T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bun-fetch.sh:15- Finding
JavaScript Code Injection Through HTTP Request Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Bun Runtime
Security checks for vulnerabilities and agentic risk
Overview
This Bun helper skill does what it advertises, but it gives broad file, command, and network power with unsafe input handling and little scoping.
Install only if you intend to give this skill broad local file, shell, and network authority and can run it in a constrained sandbox. It should be revised to avoid eval, pass data as arguments or stdin instead of generated source, restrict paths and network destinations, and require clear user approval for writes, commands, and outbound requests.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bun-fs.sh:11- Finding
JavaScript Code Injection Through Filesystem Paths and Write Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bun-process.sh:13- Finding
Arbitrary Shell Execution and Second-Stage Bun Code Injection
- Content
View full analysis
&1) EXIT_CODE=$? bun -e "console.log(JSON.stringify({ output: \`$OUTPUT\`, exitCode: $EXIT_CODE }))" ``` ### Technical Analysis The script executes its argument through `eval`, which interprets the complete value as shell syntax. Although command execution is the helper's documented purpose, `eval` adds unnecessary parsing and permits shell operators, expansions, substitutions, redirections, and command chaining. This prevents the caller from safely separating an executable from its arguments. A second injection boundary exists after the command completes. Captured output is inserted into a JavaScript template literal passed to `bun -e`. If the output contains a backtick or a `${...}` interpolation sequence, it can alter the generated JavaScript. Consequently, even a nominally trusted command can cause Bun code execution if it prints attacker-controlled text. This second stage is particularly dangerous because command output is commonly derived from filenames, remote responses, repository content, or other untrusted sources. ### Attack Path #### Direct shell execution path 1. An attacker influences the command string supplied to the helper. 2. The string includes shell syntax for an additional operation. 3. `eval` reparses and executes the complete attacker-controlled expression. 4. The added operation runs with the invoking account's privileges. #### Output-driven Bun injection path 1. The caller runs a command that emits attacker-controlled output. 2. The output contains syntax capable of escaping or invoking interpolation inside a JavaScript template literal. 3. The script inserts that output into the source text passed to `bun -e`. 4. Bun parses the output as part of the program rather than as ...[truncated 762 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bun-glob.sh:13- Finding
Malformed and Spoofable JSON Generated From Globbed Filenames
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This is the most serious finding: the skill is presented as Bun-native process support, but the underlying behavior is arbitrary shell command execution via eval. That enables command injection and unrestricted access to system resources reachable by the executing account, far beyond what a user may infer from the Bun-focused description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This is the most serious finding: the skill is presented as Bun-native process support, but the underlying behavior is arbitrary shell command execution via eval. That enables command injection and unrestricted access to system resources reachable by the executing account, far beyond what a user may infer from the Bun-focused description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This is the most serious finding: the skill is presented as Bun-native process support, but the underlying behavior is arbitrary shell command execution via eval. That enables command injection and unrestricted access to system resources reachable by the executing account, far beyond what a user may infer from the Bun-focused description.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises network-capable operations but declares no explicit tool scope or permissions boundary. In an agent environment, missing scope metadata increases the chance that the skill is invoked with broader-than-expected authority and can perform external communication without clear policy review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description is overly broad, covering common file and I/O requests that may cause this powerful skill to activate in many benign contexts. Because the skill includes file, process, and network operations, broad matching materially increases the risk of unnecessary invocation and misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The write-file documentation omits warnings that it can modify arbitrary user data and create parent directories automatically. In an agent setting, undocumented write capability raises the risk of silent data corruption, unauthorized file placement, or persistence in sensitive paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation describes command execution as a simple feature without warning that it runs shell commands. In context, this is dangerous because users or higher-level agents may treat it as routine process support, while shell execution can enable destructive commands, injection, and full access to local resources.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The network request capability is documented without warning that data may be sent to external services. This is dangerous because seemingly local tasks could trigger outbound transmission of prompts, file contents, tokens, or metadata, especially given the skill's broad trigger scope.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script enables arbitrary outbound HTTP requests to any user-supplied URL with optional method and body, without restriction, validation, or policy checks. In an agent skill context, this can be abused for SSRF-like access to internal services, data exfiltration, or contacting attacker-controlled endpoints, and the broad network capability is more dangerous because the skill is callable as a reusable runtime primitive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script forwards user-controlled request bodies and URLs directly to remote endpoints without any disclosure, confirmation, or sensitivity checks. In an agent environment, this creates a realistic risk of silently transmitting secrets, prompts, local data, or other sensitive content to third parties, especially when combined with unrestricted destination control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The write branch creates directories and writes arbitrary data to a provided path, which can modify the filesystem, but there is no confirmation prompt or explicit warning about this side effect. Aside from a success JSON message after completion, the script does not disclose the potentially destructive nature of overwriting files before performing the operation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script takes a caller-supplied string and passes it directly to
eval, which executes arbitrary shell syntax, including command substitution, pipelines, redirection, and chained commands. In the context of an agent skill that exposes process execution capabilities, this creates an easy path to arbitrary command execution and can lead to full compromise of the host environment, data loss, or secret exfiltration.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest presents a broad Bun runtime utility focused on Bun-specific filesystem, process, and network operations, with examples like Bun.file(), Bun.write(), and Bun.glob(). This file implements a concrete remote HTTP request capability via fetch to arbitrary URLs, which is narrower and more operationally significant than the documentation suggests for this script.
- Content
Static analysis
No suspicious patterns detected.