Detect File Type - Local

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:43 AM UTC
• Version: 0.2.0

Overview

This skill is a disclosed local file-type detector with a documented stdin disk-use caveat, not evidence of hidden data theft or destructive behavior.

Install only if you are comfortable letting the skill read files or directories you explicitly ask it to classify. Avoid piping untrusted, very large, or endless streams into the default stdin mode; use --stdin-mode head with a size cap or enforce external input limits for automated workflows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: detect_file_type/cli.py:50

Finding

Unbounded Default Stdin Spooling Can Exhaust Disk Space

Content

View full analysis

Vulnerability Details

File Location: detect_file_type/cli.py, lines 50–56
Vulnerability Type: Unbounded resource consumption through stdin
Risk Level: Medium

python

try:
    with os.fdopen(fd, "wb") as tmp:
        while True:
            chunk = sys.stdin.buffer.read(STDIN_SPOOL_CHUNK_BYTES)
            if not chunk:
                break
            tmp.write(chunk)

Technical Analysis

The default spool stdin mode copies the entire input stream into a temporary file without enforcing a maximum size. The loop terminates only when stdin reaches end-of-file. Consequently, an oversized or indefinitely generated stream can cause continuous growth of the temporary file.

The temporary file is securely created with tempfile.mkstemp and is removed in a finally block, but these measures do not prevent disk exhaustion while the process is running. The optional head mode has a configurable memory cap, but the default spool mode has no corresponding disk limit. SECURITY.md acknowledges this condition and delegates mitigation to external operational controls rather than enforcing it in the application.

Attack Path

1. An attacker gains the ability to provide data to a service, automation workflow, or command pipeline that invokes detect_file_type -.
2. The tool uses its default --stdin-mode spool behavior.
3. The attacker supplies a very large stream or a stream that does not terminate.
4. The loop continuously writes incoming data to the temporary filesystem.
5. Available disk space or the caller's storage quota is exhausted before Magika classification begins.
6. The detection process and other applications sharing the filesystem may fail or become unavailable.

Impact Assessment

Exploitation does not grant code execution, additional permissions, or access beyond the invoking user's privileges. Its primary impact is availability: the attacker can consume temporary-file ...[truncated 264 chars]

Remediation

View remediation

Remediation Suggestions

• Add a maximum spool size that is enforced by default.
• Track the cumulative number of bytes written and abort before writing data beyond the configured limit.
• Provide a clearly named option such as --stdin-max-spool-bytes for trusted workflows that require a different limit.
• Return a clear error and nonzero exit status when the size limit is exceeded.
• Preserve cleanup through the existing finally block.
• Consider checking available disk space and applying operating-system or container storage quotas as defense in depth.
• Add tests covering input exactly at the limit, input exceeding the limit, very large input, cleanup after rejection, and nonterminating producers subject to process-level timeouts.
• Document the enforced default and advise callers not to disable or excessively increase it for attacker-controlled streams.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill invokes local binaries and supports reading arbitrary files, recursive directory scanning, and writing stdin to a temporary file, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege enforcement and can cause a host agent to grant broader shell/file capabilities than users expect, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cli.py (reported line 15)May include surrounding context.

python

def run_cli(*args: str, stdin_data: bytes | None = None) -> subprocess.CompletedProcess:
    return subprocess.run(
        [*CLI_MODULE, *args],
        capture_output=True,
        text=stdin_data is None,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cli.py (reported line 25)May include surrounding context.

python

def run_cli_text(*args: str) -> subprocess.CompletedProcess:
    return subprocess.run(
        [*CLI_MODULE, *args],
        capture_output=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cli.py (reported line 136)May include surrounding context.

python

class TestStdin:
    def test_stdin_detection(self):
        result = subprocess.run(
            [*CLI_MODULE, "-"],
            input=b"Hello, this is plain text content for stdin detection.\n" * 20,
            capture_output=True,

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.