Security audit

termux-compat-runner

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Termux command-running helper with safety guidance, but users should not treat its “safe” allowlist as strictly read-only.

Install only if you want agent assistance with Termux/Android shell commands. Review every command before running it manually, especially package installs, apt/dpkg operations, curl, python, git pull, and storage-access commands; do not treat the helper's ALLOWED output as authorization to execute without user approval.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly guides shell-command execution and even references a helper script, but it does not declare explicit permissions or capability boundaries. In an agent framework, missing permission declarations can allow shell-capable behavior to be invoked without clear policy enforcement, increasing the chance of unsafe command execution or review blind spots.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The skill asserts that `scripts/run_safe.sh` 'never executes anything', but no script implementation is provided here to verify that claim. In a security-sensitive execution skill, undocumented trust guarantees can mislead downstream agents into invoking a helper under false safety assumptions, potentially resulting in unintended command execution if the script behaves differently.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script and skill framing describe a safe, read-only validator, but the allowlist explicitly permits mutating package-management operations such as `pkg update`, `upgrade`, and `install`. Although this script does not execute commands directly, it can still bless state-changing commands as 'safe', which is dangerous in an agent context because downstream components or users may rely on that approval and perform unintended system modifications.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The header comments claim the validator only allows read-only and informational commands, but the implemented allowlist includes write-capable operations via package managers. This mismatch can mislead reviewers, users, or higher-level agents into trusting the tool's output more than warranted, increasing the chance that unsafe changes are approved under a false safety model.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation rule says the skill becomes active whenever the user request 'matches the description,' which is broad and subjective. Over-broad invocation can cause this shell-oriented skill to engage in contexts where command execution guidance is unnecessary or unsafe, increasing the chance of unintended shell use or policy conflicts with more specialized skills.

Static analysis

No suspicious patterns detected.