Cert Decode

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:54 PM UTC
• Version: 1.0.0

Overview

The skill has a clear certificate-inspection purpose, but its command examples can run unsafe shell commands if untrusted certificate text, paths, or hostnames are substituted directly.

Install only if you are comfortable with the agent running openssl commands, and avoid using it on untrusted hostnames, paths, or pasted certificate content unless your agent validates inputs and invokes openssl without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27

Finding

Shell Command Injection Through Untrusted Certificate Inputs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–40
Vulnerability Type: Shell command injection through unsafe interpolation of user-controlled PEM content, file paths, and hostnames
Risk Level: High

Vulnerable Code

markdown

2. **From pasted PEM text:**
   Write the PEM content to a temp file, then:
   ```
   echo "PEM_CONTENT" | openssl x509 -text -noout
   ```
   Or use process substitution if available.

3. **From a file path:**
   ```
   openssl x509 -text -noout -in /path/to/cert.pem
   ```

4. **From a live hostname (port 443):**
   ```
   echo | openssl s_client -connect HOSTNAME:443 -servername HOSTNAME 2>/dev/null | openssl x509 -text -noout
   ```

Technical Analysis

The skill instructs an agent to insert user-controlled certificate text, file paths, or hostnames into shell command templates. It does not require strict input validation, shell-safe escaping, argument-array execution, or robust end-of-options handling.

If these templates are assembled as command strings and evaluated by a shell, crafted input containing quotation marks, command substitutions, separators, redirections, or other shell metacharacters could escape the intended argument context and alter command execution. The hostname is interpolated twice in a shell pipeline, increasing the injection surface. Pasted PEM data is also shown as an argument to echo, which is unsafe for arbitrary multiline content and may expose shell parsing behavior if implemented by direct textual substitution.

File paths can additionally create option-confusion risks if option-like values are accepted without validation or safe argument separation. The issue is conditional on the invoking agent constructing and executing these templates through a shell, but the skill explicitly recommends that execution pattern without relevant safeguards.

Attack Path

1. An attacker asks the skill to inspect a certificate ...[truncated 1053 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell command strings from user input. Invoke openssl through a subprocess API with an explicit argument array and shell execution disabled.
2. Write pasted PEM bytes directly to a securely created temporary file using a file API. Use restrictive permissions, avoid predictable names, and delete the file in a guaranteed cleanup block.
3. Validate live-certificate targets using a strict hostname or IP-address parser. Reject whitespace, control characters, shell metacharacters, embedded ports, and malformed internationalized domain names.
4. Keep the port as a separately validated integer and construct the host:port argument in application code rather than through shell interpolation.
5. Pass certificate paths as discrete subprocess arguments. Reject ambiguous option-like paths or safely normalize them before invocation.
6. Capture standard output and standard error directly through the subprocess API instead of using shell pipelines and redirections.
7. Add explicit instructions that raw user input must never be interpolated into a command line, including through echo, process substitution, or sh -c.
8. Run certificate inspection with least privilege, a restricted environment, bounded execution time, and appropriate network controls to reduce the impact of any parsing or invocation failure.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

- Valid (show days remaining)

7. If `openssl` is not found, tell the user:
   > "This skill requires `openssl`. Install with: `brew install openssl` (macOS) or `sudo apt install openssl` (Linux)."

## Examples

Static analysis

No suspicious patterns detected.