Neckr0ik Code Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:02 AM UTC
• Version: 1.1.0

Overview

This code-generator skill is not malicious, but it can write and overwrite local project files with weak path and input controls, so it should be reviewed before use.

Use this only in a disposable or clearly chosen output directory, review generated files before running them, and avoid untrusted model names, field names, project names, or output paths. Do not rely on its advertised API-client or multi-language features without verifying the actual implementation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generator.py:137
• Finding: Unrestricted Output Path Allows Arbitrary File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generator.py:137-151` **Vulnerability Type**: Path traversal and unrestricted file overwrite **Risk Level**: Medium ### Vulnerable Code ```python project_dir = self.output_dir / name project_dir.mkdir(parents=True, exist_ok=True) # Create directories for dir_name in ["src", "tests", "docs"]: (project_dir / dir_name).mkdir(exist_ok=True) # Create files (project_dir / "README.md").write_text(f"# {name}\n\n{description or 'A Python project'}\n") (project_dir / "pyproject.toml").write_text(f'''[project] name = "{name}" version = "0.1.0" description = "{description or 'A Python project'}" ``` Additional files are subsequently written beneath the same unvalidated `project_dir`: ```python (project_dir / "src" / "__init__.py").write_text(f'"""{name} - {description or 'A Python project'}"""\n') (project_dir / "tests" / "__init__.py").write_text("") (project_dir / ".gitignore").write_text("__pycache__/\n*.py[cod]\n.env\n.venv/\n") ``` ### Technical Analysis The project destination is calculated by directly joining the caller-controlled `name` with the caller-controlled `output_dir`: ```python project_dir = self.output_dir / name ``` Neither value is normalized and checked against an approved output root. In `pathlib`, an absolute right-hand operand causes the left-hand path to be discarded. A project name containing parent-directory components such as `../` can also resolve outside the expected output directory. The script then creates the destination and writes multiple files with `Path.write_text()`. That method truncates existing files by default, and the implementation does not check whether a target already exists or require explicit overwrite confirmation. The vulnerability is limited by the operating-system privileges of the process running the generator. It does not independently elevate privileges. ### Attack Path 1. An attacker supplies or influences the `scaffold` command's projec ...[truncated 1386 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the configured output root and candidate destination before creating anything: ```python output_root = self.output_dir.resolve() candidate = (output_root / name).resolve() ``` 2. Reject absolute project names, parent-directory components, empty names, and path separators: ```python name_path = Path(name) if name_path.is_absolute() or ".." in name_path.parts or len(name_path.parts) != 1: raise ValueError("Project name must be a single relative path component") ``` 3. Enforce containment beneath the approved output root: ```python if candidate != output_root and output_root not in candidate.parents: raise ValueError("Project destination escapes the output directory") ``` 4. Refuse to write into an existing nonempty destination by default. 5. Add an explicit `--force` option if overwrite behavior is required, and clearly list affected files before proceeding. 6. Prefer exclusive file creation, such as mode `x`, for new scaffolds. 7. Add tests covering absolute paths, `../` traversal, nested traversal, symbolic links, and existing-file collisions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generator.py:20
• Finding: Unsanitized Identifiers Permit Python Source Injection into Generated Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generator.py:20-92` **Vulnerability Type**: Generated-code injection through unsafe template interpolation **Risk Level**: Medium ### Vulnerable Code ```python def python_crud_template(model_name, fields, database="sql"): """Generate Python CRUD template.""" model_lower = model_name.lower() create_fields = ", ".join([f"{k}=user.{k}" for k in fields.keys()]) return f'''""" CRUD operations for {model_name} model. Auto-generated by neckr0ik-code-generator. """ from typing import List, Optional from sqlalchemy.orm import Session from models import {model_name} from schemas import {model_name}Create, {model_name}Update class {model_name}CRUD: """CRUD operations for {model_name} model.""" def create(self, db: Session, user: {model_name}Create) -> {model_name}: """Create a new {model_lower}.""" db_{model_lower} = {model_name}({create_fields}) db.add(db_{model_lower}) db.commit() db.refresh(db_{model_lower}) return db_{model_lower} def get(self, db: Session, {model_lower}_id: int) -> Optional[{model_name}]: """Get a {model_lower} by ID.""" return db.query({model_name}).filter({model_name}.id == {model_lower}_id).first() ``` The model generator applies the same pattern to field and model names: ```python def python_model_template(model_name, fields): """Generate SQLAlchemy model.""" field_defs = "\n ".join([f"{k} = Column(String(255))" for k in fields.keys()]) return f'''""" {model_name} model. Auto-generated by neckr0ik-code-generator. """ from sqlalchemy import Column, Integer, String, DateTime from sqlalchemy.ext.declarative import declarative_base from datetime import datetime Base = declarative_base() class {model_name}(Base): """{model_name} database model.""" __tablename__ = "{model_name.lower()}s" id = Column(Integer, primary_key=True, index=True) {field_ ...[truncated 2578 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require all model and field names to be valid Python identifiers: ```python import keyword def validate_identifier(value: str, label: str) -> str: if not value or not value.isidentifier() or keyword.iskeyword(value): raise ValueError(f"Invalid Python identifier for {label}: {value!r}") return value ``` 2. Apply validation to the model name and every field name before template generation: ```python model_name = validate_identifier(model_name, "model") for field_name in fields: validate_identifier(field_name, "field") ``` 3. Reject control characters, line breaks, quotes, path separators, and unexpected punctuation at the CLI boundary. 4. Define an allowlist for field types rather than accepting unrestricted type text, even though the current SQLAlchemy template does not use the parsed type value. 5. Prefer constructing generated Python through the standard `ast` module or another structured code-generation mechanism instead of directly interpolating untrusted text. 6. Parse generated code with `ast.parse()` before returning it. This verifies syntax, although it must supplement rather than replace identifier validation. 7. Add negative tests for Python keywords, newline injection, quote injection, semicolons, decorators, comments, Unicode edge cases, and malformed field definitions. 8. Clearly document that generated code must be reviewed before execution, particularly when arguments originate from an untrusted specification or automated workflow. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises code-generation behavior that inherently writes files and may invoke shell-like operations, but it declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may execute filesystem or command actions without the user being clearly informed of the required capabilities or constrained to a narrow set of tools.

External Transmission

Medium

• Category: Data Exfiltration

Content

neckr0ik-code-generator crud User --fields "name,email,created_at"

# Generate an API client
neckr0ik-code-generator api-client --spec https://api.example.com/openapi.json

# Generate tests
neckr0ik-code-generator tests --source ./src --type unit

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description is broadly scoped and can trigger on vague requests to 'generate code' or 'scaffold' without limiting technologies, trust boundaries, or safe-use conditions. In an agent ecosystem, this can cause overbroad invocation and lead the skill to produce high-risk boilerplate such as insecure CRUD endpoints, API clients, or database code in contexts where stronger review or narrower tooling should apply.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The description says the skill generates scaffolds, CRUD, models, tests, and config, but it does not clearly warn that these actions will create directories and write multiple files to disk. This can surprise users and lead to unintended repository modifications, overwrites, or generation in the wrong location.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The api-client command accepts a URL for --spec, but the description does not warn users that the skill may perform outbound network access to fetch remote OpenAPI documents. Unannounced remote fetching can expose metadata, trigger requests to attacker-controlled endpoints, or introduce untrusted input into downstream code generation.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: This code creates directories and writes several files into the target output path, which is a safety-relevant filesystem modification. While it prints success messages afterward, there is no prior confirmation prompt and the docstrings/comments do not explicitly warn that running the scaffold command will create or overwrite project files in the specified location.

Static analysis

No suspicious patterns detected.