file-organizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 0.1.0

Overview

This file-management skill is understandable and mostly disclosed, but it needs review because it can operate broadly on local files and its example shell commands use unsafe path placeholders.

Install only if you are comfortable letting the agent inspect and reorganize local folders. Use it with explicit target paths, avoid broad home-directory requests, review every proposed move or deletion, and ensure any shell commands quote and validate paths before running.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:86

Finding

Shell Command Injection Through Unquoted Directory Placeholders

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86-95 and 135-141
Vulnerability Type: Shell command injection caused by unsafe path interpolation
Risk Level: Medium

Vulnerable Code

bash

# Lines 86-95
ls -la [target_directory]

find [target_directory] -type f -exec file {} \; | head -20

du -sh [target_directory]/* | sort -rh | head -20

find [target_directory] -type f | sed 's/.*\.//' | sort | uniq -c | sort -rn

bash

# Lines 135-141
find [directory] -type f -exec md5 {} \; | sort | uniq -d

find [directory] -type f -printf '%f\n' | sort | uniq -d

find [directory] -type f -printf '%s %p\n' | sort -n

Technical Analysis

The skill instructs an agent to replace [target_directory] and [directory] with a user-selected path and execute the resulting shell commands. These placeholders are not quoted and are not separated from shell interpretation through a structured process-execution API.

If an agent performs direct textual substitution, shell metacharacters in the supplied value can change the intended command. Characters such as semicolons, command substitutions, redirection operators, pipes, whitespace, and glob metacharacters may be interpreted by the shell rather than treated as part of a filesystem path.

For example, unsafe interpolation of a value conceptually equivalent to:

text

/tmp/files; attacker_command

could transform the first template into two shell commands. A path containing spaces can also split into multiple arguments, while wildcard characters may expand beyond the intended target. The risk arises from the command construction pattern; exploitation depends on an agent substituting untrusted input directly and executing the result through a shell.

Attack Path

1. An attacker supplies a crafted directory value or persuades the user to request organization of a directory represented by shell metacharacters.
2. The agent substitutes that value directly for [target_directory] or `[di ...[truncated 983 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell command strings by directly substituting user-provided paths.
2. Prefer a process-execution API that passes the executable and each argument separately without invoking a shell.
3. Resolve the requested directory to a canonical absolute path and verify that it exists, is a directory, and remains within the user-approved scope.
4. When shell use is unavoidable, assign the validated path to a variable and quote every expansion:

bash

target_directory='/validated/absolute/path'

ls -la -- "$target_directory"
find "$target_directory" -type f -exec file -- {} \;
find "$target_directory" -type f -printf '%f\n'
find "$target_directory" -type f -printf '%s %p\n'

5. Avoid concatenating wildcard syntax with untrusted input. For size analysis, use find or another structured traversal mechanism instead of relying on shell glob expansion.
6. Reject values containing control characters and never treat a user-provided directory as executable shell syntax.
7. Revalidate that every source and destination path remains under the approved root before later move, rename, or deletion operations.
8. Retain the existing approval requirement for destructive changes, but do not rely on confirmation as a substitute for safe command construction.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises and exemplifies very broad natural-language triggers such as 'help me organize' or 'review my project directories,' which can overlap with ordinary user requests and cause ambiguous activation. In a high-permission file-management skill, accidental invocation is risky because the agent may begin inspecting directory contents, proposing moves, or preparing destructive operations over large parts of the filesystem.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.