tenk-connect

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:26 PM UTC
• Version: 1.0.2

Overview

The TenK skill matches its stated account-tracking purpose, but its logging script has confirmed input-handling flaws that could let crafted values run local commands.

Review before installing. The skill's account access and TenK API calls are expected, but avoid using it until the logging script is fixed to pass all user and API values as data, validate minutes strictly, and confirm state-changing log actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tenk.sh:136

Finding

Python Code Injection Through the Skill Query

Content

View full analysis

/dev/null) skill_name=$(echo "$skills_resp" | python3 -c " import json, sys q = '$skill_query'.lower() skills = json.load(sys.stdin).get('data', []) match = next((s for s in skills if q in s['name'].lower()), None) if match: print(match['name']) " 2>/dev/null) ``` ### Technical Analysis The caller-controlled `skill_query` value is interpolated directly into two programs passed to `python3 -c`. Shell quoting protects how the shell passes the overall program argument, but it does not make the interpolated content safe Python syntax. A skill query containing a single quote and additional Python statements can terminate the intended string literal and alter the program executed by Python. Because Python exposes operating-system functionality through modules such as `os` and `subprocess`, successful injection can become arbitrary local command execution. The same unsafe construction appears twice: once while resolving the skill identifier and again while resolving the skill name. ### Attack Path 1. An attacker influences the skill name supplied to the `log` command, potentially through a chat request processed by the Agent. 2. The Agent invokes `tenk.sh log` with the crafted value as `skill_query`. 3. Bash substitutes that value into the source string passed to `python3 -c`. 4. The crafted value closes the intended Python string and introduces attacker-selected Python statements. 5. Python executes those statements with the privileges and environment of the user running the Agent. ### Impact Assessment Successful exploitation provide ...[truncated 457 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tenk.sh:164

Finding

Python Code Injection Through API-Derived Skill Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tenk.sh:126

Finding

Bash Arithmetic Injection Through Unvalidated Minutes

Content

View full analysis

[nota]" [[ -z "$minutes" ]] && die "Uso: tenk.sh log [nota]" ``` ```bash local duration_sec=$(( minutes * 60 )) ``` ### Technical Analysis The `minutes` argument is checked only for emptiness. It is then referenced by name inside Bash arithmetic expansion. Bash arithmetic contexts evaluate arithmetic expressions rather than treating their contents strictly as decimal integer data. Crafted values can introduce variable references, array subscripts, substitutions, or other arithmetic syntax with side effects. Consequently, an argument intended to represent a duration can be interpreted as executable shell-related expression content. Even when command execution is not achieved, the absence of numeric and range validation allows negative, zero, excessively large, malformed, or overflow-prone durations to reach the API. ### Attack Path 1. An attacker influences the minutes argument supplied to `tenk.sh log`. 2. The script verifies only that the argument is nonempty. 3. The value is evaluated through Bash arithmetic expansion in `minutes * 60`. 4. Crafted arithmetic syntax causes unintended expansion or side effects in the shell. 5. Any resulting commands execute as the Agent user; alternatively, an invalid duration is submitted to the service. ### Impact Assessment Successful command-oriented exploitation can execute local commands with the privileges of the invoking Agent user. The attacker could access user-readable data, modify files, or retrieve the locally stored bearer token. Independently of command execution, malformed and out-of-range values can corrupt practice records or cause ...[truncated 56 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/tenk.sh:8

Finding

Bearer Token File Is Secured Only After Creation

Content

View full analysis

"$TOKEN_FILE"; chmod 600 "$TOKEN_FILE"; } ``` ### Technical Analysis The token is written to the destination file before `chmod 600` is applied. The initial mode is therefore determined by the process umask. Under a permissive umask, the file may briefly be readable by other local users. The configuration directory is also created without explicitly enforcing mode `700`. Existing directory permissions are not corrected, and the direct redirection is not an atomic secret-file installation procedure. Because the token is a bearer credential, possession may be sufficient to access the user's TenK account until the token expires or is revoked. ### Attack Path 1. The CLI successfully receives a bearer token during device authentication. 2. `echo` creates or truncates the token file using permissions derived from the current umask. 3. Before the subsequent `chmod 600` completes, another local process monitoring the path reads the file. 4. The local attacker reuses the copied token against the TenK API. This path requires local access to the same system and sufficiently permissive initial file or directory permissions. ### Impact Assessment A successful attacker may impersonate the affected TenK user for the lifetime of the token and perform operations allowed by that token, including reading account information and potentially creating practice sessions. The issue does not expose system administrator privileges. Its scope is the TenK account and any other access granted to ...[truncated 28 chars]

Remediation

View remediation

"$tmp" chmod 600 "$tmp" mv -f "$tmp" "$TOKEN_FILE" } ``` Further hardening should include: - Verify that the configuration directory is owned by the current user. - Reject symbolic links and unexpected non-regular files at the token path. - Use `printf` instead of `echo` for credential data. - Consider an operating-system credential store when available. - Ensure logout and authentication failures remove temporary token files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs the agent to execute shell commands, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That creates an overbroad execution surface where an agent or runtime may permit shell access without a documented least-privilege contract, increasing the chance of unintended command execution or unsafe chaining with user prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase 'when the user says something like "log 45 minutes of guitar"' is a broad natural-language trigger that can cause the skill to activate from loosely related conversation without clear confirmation, boundaries, or exclusions. In a skill that performs account actions and writes activity records, this can lead to unintended state-changing operations based on ambiguous or injected text.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

# ── helpers ────────────────────────────────────────────────────────────────
token_get()  { [[ -f "$TOKEN_FILE" ]] && cat "$TOKEN_FILE" || echo ""; }
token_save() { echo -n "$1" > "$TOKEN_FILE"; chmod 600 "$TOKEN_FILE"; }

api_get() {
  local path="$1"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tenk.sh (reported line 15)May include surrounding context.

sh

# ── helpers ────────────────────────────────────────────────────────────────
token_get()  { [[ -f "$TOKEN_FILE" ]] && cat "$TOKEN_FILE" || echo ""; }
token_save() { echo -n "$1" > "$TOKEN_FILE"; chmod 600 "$TOKEN_FILE"; }

api_get() {
  local path="$1"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tenk.sh (reported line 162)May include surrounding context.

sh

print(json.dumps({'skillId': '$skill_id', 'duration': $duration_sec, 'notes': sys.argv[1]}))
" "$note") || die "Error al construir payload"

  local resp; resp=$(curl -sf -X POST "$API/sessions" \
    -H "Authorization: Bearer $(token_get)" \
    -H "Content-Type: application/json" \
    -d "$body") || die "Error al registrar sesión"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script includes natural-language output such as "Iniciando autenticación con TenK..." and continues in Spanish throughout the CLI flow. Because the file does not offer language selection or explain that the tool is intended only for Spanish-speaking users, it creates a language/locale policy issue under the natural-language policy category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.