Cleanup Reporter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:13 AM UTC
• Version: 0.1.0

Overview

The skill is a local cleanup scanner, but it hard-codes a broad personal Windows user directory and writes sensitive file metadata without clear per-run scoping or confirmation.

Review before installing. This skill should only be used if /mnt/c/Users/malav is the intended scan target and you are comfortable with local reports listing file paths, duplicate metadata, and resume-related file names. Prefer a version that asks for the scan directory each time, confirms the scope, and uses private temporary/report files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/scanner.sh:14
• Finding: Hard-Coded Broad Filesystem Reconnaissance<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scanner.sh`, lines 14-24 **Vulnerability Type**: Excessive access to a hard-coded user directory **Risk Level**: Medium ### Complete Code Snippet ```bash ncdu -o - /mnt/c/Users/malav | head -n 20 >> "$REPORT_FILE" echo -e "\n## Potential Duplicate Files" >> "$REPORT_FILE" echo "Running rdfind scan... this may take a moment." rdfind -dryrun true -outputname /tmp/duplicates.txt /mnt/c/Users/malav/Documents /mnt/c/Users/malav/Downloads echo "Scan complete. Check /tmp/duplicates.txt for full list." >> "$REPORT_FILE" echo "Found duplicates (see /tmp/duplicates.txt)." >> "$REPORT_FILE" echo -e "\n## Oldest Resume Files" >> "$REPORT_FILE" find /mnt/c/Users/malav -iname "*resume*" -type f -printf "%T+ %p\n" | sort >> "$REPORT_FILE" ``` ### Technical Analysis The script recursively examines the fixed path `/mnt/c/Users/malav` instead of accepting a user-approved scan target. It inventories directory usage, duplicate-file information, and the paths and timestamps of files whose names contain `resume`. These results may reveal sensitive personal information and filesystem structure. Although `SKILL.md` discloses the target path, the identity-specific and broad scope does not follow least privilege. When the process has access to that directory, invocation of the Skill can inspect data belonging to the named user regardless of whether that user is the current operator. ### Attack Path 1. The cleanup Skill is invoked, including through its documented autonomous invocation mechanism. 2. The script runs with the filesystem permissions of the hosting agent. 3. `ncdu` inventories the hard-coded user tree. 4. `rdfind` examines files under the named user's Documents and Downloads directories. 5. `find` recursively identifies resume-related files and records their paths and timestamps. 6. The collected metadata is persisted in the generated report and `/tmp/dupl ...[truncated 562 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the identity-specific path and require the caller to provide an explicit scan directory. - Resolve the supplied path to its canonical form and enforce an allowlist of approved roots. - Confirm the target and scan scope with the user before recursively accessing files. - Default to the invoking user's selected directories rather than scanning an entire user profile. - Allow duplicate-file and resume-file searches to be enabled separately. - Store reports with restrictive permissions, such as by setting `umask 077`. - Minimize persisted metadata and provide an option to delete reports immediately after review. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scanner.sh:19
• Finding: Predictable Shared Temporary Output File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scanner.sh`, line 19 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Complete Code Snippet ```bash rdfind -dryrun true -outputname /tmp/duplicates.txt /mnt/c/Users/malav/Documents /mnt/c/Users/malav/Downloads ``` ### Technical Analysis The script directs `rdfind` output to the constant path `/tmp/duplicates.txt`. Shared temporary directories are generally writable by multiple local users, so predictable names can create collisions. Depending on the operating system's temporary-directory protections and how `rdfind` opens its output file, a local user may be able to pre-create the path or place a symbolic link there. This can cause one execution to overwrite another execution's results, expose duplicate-file metadata through insufficient file permissions, or potentially redirect output to another file writable by the Skill's process. The exact overwrite behavior depends on `rdfind` and platform-level symbolic-link protections, but the fixed shared pathname unnecessarily creates the risk. ### Attack Path 1. A local attacker predicts the fixed `/tmp/duplicates.txt` pathname. 2. Before the Skill runs, the attacker creates that file, races its creation, or places a symbolic link at the path. 3. The Skill invokes `rdfind` with the predictable output pathname. 4. If `rdfind` follows the link or opens the attacker-controlled path unsafely, scan output is redirected or another file writable by the Skill is overwritten. 5. Alternatively, another local process reads the generated file if its resulting permissions permit access. Successful redirection requires local filesystem access, compatible `rdfind` behavior, and a target that the Skill's operating-system account can write. ### Impact Assessment Potential impact includes disclosure of duplicate-file paths, corruption or replacement of scan results, and unintended modifica ...[truncated 229 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a unique temporary file with `mktemp`, for example: ```bash umask 077 DUPLICATES_FILE="$(mktemp "${TMPDIR:-/tmp}/cleanup-reporter.XXXXXX")" trap 'rm -f -- "$DUPLICATES_FILE"' EXIT rdfind -dryrun true -outputname "$DUPLICATES_FILE" \ /mnt/c/Users/malav/Documents /mnt/c/Users/malav/Downloads ``` - Prefer a private temporary directory created with `mktemp -d`. - Set `umask 077` before creating reports or temporary files. - Clean up temporary artifacts with an `EXIT` trap. - Avoid following symbolic links and use exclusive file creation where supported. - If the duplicate list must persist, move it into a private report directory and assign restrictive permissions explicitly. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill claims to scan 'the user's machine' but documents access to a specific hardcoded path, '/mnt/c/Users/malav', while declaring no required environment permissions. That mismatch is dangerous because it can cause unintended access to one particular user's files, including sensitive personal documents, and undermines informed consent about what the skill actually reads.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The autonomous invocation note says the skill runs when 'triggered by the user to perform cleanup tasks,' but does not define what requests qualify or what safeguards prevent overly broad activation. In a filesystem-scanning skill, ambiguous triggers increase the chance the agent invokes it unexpectedly and scans local data without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs broad, hard-coded scans of a specific user's home subdirectories and writes a report listing potentially sensitive file paths without meaningful consent, prompting, or scope controls. In an agent skill context, this can expose private documents and metadata unexpectedly, especially because it targets resume files and duplicate-file inventories under personal folders.

Static analysis

No suspicious patterns detected.