custom-skills-updater

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:26 PM UTC
• Version: 1.0.2

Overview

This skill is a coherent updater for manually installed skills, but it can overwrite skill files from GitHub and lacks clear path and archive containment safeguards.

Install only if you are comfortable with a skill that can overwrite manually installed skill instructions after approval. Review REGISTRY.yaml entries carefully, use only trusted repositories, avoid untrusted skill names or source paths, and prefer adding strict path validation and safe archive extraction before using it for updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:107

Finding

Unvalidated Registry Values and Unsafe Archive Extraction Permit Filesystem Path Traversal

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64-71 and SKILL.md:107-135
Vulnerability Type: Path traversal and unsafe archive extraction
Risk Level: High

The update procedure uses registry-controlled skill names and source paths to determine local write and archive extraction destinations without requiring validation, canonicalization, or containment checks.

Vulnerable Code

yaml

skills:
  example-dir-skill:
    type: github-dir
    source: example-owner/example-repo@main:skills/example-dir-skill
    version: abc123
    updated: 2026-01-01

text

| Field   | Meaning |
|---------|---------|
| key     | skill name |
| type    | `github-dir` / `github-file` / `github-readme` / `local` |
| source  | source location |
| version | commit SHA (`github-dir`) or SHA256 (file-based types) |
| updated | last update date |

markdown

## github-dir

gh api "repos/{owner}/{repo}/tarball/{branch}" > archive.tar.gz

text

Verify the file is valid gzip before extracting. Copy target path to `skills/{name}/`.

## github-file

gh api "repos/{owner}/{repo}/contents/{path}?ref={branch}" -H "Accept: application/vnd.github.raw+json" > skills/{name}/SKILL.md

text

Technical Analysis

The registry's skill name, repository path, and branch are editable input, but the documented procedure does not impose an allowlist or reject absolute paths, directory separators, .. components, control characters, or shell metacharacters.

For github-file entries, the skill name is directly incorporated into skills/{name}/SKILL.md. A name containing traversal components could resolve outside the intended skills directory. The procedure does not require canonicalizing the destination and confirming that it remains beneath the canonical skills root before writing.

For github-dir entries, the only stated archive validation is checking whether the downloaded file is valid ...[truncated 2203 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate every registry skill name against a strict allowlist, such as ^[A-Za-z0-9._-]+$.
2. Explicitly reject names containing .., /, \, absolute paths, control characters, whitespace, or shell metacharacters.
3. Parse source into separately validated owner, repository, branch, and path components rather than interpolating the complete value into commands.
4. Construct destinations through a path-safe API, canonicalize both the skills root and destination, and reject the operation unless the destination remains strictly beneath the canonical skills root.
5. Download archives to a securely created temporary directory using unique filenames rather than a predictable archive.tar.gz in the working directory.
6. Before extraction, inspect every archive entry and reject:
   • Absolute paths
   • .. path components
   • Paths resolving outside the extraction root
   • Symbolic links or hardlinks whose targets escape the extraction root
   • Device files and other special entries
7. Extract into a fresh isolated directory without following links. Revalidate all extracted paths before copying selected content into the final destination.
8. Copy only the explicitly configured repository subdirectory rather than copying the entire extracted archive.
9. Write downloaded files to a temporary file, validate them, and then perform an atomic rename into the validated destination.
10. Include destination paths and archive safety-check results in the approval summary so the user can review exactly what will be overwritten.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This skill is explicitly designed to overwrite locally installed skills based on remote GitHub content, which is a form of self-modification. Even though it includes approval steps, it still creates a trusted path for replacing executable/prompts/instructions in other skills, so a compromised upstream repo, tampered source entry in REGISTRY.yaml, or weak review of diff summaries could lead to supply-chain-style code or prompt injection persistence.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

skill-name ........ update available

text

## Update skills

Target all outdated skills or a specific skill by name.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

Location: `REGISTRY.yaml` in the same directory as this `SKILL.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

Location: `REGISTRY.yaml` in the same directory as this `SKILL.md`.

Static analysis

No suspicious patterns detected.