snapshot-wipe-resilience

• Outcome: Pass
• Latest audit: Sep 7, 2026 · 10:53 AM UTC
• Version: 1.5.8

Overview

This recovery skill has powerful shell and sync features, but they are disclosed, purpose-aligned, and gated by explicit user trust steps.

Install only if you are comfortable managing a recovery manifest that can run shell recipes after you sign or explicitly approve it. Review every restore and smoke command before signing, keep the ~/.swr signing and identity files private, avoid cleartext paste sync for sensitive manifests, and use --dry-run first on new manifests.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_smoke(cmd, cwd, timeout=60):
    try:
        r = subprocess.run(["bash", "-c", cmd], cwd=cwd, timeout=timeout,
                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        return r.returncode == 0
    except Exception:

• Confidence: 97% confidence
• Finding: `run_smoke` executes manifest-supplied `smoke` commands via `bash -c`. Although the tool tries to gate smoke execution behind manifest trust checks, a trusted or explicitly approved manifest can still contain arbitrary shell code, so this is a deliberate code-execution surface that can run attacker-controlled commands in the workspace context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

t0 = time.time()
    tmo = timeout or e.get("timeout_s", 1800)
    try:
        r = subprocess.run(["bash", "-c", cmd], cwd=man.get("workspace", HOME),
                           timeout=tmo, start_new_session=True)
        rc = r.returncode
    except subprocess.TimeoutExpired:

• Confidence: 99% confidence
• Finding: `restore_entry` runs manifest-provided restore recipes through `bash -c`, which is arbitrary command execution. The surrounding signature and approval model reduces accidental execution of unsigned manifests, but any compromised local signing key, over-broad trust decision, or malicious trusted signer turns workspace repair into unrestricted shell execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run():
            try:
                return subprocess.run(
                    ["bash", "-c", e["restore"]], cwd=man.get("workspace", HOME),
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                    timeout=e.get("timeout_s", 300),

• Confidence: 95% confidence
• Finding: The `selftest` path re-executes each entry's `restore` command twice using `bash -c`. Even though intended for idempotence testing and guarded by manifest trust, it still expands the attack surface by repeatedly running arbitrary manifest-controlled shell commands, increasing the chance of destructive or malicious side effects.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file implements a general-purpose public-key encryption, signing, key generation, and peer-management CLI that is materially unrelated to the stated skill purpose of detecting and repairing partially wiped workspaces. In an agent-skill context, this capability mismatch is dangerous because it introduces covert data-packaging and exfiltration-enabling functionality under a misleading recovery-themed label, expanding the attack surface and bypassing operator expectations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The implementation from the command section onward manages identities, peers, signatures, and encrypted envelopes rather than bounded local recovery state or restore tooling promised by the manifest. This mismatch is a supply-chain and trust-boundary problem: users or orchestration systems may grant this skill access appropriate for workspace recovery while unknowingly installing cryptographic communication features that can facilitate hidden data movement or persistence workflows.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

return None


def restore_entry(man, e, dry=False, timeout=None, quar=False):
    cmd = e.get("restore")
    # Prefer inline escrow when content is absent/corrupt: a recipe like
    # `chmod +x` cannot recreate deleted content.

• Confidence: 88% confidence
• Finding: `restore_entry` accepts an optional `timeout=None`, and later uses `timeout or e.get("timeout_s", 1800)`, so a caller passing `0` or an unexpected falsey value could disable the intended bound semantics or alter behavior. More broadly, restore recipes are potentially long-running shell commands; insufficiently enforced bounds can enable denial of service or stuck repair runs.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

q.add_argument("--pq-to", help="peer name/file -> hybrid PQ E2E encryption")
    q.add_argument("--pq-no-sign", action="store_true")
    q.add_argument("--verify", action="store_true", default=True)
    q.add_argument("--no-verify", dest="verify", action="store_false")
    q.add_argument("--qr", action="store_true")
    q.add_argument("--allow-unsigned", action="store_true")

• Confidence: 71% confidence
• Finding: Allowing `--no-verify` disables the post-upload round-trip integrity check, which weakens detection of backend tampering, truncation, or unexpected transformation before the URL is pinned for later recovery. In a tool whose purpose is resilient recovery of signed manifests from third-party paste hosts, reducing integrity verification makes operator mistakes and hostile backend behavior more dangerous.

Static analysis

No suspicious patterns detected.