Pc Assistant Fixed

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:04 AM UTC
• Version: 1.0.0

Overview

This skill is a local healthcheck tool, but it stores broad sensitive system and user data in plaintext reports and includes an unsafe scheduler configuration loader.

Install only if you need a very broad local diagnostic snapshot and are comfortable handling the reports as confidential. Run it manually as a regular user, choose a private output directory with restrictive permissions, review and redact reports before sharing, and avoid scheduled use unless the config file is trusted and protected; machines with API tokens, SSH access, or sensitive shell history are higher risk.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/healthcheck.sh:350

Finding

Excessive Collection of Sensitive Host and User Information

Content

View full analysis

> "$REPORT_FILE" ``` ```bash subsection "8.1 Environment Variables" { echo "=== Key Environment Variables ===" echo "PATH: $PATH" | head -5 echo "" echo "=== All Environment Variables ===" env | sort | head -40 } >> "$REPORT_FILE" subsection "8.2 Shell Configuration" { echo "=== Shell History (last 20) ===" if [ -f ~/.bash_history ]; then tail -20 ~/.bash_history fi echo "" echo "=== Aliases ===" alias 2>/dev/null | head -20 } >> "$REPORT_FILE" ``` ```bash subsection "12.1 User Crontab" crontab -l 2>/dev/null >> "$REPORT_FILE" || echo "No user crontabs" >> "$REPORT_FILE" subsection "12.2 System Cron" { echo "=== /etc/crontab ===" cat /etc/crontab 2>/dev/null echo "" echo "=== Cron.d files ===" ls -la /etc/cron.d/ 2>/dev/null } >> "$REPORT_FILE" subsection "12.3 Anacron" if [ -f /etc/anacrontab ]; then echo "=== /etc/anacrontab ===" cat /etc/anacrontab >> "$REPORT_FILE" fi ``` The script also records active network connections, processes, account information, authentication failures, and listening services elsewhere in the same report. ### Technical Analysis The declared purpose is PC health diagnostics. Although re ...[truncated 2518 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/healthcheck.sh:29

Finding

Sensitive Diagnostic Reports Are Created in Unsafe Temporary Locations Without Restrictive Permissions

Content

View full analysis

"$REPORT_FILE" << 'EOF' ================================================================================ 🖥️ ENHANCED PC HEALTHCHECK REPORT ================================================================================ EOF ``` ```bash # Create JSON summary { echo "{" echo " \"timestamp\": \"$(date -Iseconds)\"," echo " \"hostname\": \"$(hostname)\"," echo " \"os\": \"$(uname -s)\"," echo " \"kernel\": \"$(uname -r)\"," echo " \"uptime\": \"$(uptime -p 2>/dev/null || uptime)\"," echo " \"memory_total_gb\": $(free -g 2>/dev/null | awk '/^Mem:/{print $2}')," echo " \"memory_used_gb\": $(free -g 2>/dev/null | awk '/^Mem:/{print $3}')," echo " \"memory_percent\": $(free | awk '/^Mem:/{print int($3/$2*100)}')," echo " \"cpu_cores\": $(nproc)," echo " \"cpu_model\": \"$(grep 'model name' /proc/cpuinfo | head -1 | cut -d: -f2 | xargs)\"," echo " \"report_file\": \"$REPORT_FILE\"" echo "}" } > "$JSON_FILE" ``` The scheduler uses another shared temporary directory by default: ```bash load_config() { if [[ -f "$CONFIG_FILE" ]]; then source "$CONFIG_FILE" fi OUTPUT_DIR="${PC_ASSISTANT_OUTPUT_DIR:-/tmp/pc-healthcheck-reports}" REPORT_PREFIX="${PC_ASSISTANT_REPORT_PREFIX:-HealthCheck}" NOTIFY="${PC_ASSISTANT_NOTIFY:-false}" KEEP_DAYS="${PC_ASSISTANT_ ...[truncated 2930 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/schedule.sh:10

Finding

Scheduler Executes Configuration Files as Arbitrary Shell Code

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is documented as a read-only cross-platform healthcheck, but the described behavior goes far beyond that by collecting potentially sensitive security and user data, generating persistent reports, and overstating platform/scheduling support. This mismatch is dangerous because users may consent to a benign diagnostic while actually exposing authentication material, system inventory, and security posture data that could aid later compromise or privacy invasion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as 'read-only system diagnostics,' but it persistently writes detailed reports and JSON summaries to disk under a user-controllable path. That mismatch matters because the written files contain sensitive host, user, network, and security data, creating a durable local disclosure risk beyond transient read-only inspection.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script starts collecting data into persistent report files without any clear warning that it will include potentially sensitive system, network, account, and security information. In the context of an agent skill, silent collection is more dangerous because users may trust the 'healthcheck' label and not expect durable local reports containing sensitive details.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script reads and stores SSH authorized_keys and known_hosts data, which are sensitive trust and access artifacts not necessary for a general PC healthcheck. Even partial capture can reveal account relationships, infrastructure names, and access configuration that could aid lateral movement or targeting if the report is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

SSH authorized_keys and known_hosts are written into the report with no specific disclosure or confirmation. These files contain trust relationships and access configuration that users would not reasonably expect a general healthcheck to capture, and storing them in a report magnifies disclosure risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Across these sections, the script aggregates SSH trust data, login records, package inventories, environment variables, and shell history into a single plain-text report. Centralizing this information creates a high-value local intelligence bundle that can significantly aid an attacker if accessed, copied, or uploaded during troubleshooting.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Reading ~/.ssh/authorized_keys exposes who is permitted to authenticate to the account and may reveal administrative access arrangements. Even though private keys are not read, this is credential-adjacent access data that can materially assist targeting and persistence planning when written to a report.

Content

Scanner excerpt · scripts/healthcheck.sh (reported line 356)May include surrounding context.

sh

{
    echo "=== SSH Authorized Keys ==="
    if [ -d ~/.ssh ]; then
        for keyfile in ~/.ssh/authorized_keys ~/.ssh/authorized_keys2; do
            [ -f "$keyfile" ] && echo "$keyfile:" && cat "$keyfile" | head -5
        done
    fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Accessing ~/.ssh/known_hosts reveals trusted remote systems and internal hostnames or IPs, which can disclose network topology and operational relationships. Persisting this data in a diagnostics report increases the chance that sensitive infrastructure details are leaked.

Content

Scanner excerpt · scripts/healthcheck.sh (reported line 362)May include surrounding context.

sh

fi
    echo ""
    echo "=== SSH Known Hosts ==="
    if [ -f ~/.ssh/known_hosts ]; then
        head -10 ~/.ssh/known_hosts
    fi
} >> "$REPORT_FILE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The specific read of known_hosts content is a true information disclosure issue because it extracts sensitive trust relationships into a report unrelated to basic system health. In this skill context, that is more dangerous because the stated purpose does not justify collecting remote host trust data.

Content

Scanner excerpt · scripts/healthcheck.sh (reported line 363)May include surrounding context.

sh

echo ""
    echo "=== SSH Known Hosts ==="
    if [ -f ~/.ssh/known_hosts ]; then
        head -10 ~/.ssh/known_hosts
    fi
} >> "$REPORT_FILE"

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Dumping environment variables and shell history into a report can expose credentials, API tokens, internal URLs, usernames, commands, and operational secrets. For a healthcheck skill, this data collection is far beyond what is needed and becomes especially risky because it is persisted in plain text.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Environment variables and shell history often contain credentials, tokens, internal endpoints, and sensitive operational commands, yet the script exports them without warning. Because the output is stored on disk, accidental sharing, backup ingestion, or local compromise could expose secrets long after execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script executes source "$CONFIG_FILE" on a user-controlled path, which causes arbitrary shell code in that file to run with the script's privileges. In a scheduler context, this can become persistent local code execution, especially if the script is launched automatically via cron or by a more privileged user.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill provides 'Read-only system diagnostics', but this script creates output directories, writes report and recommendation files, renames generated files, and deletes JSON and old reports. Those are persistent filesystem modifications that go beyond a read-only diagnostic behavior claim.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script removes JSON output files and, when cleanup is enabled, deletes historical report files using find -delete. Deletion is not consistent with a 'read-only system diagnostics' description, which implies observation rather than modification of local state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says 'Read-only system diagnostics,' but the documented behavior includes creating persistent reports and optionally deleting older files. This is a security-relevant disclosure issue because users and orchestration systems may grant trust based on a lower-risk classification than the skill actually deserves.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad trigger phrases like 'how is my PC doing?' increase the chance that the skill runs unintentionally in contexts where the user did not mean to authorize extensive system inspection and report generation. In this skill's context, accidental invocation is more dangerous because the documented checks include sensitive system, security, and software inventory data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Labeling the skill as read-only is misleading when it explicitly creates report files and may delete old reports during scheduled execution. Even if the writes are local, this changes the trust model: sensitive diagnostic data is persisted on disk and cleanup behavior can remove files without the user fully appreciating that the skill performs filesystem modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation does not clearly warn that generated reports may contain sensitive user and system information, including security posture, network details, installed software, and possibly account-related artifacts. Without that warning, users may store, share, or automate these reports insecurely, increasing the risk of privacy leaks and targeted attacks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Configuration Options

Create a config file at ~/.config/pc-assistant.conf:

bash

# Output directory for reports

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · install.yaml (reported line 43)May include surrounding context.

yaml

# Security notes:
# - Reports contain system info, SSH key filenames, package lists
# - Do not share reports publicly or leave in world-readable locations
# - When scheduling, use a private output directory
# - Run as regular user, not root

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The header frames the script as a health analysis tool, but the implementation performs broad persistent collection of sensitive user, authentication, environment, and access data. This discrepancy can mislead users and reviewers about the actual collection scope, undermining informed consent and increasing the chance of unsafe execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script gathers login history, current users, account listings, failed logins, and SSH access material, expanding a simple healthcheck into user and security surveillance. While some security posture checks can be relevant, the breadth and persistence of this collection exceed typical diagnostics and increase privacy and exposure risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The inventory of packages and developer ecosystems such as pip, npm, gems, cargo, Docker images, and containers can disclose installed software, tooling, and workloads that are not strictly required for core PC health assessment. This information can reveal development stack, internal projects, and attack surface if the report is later shared or accessed by others.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/healthcheck.sh (reported line 563)May include surrounding context.

sh

section "12. CRON & SCHEDULED TASKS"

subsection "12.1 User Crontab"
crontab -l 2>/dev/null >> "$REPORT_FILE" || echo "No user crontabs" >> "$REPORT_FILE"

subsection "12.2 System Cron"
{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/healthcheck.sh (reported line 568)May include surrounding context.

sh

subsection "12.2 System Cron"
{
    echo "=== /etc/crontab ==="
    cat /etc/crontab 2>/dev/null
    echo ""
    echo "=== Cron.d files ==="
    ls -la /etc/cron.d/ 2>/dev/null

Static analysis

No suspicious patterns detected.