Neckr0ik Security Fixer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This security-fixer skill is not clearly malicious, but its auto-fix mode has unsafe file-modification behavior that can corrupt code or write outside the intended target.

Review this skill carefully before installing. Use it only on a clean, backed-up repository, prefer --dry-run, inspect every diff manually, and avoid --auto until the path containment, manual-review bypass, and source-replacement issues are fixed. The .env guidance itself looks purpose-aligned, but the file-writing behavior is too broad for unattended use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/fixer.py:74

Finding

Unrestricted Scanner-Supplied File Access and Modification

Content

View full analysis

None: """Apply a single fix to a file.""" # Create backup if enabled if self.backup: backup_path = fix.file_path.with_suffix(fix.file_path.suffix + '.bak') shutil.copy2(fix.file_path, backup_path) # Read file content = fix.file_path.read_text(encoding='utf-8') lines = content.split('\n') # Replace lines new_lines = lines[:fix.line_start-1] new_lines.extend(fix.fixed_code.split('\n')) new_lines.extend(lines[fix.line_end:]) # Write back fix.file_path.write_text('\n'.join(new_lines), encoding='utf-8') ``` ### Technical Analysis The path contained in `vuln.file` is accepted directly from the external scanner result and converted to a `Path` without validation. The implementation does not resolve the path against `self.skill_path`, verify that it remains under the requested skill directory, reject absolute paths, or detect symlinks that escape the directory. Consequently, a malicious or compromised `audit` implementation can submit an absolute path such as `/home/user/.bashrc` or a traversal path such as `../../sensitive-file`. The fixer will read that file during fix generation and may subsequently create a backup and overwrite it during fix application. The required `audit` module is not included in this project, so its trustworthiness and validation behavior cannot be established from the audited source. ### Attack Path 1. An attacker influences the target being scanned or compromises/spoofs the imported `audit` module. 2. The scanner returns a vulnerability whose `file` field points outside the inte ...[truncated 881 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fixer.py:228

Finding

Automatic Mode Applies Fixes Explicitly Marked as Unsafe for Automatic Application

Content

View full analysis

List[Fix]: """Apply all fixes to files.""" applied = [] for fix in self.fixes: if fix.manual_review and not auto: print(f"[REVIEW] {fix.file_path}:{fix.vulnerability.line} - {fix.vulnerability.name}") print(f" {fix.notes}") continue if not fix.auto_fixable and not auto: print(f"[MANUAL] {fix.file_path}:{fix.vulnerability.line} - {fix.vulnerability.name}") print(f" Requires manual fix") continue # Apply fix if self.dry_run: print(f"[DRY-RUN] Would fix: {fix.file_path}:{fix.vulnerability.line}") ``` ### Technical Analysis Both safety conditions are dependent on `not auto`. When `--auto` is enabled, a fix is applied even if `manual_review` is true or `auto_fixable` is false. This behavior defeats the distinction between trusted automatic transformations and review-only placeholders. It also contradicts the documented claim that complex issues are flagged for manual review. Non-fix transformations, including comments generated for `eval`, `exec`, or dependency findings, can therefore be written directly into source files. ### Attack Path 1. The scanner reports a vulnerability for which the fixer generates a review-only or non-auto-fixable replacement. 2. The resulting `Fix` has `manual_review=True` or `auto_fixable=False`. 3. The user invokes the documented `fix --auto` command. 4. Because `auto` is true, both rejection conditions evaluate to false. 5. `_apply_fix()` writes the unsafe placeholder or incomplete transformation into the target file. 6. The modified application may become nonfunctional or lose security-relevant behavior. ### I ...[truncated 513 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fixer.py:82

Finding

Fix Application Replaces and Deletes Unrelated Surrounding Source Lines

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fixer.py:174

Finding

Generated Security Fixes Are Incomplete and Can Leave Vulnerabilities Unresolved

Content

View full analysis

Tuple[str, bool]: """Fix prompt injection vulnerabilities.""" line = lines[vuln.line - 1] if vuln.line <= len(lines) else "" indent = len(line) - len(line.lstrip()) fixed = f'''{line[:indent]}import re {line[:indent]}def sanitize_for_prompt(text: str) -> str: {line[:indent]} return re.sub(r'[<>\\{{\\}}\\[\\]\\\\]', '', text[:1000]) {line[:indent]} {line[:indent]}# Sanitize user input before use in prompt {line[:indent]}sanitized_input = sanitize_for_prompt(user_input)''' return fixed, True ``` The path-containment transformation uses a string-prefix comparison: ```python fixed = f'''{line[:indent]}from pathlib import Path {line[:indent]}import re {line[:indent]} {line[:indent]}def safe_path(base_dir: str, user_input: str) -> Path: {line[:indent]} safe_name = re.sub(r'[^\\w.-]', '_', Path(user_input).name) {line[:indent]} full_path = (Path(base_dir) / safe_name).resolve() {line[:indent]} if not str(full_path).startswith(str(Path(base_dir).resolve())): {line[:indent]} raise ValueError("Path traversal detected") {line[:indent]} return full_path''' ``` The documentation also recommends shell quoting while invoking a process without a shell: ```python import subprocess import shlex safe_input = shlex.quote(user_input) subprocess.run(["echo", safe ...[truncated 2732 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

text

# Environment Variables
# Copy to .env and fill in your values

OPENAI_API_KEY=your-key-here
ANTHROPIC_API_KEY=your-key-here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/fix-templates.md (reported line 46)May include surrounding context.

text

# Environment Variables
# Copy to .env and fill in your values

OPENAI_API_KEY=your-key-here
ANTHROPIC_API_KEY=your-key-here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fixer.py (reported line 95)May include surrounding context.

python

```
# Environment Variables
# Copy to .env and fill in your values

OPENAI_API_KEY=your-key-here
ANTHROPIC_API_KEY=your-key-here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fixer.py (reported line 287)May include surrounding context.

python

```
# Environment Variables
# Copy to .env and fill in your values

OPENAI_API_KEY=your-key-here
ANTHROPIC_API_KEY=your-key-here

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/fix-templates.md (reported line 89)May include surrounding context.

Before:

python

subprocess.run(f"ls {directory}", shell=True, capture_output=True)

After:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · references/fix-templates.md (reported line 356)May include surrounding context.

md

def _load_from_env(self) -> None:
        """Load configuration from environment variables."""
        for key, value in os.environ.items():
            if key.startswith(self.prefix):
                config_key = key[len(self.prefix):].lower()
                self._config[config_key] = value

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fixer.py (reported line 304)May include surrounding context.

python

if gitignore_path.exists():
            gitignore_content = gitignore_path.read_text()
        
        if '.env' not in gitignore_content:
            gitignore_content += "\n# Environment variables\n.env\n.env.local\n"
            
            if not self.dry_run:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes capabilities to read and write files, access environment variables, and invoke shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where a consumer may not understand the skill's operational reach, increasing the risk of unsafe execution or over-privileged use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says this skill auto-remediates hardcoded secrets, shell injection risks, prompt injection, and path traversal issues. This file also includes a separate 'Code Execution' section with eval/exec remediation templates, which expands the documented remediation scope beyond the listed vulnerability classes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The fixer writes modified source files in place once invoked, and can do so automatically with --auto, but it does not present an explicit overwrite warning or require confirmation before changing project files. This creates a real safety risk because users may unintentionally alter code, and if the skill is pointed at an unexpected path it could overwrite files beyond what the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool creates or updates .env.example and .gitignore as part of normal execution without an explicit warning that project metadata files will be written. While not credential theft by itself, silent modification of repository files can surprise users, break workflows, or be abused to persist changes in a project under the guise of security remediation.

Content

No source excerpt is available for this finding.