ClawHub
Back to skill

Security audit

Bytesagain Fortune Teller

Security checks for vulnerabilities and agentic risk

Overview

This fortune-telling skill includes unrelated local data storage, search, export, and history logging that are not clearly disclosed to users.

Review before installing. The fortune functions appear local and non-networked, but the package also contains an unrelated local data utility that can store, list, search, and export user-provided text and command history. Avoid entering sensitive personal information unless the publisher clarifies the storage behavior and narrows the commands to the advertised fortune-telling use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Note
Location
scripts/fortune.sh:51
Finding

Unconditional Third-Party Promotional Content in Command Output

Content
View full analysis

Vulnerability Details

File Location: scripts/fortune.sh:51
Vulnerability Type: Unsolicited promotional output
Risk Level: Informational

Technical Analysis

The script unconditionally appends third-party branding and a domain name to every command result:

python
print("\nPowered by BytesAgain | bytesagain.com")

This output is unrelated to the requested fortune calculation and cannot be disabled. Because SKILL.md states that results are returned through standard output, an agent that relays the script's output may reproduce this promotional content in its response.

This does not alter the agent's safety constraints or execute content from the referenced domain, so it does not meet the definition of instruction hijacking or remote payload execution. No network request is made.

Attack Path

  1. A user asks the agent to perform a supported fortune-telling operation.
  2. The agent invokes scripts/fortune.sh.
  3. The script calculates the requested result locally.
  4. Line 51 unconditionally appends the third-party attribution and domain.
  5. If the agent relays standard output verbatim, the promotional content appears in the agent's response without being requested.

Impact Assessment

The issue can affect the integrity and neutrality of agent-generated responses by causing them to carry unsolicited third-party promotion. It does not grant additional system privileges, access credentials, execute remote code, or expose local data. The scope is limited to output produced by this script.

Remediation
View remediation

Remediation Suggestions

  • Remove the unconditional promotional footer from normal command output.
  • If attribution is required, display it only for explicit help, version, or about commands.
  • Alternatively, provide an explicit opt-in flag such as --show-attribution.
  • Keep standard output limited to the requested command result so agents can safely relay it.
  • Do not turn the displayed domain into an automatic network request or remote content source.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:6
Finding

Persistent User Input Is Stored Without Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:6-8, 30, 53-55
Vulnerability Type: Insecure local data storage and logging
Risk Level: Low

Technical Analysis

The script creates a persistent data directory and writes command arguments to data.log and history.log:

bash
DATA_DIR="${FORTUNE_TELLER_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/fortune-teller}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
bash
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }
bash
cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Added: $*"
    _log "add" "${1:-}"
}

No restrictive umask, directory mode, or file mode is established. Consequently, permissions depend on the invoking process's environment and existing parent directories. With a common umask of 022, newly created files may be mode 0644, which can make stored input readable by other local accounts when directory traversal permissions allow it.

The logging function records the first argument supplied to several commands. The add command additionally stores all supplied arguments in data.log. Users may reasonably supply personal fortune-related information, names, dates, or other sensitive text.

The configurable FORTUNE_TELLER_DIR also means the security properties of the destination are not guaranteed. Although this configuration does not itself provide privilege escalation, writing into a shared or permissive directory increases exposure.

Attack Path

  1. A user invokes script.sh add with personal or sensitive text.
  2. The script creates the configured data directory using the process's default permission mask.
  3. The complete add input is appended to data.log.
  4. The first input argument is also appended to history.log.
  5. If the resulting directory and files permit access, another local account can read the persisted information.

Exploitation re ...[truncated 540 chars]

Remediation
View remediation

Remediation Suggestions

  • Set a restrictive permission mask before creating any storage:
    bash
    umask 077
  • Create the data directory with owner-only permissions:
    bash
    mkdir -p -m 700 -- "$DATA_DIR"
chmod 700 -- "$DATA_DIR"
  • Create data and history files with mode 0600, and verify that existing files are not symbolic links before writing.
  • Avoid recording command arguments in history.log unless logging is explicitly enabled by the user.
  • If logging is necessary, redact names, dates, identifiers, and other potentially sensitive values.
  • Clearly document which commands persist user input, where it is stored, and how users can delete it.
  • Validate that FORTUNE_TELLER_DIR points to an owner-controlled directory and reject shared, unexpectedly owned, or insecurely permissioned destinations.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

If the skill actually implements persistent local storage, generic record management, and unrelated command frameworks while presenting itself as a harmless fortune-telling tool, that is a meaningful trust and transparency problem. Mislabeling functionality can conceal data collection or unexpected local persistence, which increases the risk of users invoking the skill without understanding what data is stored or exported.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

If the skill actually implements persistent local storage, generic record management, and unrelated command frameworks while presenting itself as a harmless fortune-telling tool, that is a meaningful trust and transparency problem. Mislabeling functionality can conceal data collection or unexpected local persistence, which increases the risk of users invoking the skill without understanding what data is stored or exported.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's functionality does not match the declared fortune-telling purpose and instead exposes a generic local utility with logging and data handling behavior. Capability mismatch is dangerous because it can conceal broader-than-expected behavior from users and reviewers, increasing the chance of covert data collection or misuse under an innocuous skill label.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The main descriptive text is predominantly in Chinese and does not indicate that users may choose their preferred language or locale. This can violate language/locale policy when a skill presents itself in a fixed language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script prints user-facing content entirely in Chinese, including zodiac terms and fortune output, while the help text is mixed-language and does not disclose that responses will be Chinese-only. This creates a natural-language policy concern because the skill forces a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the skill can 'Draw tarot cards, cast I Ching hexagrams, and check daily fortunes,' implying tarot and I Ching capabilities. In this file, the implemented commands are only 'bazi', 'daily', 'zodiac', and 'help'; there is no tarot card draw or hexagram casting behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The in-file description labels the tool as a 'Multi-purpose utility tool,' which conflicts with the skill metadata describing a fortune-telling feature. This inconsistency undermines transparency and can be used to disguise unauthorized capabilities, making security review and user consent less reliable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script provides unrelated add, search, export, and logging operations that enable arbitrary local data collection and retrieval outside the stated fortune-telling use case. In this context, those capabilities enlarge the attack surface and create an opportunity to store or expose sensitive user content under a misleading skill identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The logging helper writes command activity to a persistent history file without user notice or consent. Silent persistence is risky because command arguments may contain sensitive or personal content, and the skill context gives users little reason to expect background local tracking from a fortune-telling tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The add command stores user-supplied input directly into a persistent local file without warning. In a skill presented as entertainment/fortune-telling, this unexpected data retention can capture private notes or prompts and later expose them through list/export functionality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.