Sendme

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:53 PM UTC
• Version: 0.1.4

Overview

This skill is a straightforward file-transfer helper; its main risks are ordinary file-sharing risks around choosing paths, recipient tickets, transfer size, and installing the sendme tool.

Install only from a source you trust, prefer a reviewed or package-manager version, and only send explicit files or folders you intend to share. Treat sendme tickets as access tokens, verify the recipient, and check available disk space before receiving large folders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Third-Party Cargo Package Installation## Vulnerability Details **File Location**: `SKILL.md`, line 25 **Vulnerability Type**: Unpinned dependency installation from an external package registry **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown Alternatively, install via Cargo: `cargo install sendme` ``` ### Technical Analysis The skill recommends installing `sendme` from the configured Cargo registry without specifying an exact version, requiring a lockfile, validating a checksum, or verifying release provenance. Consequently, the command resolves and compiles whichever package version the registry serves at installation time. Cargo packages can execute package-controlled build scripts during compilation. Therefore, compromise of the package, its publisher account, the configured registry, or a future release could cause unreviewed code to execute before the installed application is used. The audited file does not establish that the current package is malicious; the vulnerability is the absence of controls that make dependency installation reproducible and verifiable. ### Attack Path 1. An attacker compromises the relevant package publisher, package release process, or Cargo registry, or otherwise causes a malicious future version of `sendme` to be published. 2. A user or agent follows the instruction in `SKILL.md` and runs `cargo install sendme`. 3. Cargo resolves the unpinned package version and downloads attacker-controlled package content. 4. Cargo compiles the package and may execute attacker-controlled build scripts with the privileges of the user performing the installation. 5. The resulting malicious executable may also run later when the skill invokes `sendme` to send or receive files. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the account running Cargo. This may permit access to that user's files, environment variables, credentials, and network resources, as well as modificati ...[truncated 310 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact, reviewed release: ```bash cargo install sendme --version '<exact-version>' --locked ``` - Document the expected Cargo registry, package identity, publisher, and reviewed version. - Verify release provenance, signatures, or published checksums before installation. - Review the package source, transitive dependencies, and build scripts for the pinned release. - Execute installation under an unprivileged account and avoid installing from administrator or root contexts. - Prefer a trusted package-manager artifact when it provides stronger provenance and integrity controls. - Establish a controlled update process in which newer versions are reviewed and tested before changing the pin.

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill is activated by very broad phrases such as 'share files' or 'send files to someone', which can cause it to trigger in many ordinary conversations without clear user confirmation or safety gating. In a file-transfer skill, over-broad activation increases the chance of unintended data sharing workflows being initiated around sensitive local paths or externally provided tickets.

Unbounded Output

Medium

• Category: Output Handling

Content

- **Resumable**: Interrupted downloads continue from where they left off.
- **Integrity**: All data is blake3-verified during streaming.
- **Speed**: Saturates connections up to 4Gbps.
- **No size limit**: Works with files and folders of any size.
- **Sender must stay online**: The `sendme send` process must keep running until the recipient completes the download.

• Confidence: 80% confidence
• Finding: Advertising and enabling transfers with 'no size limit' can lead to unbounded disk, bandwidth, and runtime consumption when receiving or sending large datasets. In an agent context, this can be abused for denial of service, quota exhaustion, or unintended transfer of massive directories, especially because the skill also supports recursive folder transfer and resumable downloads.

Static analysis

No suspicious patterns detected.