Security audit

File Batch Processor

Security checks for vulnerabilities and agentic risk

Overview

This is a local batch file tool, but it can overwrite, move, or corrupt many user files without enough safeguards.

Review before installing. Use this only on copied folders or backed-up data, run --dry-run first, avoid using it on important originals, and do not rely on it to preserve GIF/BMP formats or existing PDFs. Prefer waiting for a version that defaults to safe output folders, pins dependencies, validates rename paths, checks collisions, and implements real backups or rollback.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/batch_rename.py:46
Finding: Path Traversal and File Overwrite Through Unvalidated Rename Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/convert_to_pdf.py:75
Finding: Predictable Shared Temporary File Enables File Clobbering and Race Conditions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/image_compress.py:41
Finding: In-Place Image Processing Can Irreversibly Corrupt BMP and GIF Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:30
Finding: Unpinned Third-Party Dependencies Create Supply-Chain and Reproducibility Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/convert_to_pdf.py:47
Finding: PDF Conversion Silently Replaces Existing Output Files
Content: View full analysis
height: new_width = max_width new_height = height * (max_width / width) else: new_height = max_height new_width = width * (max_height / height) # Resize image and save to PDF img.save('temp_image.jpg', quality=95) pdf.image('temp_image.jpg', x=(210-new_width)/2, y=(297-new_height)/2, w=new_width, h=new_height) pdf.output(pdf_path) os.remove('temp_image.jpg') elif ext.lower() in text_extensions: # Text to PDF pdf = FPDF() pdf.add_page() pdf.set_font("Arial", size=12) # Read text file with open(old_ ...[truncated 1655 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding specifically notes safety-signaling language such as 'safe' and mentions backup behavior that may not actually occur while originals are overwritten. False assurances around backup and safety are particularly dangerous for batch file processors because they can directly cause irreversible user data loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding specifically notes safety-signaling language such as 'safe' and mentions backup behavior that may not actually occur while originals are overwritten. False assurances around backup and safety are particularly dangerous for batch file processors because they can directly cause irreversible user data loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding specifically notes safety-signaling language such as 'safe' and mentions backup behavior that may not actually occur while originals are overwritten. False assurances around backup and safety are particularly dangerous for batch file processors because they can directly cause irreversible user data loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding specifically notes safety-signaling language such as 'safe' and mentions backup behavior that may not actually occur while originals are overwritten. False assurances around backup and safety are particularly dangerous for batch file processors because they can directly cause irreversible user data loss.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The checklist exposes what appears to be a personal account identifier in plain text: 'ClawHub account login (lx19840614)'. Even if it is only a username and not a password, publishing account identifiers helps attackers enumerate valid accounts, target credential-stuffing or phishing attacks, and associate a real individual with the asset. In a commercial skill-release context, this makes the account and related dashboard actions more attractive targets.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises file-manipulation behavior but does not declare an explicit tool scope such as permissions or allowed-tools. In a batch-processing context, undeclared read/write capability increases the chance of unintended or overly broad filesystem access, making user consent and policy enforcement weaker.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: An overly broad description can cause the skill to be invoked for generic file-related requests beyond its safe or intended scope. In a filesystem-modifying tool, over-triggering increases the chance that users run batch operations in inappropriate contexts or on unintended directories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill performs or advertises batch rename, compression, conversion, and organization workflows, all of which can modify or overwrite large numbers of files, yet the description lacks a strong upfront destructive-operation warning. In batch contexts, insufficient warning materially raises the risk of accidental data loss at scale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool advertises support for GIF and BMP and comments imply original formats are preserved, but the implementation writes all non-JPEG inputs using PNG encoding back to the original path. This can corrupt files or produce mislabeled content (for example, a .gif or .bmp file containing PNG data), causing data loss, application failures, and unexpected behavior during batch processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script overwrites original images in place during batch processing without a real backup or a clear destructive-operation warning. In this skill context, marketed as a one-click newbie-friendly file tool, that makes accidental irreversible data loss more likely because users may process entire folders expecting safe compression rather than permanent modification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses English throughout for operational instructions, checklists, and user-facing planning content, but it does not indicate that English is optional or required for a justified region-specific reason. Under the language/locale policy check, forcing a single language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The line states that for TXT/MD conversion, 'English works best,' which expresses a language preference in the skill description. Under the policy, forcing or preferring a specific language without explicit user choice can be a natural-language policy issue, especially since no opt-in or alternative language support choice is offered here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.