Env Health Check

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:38 AM UTC
• Version: 1.0.0

Overview

This deployment health-check skill is mostly purpose-aligned, but its filesystem write checks can overwrite or delete files in user-supplied directories without adequate safeguards.

Review before installing. Use this only on directories where creating and deleting a temporary probe file is acceptable, avoid sensitive or shared paths, and choose an output report path that can be overwritten. The skill should be safer if updated to use exclusive random temporary files, avoid symlink following, and warn or require confirmation before overwriting reports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:5

Finding

Predictable Temporary File Allows File Destruction and Symlink-Based Target Corruption

Content

View full analysis

Vulnerability Details

File Location: index.js, line 5
Vulnerability Type: Unsafe temporary-file creation and predictable filename
Risk Level: Medium

js

for(const d of dirs){const abs=path.resolve(d); const exists=fs.existsSync(abs); let writable=false; if(exists){ try{ const test=path.join(abs,'.env-health-check.tmp'); fs.writeFileSync(test,'ok','utf8'); fs.unlinkSync(test); writable=true; }catch{} }

Technical Analysis

The directory write-permission test uses the fixed filename .env-health-check.tmp. fs.writeFileSync() opens an existing destination for truncation and does not require exclusive creation. Consequently, if a regular file already exists at that path, the skill replaces its contents with ok and then deletes it.

The operation also does not prevent symbolic-link traversal. If an attacker places .env-health-check.tmp as a symbolic link, fs.writeFileSync() follows the link and truncates the linked target. The subsequent fs.unlinkSync(test) removes the symbolic link itself, but the target remains corrupted.

Because the filename is predictable and the existence check does not securely validate the probe file, this creates a time-of-check/time-of-use and unsafe temporary-file condition.

Attack Path

1. An attacker obtains write access to a directory that a more privileged user or service will pass through --dir.
2. The attacker creates <checked-directory>/.env-health-check.tmp as either:
   • a valuable regular file, or
   • a symbolic link to another file writable by the account running the skill.
3. The privileged user or service invokes node index.js --dir <checked-directory>.
4. The skill follows or opens the predictable pathname and truncates its destination to the string ok.
5. The skill deletes .env-health-check.tmp. If it was a symbolic link, the link is removed while the linked target remains corrupted.

Impact Assessment

Exploitation does not d ...[truncated 582 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique probe in the target directory using a cryptographically random name or fs.mkdtempSync().
• Open the probe atomically with exclusive creation, such as O_CREAT | O_EXCL | O_WRONLY, so an existing path is never overwritten.
• Where supported, add O_NOFOLLOW to prevent symbolic-link traversal.
• Record whether the current invocation successfully created the probe and delete it only if ownership is certain.
• Place cleanup in a finally block so failures do not leave probe files behind.
• Do not perform a separate existence check followed by a non-exclusive write, because that remains vulnerable to races.
• Consider using fs.accessSync(abs, fs.constants.W_OK) when a non-destructive permission indication is sufficient, while recognizing that an actual atomic probe more accurately tests effective write access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs inspection of environment variables and references code capabilities for env access, but it does not declare any tool scope such as permissions or allowed-tools. That mismatch is risky because it obscures sensitive data access from policy review and can lead to broader-than-expected exposure of secrets in environment variables during execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill reads arbitrary environment variable names supplied via --env and includes their presence in a generated report without any user-facing disclosure, allowlist, or sensitivity filtering. In a deployment-validation context this is risky because environment variables commonly include secrets, and even confirming whether specific secret names exist can leak sensitive configuration details to logs or report files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill performs active write/delete probes in user-specified directories by creating and deleting a temporary file, but it does so automatically and without prior warning. Even though the intent is a health check, this behavior modifies the filesystem and can have side effects in sensitive directories, mounted volumes, audited paths, or locations where writes trigger automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The report output path is user-controlled and is written with fs.writeFileSync, which will overwrite an existing file without warning. In this skill's context, that can destroy existing data or overwrite important workspace files if the caller passes an unsafe --out path or relies on the default path without realizing a prior report will be replaced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.