L

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:46 PM UTC
• Version: 1.0.0

Overview

This is a simple listing-command skill, but it needs review because it can prompt broad disclosure of sensitive local system details without clear safeguards.

Install only if you want a broad local system-listing helper. Use it with explicit, narrow requests, and avoid asking it to dump environment variables, shell variables, firewall rules, routes, full process lists, or network listeners unless needed; redact tokens, passwords, keys, cookies, usernames, hostnames, and internal service details before sharing outputs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:95

Finding

Unrestricted Sensitive System and Environment Enumeration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:95, SKILL.md:124, SKILL.md:132, SKILL.md:160, SKILL.md:166-168, and SKILL.md:180-183
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code Snippets

bash

ps aux

bash

netstat -tulpn

bash

ss -tuln

bash

lsmod

bash

printenv
env
set

bash

iptables -L
ufw status verbose
firewall-cmd --list-all
pfctl -s rules

Technical Analysis

The skill presents broad system-enumeration commands as general listing operations without requiring explicit authorization, limiting collection to task-relevant information, or providing output-redaction safeguards.

In particular, printenv, env, and shell set can disclose sensitive runtime values such as API keys, access tokens, credentials, proxy secrets, service endpoints, and shell functions. The set command can expose more information than environment-only commands because it may include shell-local variables and function definitions.

The process, listening-port, kernel-module, and firewall commands disclose detailed host-security topology. Depending on operating-system permissions, commands such as netstat -tulpn, iptables -L, and pfctl -s rules may also reveal privileged process associations or security policy details. The document does not itself bypass permissions or execute these commands automatically, but its broad trigger and lack of least-privilege constraints can cause an agent to collect substantially more sensitive information than a routine file-listing request requires.

Attack Path

1. A user or untrusted prompt invokes the broadly described listing skill.
2. The agent interprets the request as authorization to inspect general system state.
3. The agent runs commands such as printenv, set, ps aux, netstat -tulpn, or firewall-rule enumeration.
4. Cred ...[truncated 1529 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove printenv, env, and set from general-purpose listing guidance. Provide targeted alternatives that display only explicitly requested, non-sensitive variable names.
2. Require explicit informed confirmation before enumerating environment variables, all processes, process-to-port mappings, kernel modules, routing information, or firewall rules.
3. Apply least-privilege defaults. File-listing requests should run only file-listing commands and must not implicitly authorize broader host reconnaissance.
4. Introduce a strict allowlist of safe commands and options for each supported intent.
5. Redact values whose names match secret patterns such as TOKEN, SECRET, PASSWORD, PASS, KEY, CREDENTIAL, AUTH, and COOKIE.
6. Return only task-relevant fields. For example, omit process command-line arguments and process ownership unless the user explicitly requests them.
7. Avoid privileged execution and clearly state that the skill must not use sudo, elevation, or permission bypasses to obtain otherwise inaccessible details.
8. Prevent sensitive command output from being retained in persistent memory, telemetry, or logs.
9. Document trust boundaries and warn that system-enumeration output may contain confidential information that should not be shared with third parties.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This skill uses a single-letter trigger, 'l', with a very broad activation scope covering files, processes, networking, packages, and system state. Such a short and common trigger creates a high risk of accidental invocation and unintended disclosure of sensitive local information when ordinary conversation or short commands are interpreted as activating the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Aside from one English example, the skill's headings, instructions, and narrative are presented in Chinese, with no indication that the user can choose another language. This creates a locale/language constraint that is not documented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill prominently includes commands that reveal sensitive system state, including environment variables, open ports, routing tables, firewall rules, processes, and recursive file listings, but provides no warning, minimization guidance, or confirmation step. In an agent setting, this can lead to unnecessary collection or exposure of secrets and operational details that increase attack surface or leak private data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation examples are broad everyday requests like listing files, processes, ports, and installed packages without clear boundaries or sensitivity guidance. This makes the skill more likely to activate in routine contexts and normalize disclosure of system inventory information that may include secrets, usernames, internal services, or filesystem layout.

Content

No source excerpt is available for this finding.