Security audit

Cleanup Reporter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local cleanup scanner, but it hard-codes a broad personal Windows user directory and writes sensitive file metadata without clear per-run scoping or confirmation.

Review before installing. This skill should only be used if /mnt/c/Users/malav is the intended scan target and you are comfortable with local reports listing file paths, duplicate metadata, and resume-related file names. Prefer a version that asks for the scan directory each time, confirms the scope, and uses private temporary/report files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/scanner.sh:14
Finding: Hard-Coded Broad Filesystem Reconnaissance
Content: View full analysis
> "$REPORT_FILE" echo -e "\n## Potential Duplicate Files" >> "$REPORT_FILE" echo "Running rdfind scan... this may take a moment." rdfind -dryrun true -outputname /tmp/duplicates.txt /mnt/c/Users/malav/Documents /mnt/c/Users/malav/Downloads echo "Scan complete. Check /tmp/duplicates.txt for full list." >> "$REPORT_FILE" echo "Found duplicates (see /tmp/duplicates.txt)." >> "$REPORT_FILE" echo -e "\n## Oldest Resume Files" >> "$REPORT_FILE" find /mnt/c/Users/malav -iname "*resume*" -type f -printf "%T+ %p\n" | sort >> "$REPORT_FILE" ``` ### Technical Analysis The script recursively examines the fixed path `/mnt/c/Users/malav` instead of accepting a user-approved scan target. It inventories directory usage, duplicate-file information, and the paths and timestamps of files whose names contain `resume`. These results may reveal sensitive personal information and filesystem structure. Although `SKILL.md` discloses the target path, the identity-specific and broad scope does not follow least privilege. When the process has access to that directory, invocation of the Skill can inspect data belonging to the named user regardless of whether that user is the current operator. ### Attack Path 1. The cleanup Skill is invoked, including through its documented autonomous invocation mechanism. 2. The script runs with the filesystem permissions of the hosting agent. 3. `ncdu` inventories the hard-coded user tree. 4. `rdfind` examines files under the named user's Documents and Downloads directories. 5. `find` recursively identifies resume-related files and records their paths and timestamps. 6. The collected metadata is persisted in the generated report and `/tmp/dupl ...[truncated 562 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scanner.sh:19
Finding: Predictable Shared Temporary Output File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill claims to scan 'the user's machine' but documents access to a specific hardcoded path, '/mnt/c/Users/malav', while declaring no required environment permissions. That mismatch is dangerous because it can cause unintended access to one particular user's files, including sensitive personal documents, and undermines informed consent about what the skill actually reads.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The autonomous invocation note says the skill runs when 'triggered by the user to perform cleanup tasks,' but does not define what requests qualify or what safeguards prevent overly broad activation. In a filesystem-scanning skill, ambiguous triggers increase the chance the agent invokes it unexpectedly and scans local data without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script performs broad, hard-coded scans of a specific user's home subdirectories and writes a report listing potentially sensitive file paths without meaningful consent, prompting, or scope controls. In an agent skill context, this can expose private documents and metadata unexpectedly, especially because it targets resume files and duplicate-file inventories under personal folders.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.