Security audit

filesystem-1.0.2

Security checks for vulnerabilities and agentic risk

Overview

This filesystem skill is broad and should be used carefully, but its read, search, analyze, and copy behavior is disclosed and aligned with its stated purpose.

Install only if you want an agent to perform local filesystem listing, searching, analysis, and copying. Treat it as a read-write filesystem tool: use dry-run for batch copies, verify source and destination paths, and avoid overwrite operations unless you explicitly intend to replace files. The reviewed package snapshot did not include the executable implementation, so functionality and claimed safeguards could not be independently verified from code.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation presents batch copy functionality, including an explicit `--overwrite` option, without a prominent warning about the risk of overwriting existing files or copying into unintended destinations. In an agent-facing skill, that omission is dangerous because it normalizes potentially destructive filesystem actions and may cause automated use without sufficient user confirmation or dry-run safeguards.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The Safety Features section states that the skill 'Prevents directory traversal attacks', implying constrained or sandboxed path handling. However, the rest of the documentation advertises operations on arbitrary paths such as './', '/tmp', and '/var/log' without any stated boundary, which contradicts the claim of traversal-prevention in the ordinary sense of restricting path escape.

Vague Triggers

Low

Confidence: 82% confidence
Finding: This JSON manifest file describes the skill as handling broad 'Advanced filesystem operations' including listing, searching, batch processing, and analysis, but it does not define any specific invocation phrases, constraints, or exclusions. In a manifest context, such a broad description can overlap with many ordinary file-related requests and may lead to unintended activation.

Static analysis

No suspicious patterns detected.