Backup Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:17 PM UTC
• Version: 1.0.0

Overview

The skill is a real backup helper, but it includes broad data copying and destructive scheduled commands without enough safeguards.

Review before installing. Use this only with explicit source and destination paths, prefer /home/USER or selected folders over /home/ and /etc/, encrypt or restrict access to backup destinations, preview rsync --delete changes before running, fix the cleanup command before using it, and only add cron jobs after confirming the exact schedule and removal path.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:47
• Finding: Backup Script Collects Data Beyond the Minimum Required Scope## Vulnerability Details **File Location**: `SKILL.md`, lines 47-52 **Vulnerability Type**: Overbroad access to local files and system configuration **Risk Level**: Medium **Vulnerable Code**: ```bash # Backup home directory rsync -avh --delete \ --exclude='.cache' \ --exclude='node_modules' \ --exclude='.local/share/Trash' \ --exclude='*.tmp' \ /home/ $BACKUP_DIR/home/ 2>&1 >> $LOG # Backup system configs rsync -avh /etc/ $BACKUP_DIR/etc/ 2>&1 >> $LOG ``` ### Technical Analysis The generated backup script copies all readable content under `/home/` and `/etc/`. This is broader than the minimum scope needed to back up the requesting user's files. Depending on the account executing the script, these locations can include other users' documents, SSH keys, application credentials, network configurations, password hashes readable by the executing account, service credentials, and other security-sensitive configuration. Copying these files to an external drive, NAS, or other destination creates an additional repository of sensitive information whose access controls may be weaker than those of the source system. No privilege-escalation command is present, and the script cannot read files beyond the executing account's existing permissions. The security issue is that it exercises all available read access rather than restricting collection to paths necessary for the requested backup. ### Attack Path 1. A user asks the agent to create or schedule a backup. 2. The agent creates the documented script and retains `/home/` and `/etc/` as source paths. 3. The script runs manually or through cron with the invoking account's permissions. 4. Every readable file in those source trees is copied to the configured backup destination. 5. A local user, remote storage operator, or attacker who compromises the backup destination accesses sensitive files that were not necessary for the requeste ...[truncated 457 chars]
• Remediation: ## Remediation Suggestions - Default to the requesting user's directory, such as `/home/USER/`, instead of all of `/home/`. - Require explicit confirmation before adding `/etc/`, another user's home directory, or any system-wide source. - Use an allowlist of user-selected source directories. - Exclude sensitive credential stores unless the user explicitly requests and understands their inclusion. - Ensure the destination and backup files use restrictive ownership and permissions. - Encrypt backups stored on removable, network, or cloud destinations. - Display the resolved source paths, destination, exclusions, and execution identity before the first backup. - Avoid recommending privileged execution unless a specifically requested source requires it.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:147
• Finding: Snapshot Cleanup Can Recursively Delete the Entire Snapshot Repository## Vulnerability Details **File Location**: `SKILL.md`, line 147 **Vulnerability Type**: Unsafe recursive deletion caused by an insufficiently constrained `find` command **Risk Level**: High **Vulnerable Code**: ```bash # Remove snapshots older than 30 days find /mnt/backup/snapshots/ -maxdepth 1 -type d -mtime +30 -exec rm -rf {} \; ``` ### Technical Analysis The command sets `-maxdepth 1` but does not set `-mindepth 1`. Consequently, the starting path `/mnt/backup/snapshots/` is itself eligible for matching because it is a directory at depth zero. If the modification time of the snapshot root is more than 30 days old, `find` can pass that root directory to `rm -rf`. This removes the complete snapshot repository, including recent snapshots beneath it. The age of a directory is based on changes to its directory entries and does not reliably represent the age of every backup it contains. The fixed absolute path limits direct attacker-controlled command injection, but the deletion logic is intrinsically unsafe and can cause catastrophic data loss during normal use. ### Attack Path 1. The snapshot repository exists for more than 30 days without a recent change to the root directory's own modification time. 2. Recent backup contents may still exist beneath that root. 3. An operator or scheduled maintenance process runs the documented cleanup command. 4. `find` evaluates the depth-zero starting directory and determines that it satisfies `-type d -mtime +30`. 5. `rm -rf` receives `/mnt/backup/snapshots/` and recursively deletes the entire repository. 6. All retained restore points can be lost, including backups that should not have expired. ### Impact Assessment The command can delete every snapshot accessible under the configured repository. It does not provide additional privileges; deletion is limited to paths writable by the executing account. However, if run with elevated privileges or by the backup owner, it ca ...[truncated 123 chars]
• Remediation: ## Remediation Suggestions - Add `-mindepth 1` so the repository root cannot match: ```bash find /mnt/backup/snapshots/ -mindepth 1 -maxdepth 1 -type d -mtime +30 -print ``` - Review the printed candidates before enabling deletion. - Restrict matches to the expected snapshot naming convention, such as date-formatted child directories. - Resolve and validate the canonical repository path before executing destructive operations. - Refuse to proceed if the path is empty, `/`, a mount root, or differs from the configured snapshot directory. - Delete candidates individually only after confirming they are direct descendants of the repository. - Preserve at least one known-good restore point regardless of age. - Use filesystem snapshots, retention-aware backup software, or immutable storage where practical.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61
• Finding: Non-Idempotent Cron Registration Can Create Duplicate Persistent Backup Jobs## Vulnerability Details **File Location**: `SKILL.md`, lines 61-64 **Vulnerability Type**: Unsafe scheduled-task registration **Risk Level**: Medium **Vulnerable Code**: ```bash ### Schedule automatic backups ```bash # Daily at 2am (crontab -l 2>/dev/null; echo "0 2 * * * /home/USER/backup.sh") | crontab - ``` ### Technical Analysis The command preserves the current crontab and appends a new entry without checking whether an equivalent managed entry already exists. Every repeated setup invocation can therefore add another persistent execution of the same backup script. Concurrent instances may compete for destination files, logs, network bandwidth, and storage resources. Because the documented backup script uses `rsync --delete`, overlapping runs also increase the operational risk of inconsistent or unintended destination changes. Cron is a cross-session persistence mechanism, but its use is explicitly aligned with the declared automatic-backup functionality and is not covert. It is reasonable only when the user specifically requests scheduled backups. The flaw is the lack of explicit confirmation, idempotent management, concurrency control, and removal instructions—not the mere use of cron. ### Attack Path 1. A user or agent invokes automatic-backup setup more than once. 2. Each invocation appends another identical cron entry. 3. At 02:00, cron starts multiple instances of `/home/USER/backup.sh`. 4. The processes concurrently access the same backup destination and log. 5. Resource consumption increases, log output interleaves, and overlapping synchronization operations may leave an unreliable backup state. 6. The duplicate jobs continue to execute across sessions until the crontab is manually corrected. ### Impact Assessment The cron entry runs with the existing privileges of the crontab owner and does not itself escalate privileges. Its scope includes persistent daily execution of the specified script ...[truncated 195 chars]
• Remediation: ## Remediation Suggestions - Register a cron job only after the user explicitly requests and confirms automatic scheduling. - Make installation idempotent by assigning a unique marker and replacing an existing managed entry instead of blindly appending. - Use a validated absolute script path and quote paths where applicable. - Add `flock` or equivalent locking so only one backup instance can run at a time. - Verify the resulting crontab and report the exact schedule to the user. - Provide a documented removal command for the managed entry. - Consider a user-level systemd timer where available, with explicit service hardening, locking, logging, and lifecycle management. - Ensure modifying the schedule does not overwrite unrelated crontab entries.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Compare backup with source
```bash
rsync -avhn --delete /home/USER/ /mnt/backup/home/ | head -20
# -n = dry run, shows what WOULD change
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The cleanup example uses 'find ... -exec rm -rf {} \;' to delete snapshot directories older than 30 days, but it does not include an explicit irreversible-deletion warning or safety guards. If the path is mistyped, expanded unexpectedly, or includes symlinks or unintended directories, this can cause permanent data loss across backups.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Install dependencies
```bash
sudo apt install rsync -y
# For cloud backups:
sudo apt install rclone -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Install dependencies
```bash
sudo apt install rsync -y
# For cloud backups:
sudo apt install rclone -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Schedule automatic backups
```bash
# Daily at 2am
(crontab -l 2>/dev/null; echo "0 2 * * * /home/USER/backup.sh") | crontab -
```

### Cloud backup with rclone

• Confidence: 88% confidence
• Finding: The cron command establishes persistent scheduled execution of '/home/USER/backup.sh', which changes system state beyond the current session. Persistence is not inherently malicious here, but unattended recurring jobs that invoke backup commands with '--delete' can repeatedly propagate mistakes or destructive sync behavior without fresh user review.

Session Persistence

Medium

• Category: Rogue Agent

Content

du -sh /mnt/backup/*/

# Check cron is set up
crontab -l | grep backup
```

### Compare backup with source

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example invocation "Back up my stuff" is vague and colloquial, with no stated constraints on what counts as "my stuff" or when this skill should activate. Because the markdown does not provide narrower trigger scope or exclusion examples, this could lead to unintended invocation or ambiguous behavior.