Security audit

Java Switch

Security checks for vulnerabilities and agentic risk

Overview

This Java-switching skill is mostly purpose-aligned, but it can automatically install software and persistently change shell startup files without enough user control.

Install only if you are comfortable with a skill that can install Homebrew/OpenJDK and edit ~/.zshrc. Review the script first, use simple numeric Java versions only, and prefer asking the agent to show commands before running anything that installs Homebrew or modifies your shell profile.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/switch-java.sh:21
Finding: Unpinned Remote Homebrew Installer Is Downloaded and Executed
Content: View full analysis
/dev/null; then echo "⚠️ Homebrew is not installed. Installing..." /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" echo "✅ Homebrew installation completed" else echo "✅ Homebrew is installed: $(brew --version)" fi ``` The same behavior is prescribed by the Skill instructions: ```bash if ! command -v brew &> /dev/null; then echo "Homebrew is not installed. Installing..." /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" fi ``` ### Technical Analysis The script retrieves shell code from the mutable `HEAD` reference of Homebrew's GitHub repository and passes the response directly to Bash. There is no commit pinning, release pinning, checksum verification, signature verification, or opportunity to inspect the downloaded file before execution. Although the URL is associated with the official Homebrew GitHub organization rather than a personal paste service, the effective executable payload can change after this Skill has been reviewed. Compromise of the upstream repository, maintainer credentials, delivery infrastructure, or installer content would consequently result in arbitrary code execution on systems invoking the Skill. Using `curl -fsSL` provides transport and HTTP error handling, but it does not establish that the received script is an approved or previously audited version. TLS alone does not protect against an authorized upstream account publishing compromised content. Automatically installing a system package manager also exceeds the minimum privileges needed to switch among Java versions that ...[truncated 1677 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/switch-java.sh:84
Finding: Unsanitized Java Version Is Written as Executable Shell Configuration
Content: View full analysis
> ~/.zshrc echo "$ZSHRC_ENTRY" >> ~/.zshrc echo 'export JAVA_HOME=$(/usr/libexec/java_home -v '"$VERSION"')' >> ~/.zshrc echo 'export PATH=$JAVA_HOME/bin:$PATH' >> ~/.zshrc echo "✅ Configuration added to ~/.zshrc" echo "" # Apply the configuration echo "🔄 Applying configuration..." source ~/.zshrc ``` ### Technical Analysis `$VERSION` originates from the first command-line argument and is not restricted to a valid Java version grammar. The script concatenates this value into a line of executable shell syntax: ```bash export JAVA_HOME=$(/usr/libexec/java_home -v ) ``` The quoting used by the `echo` command only affects construction of the output string. It does not safely encode the value for later interpretation as shell source. Characters such as `)`, `;`, newlines, comment markers, redirection operators, or other shell metacharacters can alter the generated command when zsh parses `~/.zshrc`. For example, a value shaped like the following would produce an additional command in the generated profile if execution reaches the persistence stage: ```text 17); touch /tmp/java-switch-injection # ``` The resulting profile line would be equivalent to: ```bash export JAVA_HOME=$(/usr/libexec/java_home -v 17); touch /tmp/java-switch-injection #) ``` The risk is amplified because the script immediately executes `source ~/.zshrc`. Consequently, an injected co ...[truncated 2117 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` If broader version support is required, enforce a narrowly defined numeric grammar such as: ```bash if [[ ! "$VERSION" =~ ^[0-9]+([.][0-9]+){0,2}$ ]]; then printf '%s\n' "Invalid Java version format" >&2 exit 1 fi ``` 2. Do not concatenate untrusted values into executable shell configuration. Generate configuration using safely encoded values or avoid embedding the argument entirely. 3. Use a clearly delimited, managed configuration block and replace that block atomically rather than repeatedly appending entries. 4. Write changes to a securely created temporary file, verify the generated content, and atomically rename it over the destination. 5. Preserve the original file's ownership and permissions and create backups with restrictive permissions. 6. Do not `source ~/.zshrc` from the script. Report that the settings will apply to newly opened shells, or print explicit commands for the user to run. 7. For the current process, set `JAVA_HOME` and `PATH` directly using the already resolved `JAVA_HOME_PATH`; no profile reload is necessary. 8. Add tests using metacharacters, whitespace, newlines, command substitutions, and redirections to verify that invalid version inputs are rejected before any package installation or profile modification occurs. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly states that the skill will persist changes to ~/.zshrc, but it does not clearly warn users about the security and operational implications of modifying shell startup files. Persistent shell profile changes can alter command resolution and environment behavior across future sessions, which is especially risky in an agent-driven automation context where users may not expect durable system configuration changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is designed to install Homebrew/OpenJDK and persistently modify ~/.zshrc, but it does not prominently require explicit user consent or warn that it will make lasting system changes. This is dangerous because users may trigger the skill expecting advice, while the skill instead performs software installation and alters future shell behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match common requests like installing or changing Java, which can cause the skill to activate in situations where the user may only want guidance rather than automated system changes. Because the skill can install packages and modify shell configuration, overbroad activation increases the risk of unintended execution of impactful actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script appends exports to ~/.zshrc, comments out existing JAVA_HOME lines, and then sources the modified file immediately, all without asking for user confirmation. Persistently changing shell startup files can unexpectedly alter future sessions and sourcing ~/.zshrc can execute arbitrary commands already present in that file, increasing the chance of unintended side effects in the current run.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: All comments and user-visible echo output are written in Chinese, including usage and status/error messages. This imposes a specific language on all users without any opt-in, fallback, or indication that the script is intended only for a Chinese-language audience.
Content: No source excerpt is available for this finding.