ai-code-scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.0

Overview

This code-review skill does what it claims, but it uploads reviewed source code to an external API and has an unsafe script bug that can execute attacker-controlled code locally.

Install only if you are comfortable sending reviewed code and filenames to the listed external API. Do not run this on proprietary code, secrets, credentials, private keys, environment files, or untrusted sample files until the script's JSON construction is fixed and the skill adds clear consent and data-handling disclosures.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: scripts/review.sh:6

Finding

External Disclosure of Source Code to a Third-Party API

Content

View full analysis

/dev/null || echo "") [[ -z "$CODE" ]] && echo "❌ 无法读取文件: $FILENAME" && exit 1 fi [[ -z "$CODE" ]] && echo "❌ 请提供代码 (--code 或 --file)" && exit 1 PAYLOAD=$(python3 -c "import json; print(json.dumps({'code': '''$CODE''', 'language': '$LANGUAGE', 'filename': '$FILENAME'}))" 2>/dev/null || echo "{}") RESPONSE=$(curl -s -X POST "${API_BASE}/review" -H "Content-Type: application/json" -d "$PAYLOAD" --connect-timeout 10 --max-time 15) ``` The Skill instructions reinforce this behavior: ```markdown ### 1. API Scan (Automated) Always run the API scan first to catch known patterns: ``` ```markdown - **Always run API scan first** — it catches patterns that AI might miss ``` ### Technical Analysis The script reads the complete contents of a user-selected file into `CODE`, includes that content in a JSON request, and sends it to an externally hosted Tencent Cloud Function endpoint. The mandatory API-first workflow does not provide an offline mode, a per-upload consent prompt, secret redaction, file-scope restrictions, or information about the remote service's storage and retention policies. Source files submitted for security review are especially likely to contain proprietary implementation details, credentials, API keys, internal endpoints, personal data, or configuration secrets. HTTPS protects data in transit but does not prevent the receiving service from accessing, retaining, or redistributing the submitted content. The endpoint and upload behavior are declared in the project rather than concealed, so the available evidence does not establish intentional credential theft. Nevertheless, tr ...[truncated 1331 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/review.sh:22

Finding

Arbitrary Python Code Execution Through Unsafe JSON Payload Construction

Content

View full analysis

/dev/null || echo "{}") ``` ### Technical Analysis The script embeds `CODE`, `LANGUAGE`, and `FILENAME` directly into a Python program supplied to `python3 -c`. These values are treated as Python source code rather than as inert data. The source file content is placed between triple-quoted Python delimiters, while the language and filename are placed between single-quoted delimiters. An attacker can include matching quote sequences and Python expressions in any attacker-controlled value to break out of the intended string context. The injected expression is then evaluated by `python3` while the payload is being generated. For example, a malicious code value can use a triple-quote breakout and an expression such as: ```python '''+(__import__('os').system('id') or '')+''' ``` When interpolated into the generated Python program, the `os.system` expression is evaluated locally. Similar injection is possible through the language or filename values by breaking out of their single-quoted string contexts. Suppressing standard error with `2>/dev/null` does not prevent exploitation. It only hides syntax errors and other diagnostic output, making attacks and failures harder to detect. ### Attack Path 1. An attacker prepares a source file containing a Python triple-quote breakout and a command-executing expression. 2. The attacker convinces a user or automated Agent to review that file with `./review.sh --file `. 3. The script reads the malicious content into the `CODE` shell variable. 4. Line 22 interpolates that value directly into the source text passed to `python3 -c`. 5. Python parses the injected content as part of the generated program. 6. The injected ...[truncated 977 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is extremely broad (code review, security audit, static analysis, etc.), making the skill likely to activate for many ordinary development tasks. Because the skill routes user code to a remote API and includes executable shell workflow guidance, overbroad triggering can cause unanticipated data exposure or tool use in contexts where the user did not intend to invoke this external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The description markets the skill as a code review tool but does not clearly warn users up front that submitted source code may be sent to a remote API endpoint. This creates a serious transparency and data-handling risk: users may provide proprietary code, secrets, or regulated data without realizing it will leave the local environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and instructs use of an executable shell script (./review.sh) but does not declare any permissions or allowed-tools scope. That creates an undeclared capability gap where an agent may invoke shell operations without explicit user-visible restriction or consent boundaries, increasing the chance of unexpected command execution behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The curl POST sends user-supplied code content to an external API over the network, which is a genuine data egress behavior. In this skill's context, external transmission is core functionality, but it is still security-relevant because the payload may contain source code, embedded credentials, internal paths, or other sensitive material, and the script does not provide trust controls, disclosure, or destination validation beyond a hardcoded URL.

Content

Scanner excerpt · scripts/review.sh (reported line 23)May include surrounding context.

sh

fi
[[ -z "$CODE" ]] && echo "❌ 请提供代码 (--code 或 --file)" && exit 1
PAYLOAD=$(python3 -c "import json; print(json.dumps({'code': '''$CODE''', 'language': '$LANGUAGE', 'filename': '$FILENAME'}))" 2>/dev/null || echo "{}")
RESPONSE=$(curl -s -X POST "${API_BASE}/review" -H "Content-Type: application/json" -d "$PAYLOAD" --connect-timeout 10 --max-time 15)
SCORE=$(echo "$RESPONSE" | jq -r '.data.score // 0')
APPROVED=$(echo "$RESPONSE" | jq -r '.data.approved // false')
TOTAL=$(echo "$RESPONSE" | jq -r '.data.totalIssues // 0')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends the full provided source code and filename to a third-party remote API endpoint, but the CLI gives no explicit warning, consent prompt, or disclosure at the point of transmission. In a code-review tool context, users may pass proprietary code, secrets, or regulated data, so silent exfiltration to an external service creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

User-visible strings such as the help text and status/error messages are presented in Chinese only. This imposes a specific language on all users without opt-in or any documented locale constraint, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/review.sh:4