current environment and installed packages even when the switch ultimately fails.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The remove command deletes the virtual environment immediately with no confirmation, dry-run option, or safety interlock. In an agent setting, a mistaken invocation or prompt-manipulated action could destroy the environment and disrupt dependent workflows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Clean reinstall performs a destructive delete-and-recreate sequence without an explicit warning or confirmation step. If triggered unintentionally, it can wipe the current environment and package state, and recreation may fail afterward, leaving the system in a broken state.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script deletes files and recursively removes directories automatically at startup, with no confirmation prompt and no strong boundary check beyond path construction. If the directory assumptions are wrong, symlinks are involved, or the script is run from an unexpected layout, this can cause unintended data loss in the local environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script unconditionally opens `SKILL.md` for writing and overwrites its contents after blind string replacement, with no prompt, backup, atomic write, or validation that the expected old version text exists. In a file-operations skill, this is more dangerous than usual because it normalizes destructive write behavior and can silently corrupt project metadata if run in the wrong directory or against unexpected file contents.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script always truncates and rewrites `references/changelog.md`, even though the preceding logic suggests an intent to merge existing content; the `pass` makes that safety logic ineffective. This can destroy prior changelog history or user edits without warning, which is especially risky in a skill explicitly designed for file CRUD and automation workflows.

Unvalidated Output Injection

High

• Category: Output Handling

Content

))
            sys.exit(1)
        cmd = [sys.executable, str(script)]
        proc = subprocess.run(cmd, input=stdin_data, capture_output=True, text=True)
        # 透传脚本输出
        if proc.stdout:
            print(proc.stdout, end="")

• Confidence: 81% confidence
• Finding: The orchestrator blindly relays stdout and stderr from the invoked child script back to the caller. If downstream scripts echo attacker-controlled content, this can propagate terminal control sequences, misleading status text, or structured output spoofing to whatever agent or user consumes the result, creating output-injection and log-forgery risk.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# 3. Install dependencies
        pkgs_to_install = ["pytest"] + extra_pkgs
        pip_result = subprocess.run(
            [pip_exe, "install"] + pkgs_to_install,
            capture_output=True, text=True, timeout=120
        )

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# 4. Run pytest from the sandbox directory so conftest.py is picked up
        test_path = os.path.join(sandbox_dir, test_basename)
        pytest_result = subprocess.run(
            [python_exe, "-m", "pytest", test_path, "-v", "--tb=short"],
            capture_output=True, text=True, timeout=120,
            cwd=sandbox_dir

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High

• Category: Output Handling

Content

timeout: int = 120) -> Tuple[int, str, str]:
    """运行命令，返回 (returncode, stdout, stderr)"""
    try:
        proc = subprocess.run(
            cmd, cwd=cwd, capture_output=True, text=True, timeout=timeout
        )
        return proc.returncode, proc.stdout.strip(), proc.stderr.strip()

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Static analysis

No suspicious patterns detected.