Security audit

File Organizer

Security checks for vulnerabilities and agentic risk

Overview

This file organizer is mostly coherent, but its execute mode can move or overwrite files beyond the intended folder if fed a crafted scan file or run with the non-interactive flag.

Install only if you are comfortable with a local filesystem tool that can move files. Use dry-run first, inspect the complete JSON plan, do not run plans from untrusted scan files, and avoid --execute --yes unless you have backups and have checked for destination conflicts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/organize.py:123
Finding: Untrusted Scan Plan Allows Arbitrary File Relocation and Destination Path Escape
Content: View full analysis
1: dest_path = dest_root / category / rel else: dest_path = dest_root / category / f["name"] ``` The resulting paths are later used directly during execution: ```python for move in moves: src = Path(move["source"]) dst = Path(move["dest"]) if dst.exists() and not yes: skipped_conflicts += 1 errors.append({ "source": move["source"], "dest": move["dest"], "error": "destination_exists" }) continue try: dst.parent.mkdir(parents=True, exist_ok=True) shutil.move(str(src), str(dst)) succeeded += 1 ``` ### Technical Analysis `organize.py` accepts a scan JSON file and treats its `scan_dir`, `abs_path`, `path`, `name`, and size metadata as authoritative. The input is parsed as JSON, but its schema, provenance, and path relationships are not validated. In particular: 1. `f["abs_path"]` can identify any file accessible to the executing account. The code does not verify that the resolved source is inside the declared `scan_dir`. 2. `f["path"]` may be absolute or contain `..` traversal components. When this value is appended to `dest_root / category`, it can resolve outside the intended organization directory. 3. The destination is not canonicalized ...[truncated 2216 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/organize.py:226
Finding: The --yes Confirmation Option Also Enables Destructive Destination Overwrites
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
- `--flat` — don't preserve subdirectory structure - `--dry-run` — default, shows plan without moving anything - `--execute` — actually move files (prompts for confirmation) - `--execute --yes` — skip confirmation prompt ### 4. Execute the plan

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's warning message says to re-run with --yes to overwrite existing destinations, but the execution logic also uses --yes to bypass the safety check and allows shutil.move to proceed when the destination exists. Depending on platform behavior, this can overwrite or replace existing files unexpectedly, creating a real integrity risk through misleading operator guidance.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/organize.py (reported line 346)May include surrounding context.
python
"-y", action="store_true", default=False, help="Skip confirmation prompt when using --execute", ) parser.add_argument( "--dest",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script emits a complete directory inventory including absolute paths, filenames, sizes, timestamps, and optional hashes to stdout or a file without any warning, redaction, or access-control safeguard. In an agent/skill context, this can expose sensitive system metadata and file layout information to logs, downstream tools, or users who did not need full path disclosure, which can materially aid reconnaissance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code creates parent directories and writes a markdown file to a user-supplied path, but it does not provide advance disclosure about modifying the filesystem before performing the write. For code files, file writes should have some visible warning, confirmation, or explanatory disclosure; here the only user-facing message appears after the write completes.
Content: No source excerpt is available for this finding.