Waste Disposal Guide

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:30 AM UTC
• Version: 0.1.0

Overview

This skill needs review because it can give unsafe chemical waste container guidance for blank or mixed chemical inputs, although it shows no hidden network, credential, persistence, or file-modifying behavior.

Only use this as a demonstration or rough reference until the lookup is fixed. Do not rely on it for real chemical disposal decisions without EHS approval, SDS review, exact chemical identifiers, and explicit handling for mixtures, unknowns, and ambiguous inputs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:65

Finding

Unsafe Substring Matching Can Produce Hazardous Chemical Disposal Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 65-72
Vulnerability Type: Improper input validation and ambiguous substring matching
Risk Level: High

Complete Code Snippet

python

def lookup(self, chemical):
    """Look up disposal category for chemical."""
    chemical_lower = chemical.lower().strip()
    
    for category, info in self.WASTE_CATEGORIES.items():
        if any(chemical_lower in accept or accept in chemical_lower 
               for accept in info["accepts"]):
            return info
    
    return None

Technical Analysis

The lookup routine uses bidirectional substring matching instead of exact, normalized chemical identifiers:

python

chemical_lower in accept or accept in chemical_lower

This logic accepts blank, partial, ambiguous, and compound inputs as valid matches. For example:

• Whitespace-only input becomes an empty string after strip(). Because an empty string is considered a substring of every string, the first entry in the first category matches, causing the input to be classified as halogenated organic waste.
• A partial string can match an unintended chemical alias.
• An input containing multiple chemicals is classified according to the first matching category in dictionary iteration order. The code does not detect mixtures or conflicting categories.
• The method returns immediately after the first match, preventing ambiguity detection.

The output presents the result as authoritative disposal guidance, so a false-positive classification is safety-relevant rather than merely a display error.

Attack Path

1. A user or upstream caller supplies blank, partial, ambiguous, or multi-chemical text through --chemical.
2. The application lowercases and strips the text but does not reject empty input or parse mixtures.
3. Bidirectional substring matching identifies the first compatible substring in WASTE_CATEGORIES. ...[truncated 1255 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject empty or whitespace-only input before attempting a lookup.
2. Replace substring comparisons with exact matching against normalized aliases.
3. Maintain an explicit alias-to-category mapping so that each accepted identifier has deterministic behavior.
4. Detect separators and language indicating mixtures, such as commas, semicolons, slashes, plus signs, or words such as and and with.
5. Evaluate all matches before returning. If multiple categories match, do not recommend a container; instruct the user to contact Environmental Health and Safety personnel.
6. Treat unknown, partial, or ambiguous names as unresolved rather than selecting the first category.
7. Consider requiring validated identifiers, such as CAS Registry Numbers, for operational use.
8. Add regression tests covering:
   • Empty and whitespace-only input
   • Partial chemical names
   • Unknown substances
   • Multiple chemicals from the same category
   • Mixtures belonging to conflicting categories
   • Aliases with different capitalization and surrounding whitespace
9. Include a clear warning that this limited static database must not replace site-specific EHS procedures or Safety Data Sheet review.

A safer lookup pattern would normalize the input and perform exact alias matching:

python

def lookup(self, chemical):
    chemical_lower = chemical.casefold().strip()
    if not chemical_lower:
        return None

    matches = [
        info
        for info in self.WASTE_CATEGORIES.values()
        if chemical_lower in {alias.casefold() for alias in info["accepts"]}
    ]

    if len(matches) != 1:
        return None

    return matches[0]

Mixture detection and explicit ambiguous-result handling should be added before presenting any disposal recommendation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation explicitly states that local Python scripts are executed and that output files may be written to the workspace, but it does not clearly warn users that running the skill can modify local files. This creates a real transparency and safety issue because users may invoke the skill assuming it is informational only, while it actually performs filesystem-affecting actions that could overwrite, create, or clutter workspace contents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.