Confmt

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:26 AM UTC
• Version: 1.0.0

Overview

This is a small user-invoked config formatting skill with no hidden network, persistence, or privilege behavior, but users should be careful because it can print secrets from .env files and emits unsafe shell-style env output.

Install only if you are comfortable with a local formatter that reads files you explicitly provide and prints their contents. Do not run it on secret-bearing .env files in shared transcripts or logs, and do not source generated env output in a shell without sanitizing it first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: confmt.py:43

Finding

Unsafe .env Serialization Enables Downstream Shell Injection

Content

View full analysis

Vulnerability Details

File Location: confmt.py:43-47 and duplicate implementation in scripts/confmt.py:43-47
Vulnerability Type: Improper escaping of attacker-controlled .env keys and values
Risk Level: Medium

Vulnerable Code

python

def to_env(d):
    flat = flatten_dict(d)
    lines = []
    for k, v in sorted(flat.items()):
        key = k.upper().replace(".", "_").replace("[", "_").replace("]", "")
        lines.append(f'{key}="{v}"')
    return "\n".join(lines)

Technical Analysis

The to_env function directly interpolates configuration keys and values into .env output. It neither validates generated variable names nor escapes characters with special meaning to shell-compatible parsers, including double quotes, backslashes, dollar signs, backticks, carriage returns, and newlines.

For example, an attacker-controlled JSON input containing:

json

{
  "SAFE": "$(malicious-command)"
}

is converted into:

sh

SAFE="$(malicious-command)"

The converter does not execute this command itself. However, if a user or automation subsequently loads the generated file using a shell command such as source output.env, shell command substitution evaluates the injected expression.

A value containing quotes and newline characters could also terminate the intended assignment and inject additional shell statements. Unsafe keys may similarly produce malformed or semantically unexpected assignments.

Attack Path

1. An attacker supplies or modifies a JSON, TOML, or other supported configuration file.

2. A user converts the untrusted configuration to .env format:

   sh

   python3 scripts/confmt.py format attacker.json -o env > output.env
   

3. The converter writes attacker-controlled shell metacharacters without safe escaping.

4. A user, deployment script, or CI/CD process treats the output as shell-compatible environment syntax:

   sh

   source output.env
   

5. The shell evaluates injected command s ...[truncated 718 chars]

Remediation

View remediation

Remediation Suggestions

• Validate every generated environment variable name against a strict pattern such as ^[A-Za-z_][A-Za-z0-9_]*$; reject invalid names rather than attempting ambiguous normalization.
• Use a clearly specified dotenv serialization routine that safely handles quotes, backslashes, dollar signs, carriage returns, and newlines.
• Avoid claiming that generated output is safe to load as shell source code. Explicitly document that users must parse it with a non-executing dotenv parser.
• Consider rejecting control characters and multiline values unless the chosen dotenv grammar supports them unambiguously.
• Apply the same correction to both confmt.py and scripts/confmt.py, or consolidate them into one implementation to prevent security fixes from diverging.
• Add regression tests for command substitutions, backticks, embedded double and single quotes, backslashes, CR/LF characters, multiline values, and malformed keys.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/confmt.py:43

Finding

Unsafe .env Serialization Enables Downstream Shell Injection in Duplicate CLI Implementation

Content

View full analysis

Vulnerability Details

File Location: scripts/confmt.py:43-47
Vulnerability Type: Improper escaping of attacker-controlled .env keys and values
Risk Level: Medium

Vulnerable Code

python

def to_env(d):
    flat = flatten_dict(d)
    lines = []
    for k, v in sorted(flat.items()):
        key = k.upper().replace(".", "_").replace("[", "_").replace("]", "")
        lines.append(f'{key}="{v}"')
    return "\n".join(lines)

Technical Analysis

This duplicate CLI implementation serializes untrusted configuration data into .env assignments without validating keys or escaping shell-sensitive characters. Values containing command substitution syntax, quotes, backticks, or line breaks remain active if the resulting file is later sourced by a shell.

The script itself only prints the payload and does not execute it. Execution occurs in a downstream consumer that interprets the generated file as shell syntax.

Attack Path

1. An attacker controls a supported input configuration.
2. A user runs scripts/confmt.py with -o env and saves its output.
3. Malicious characters are emitted unchanged inside the generated assignment.
4. A shell-based deployment or automation process sources the generated file.
5. The injected syntax executes with that process's existing privileges.

Impact Assessment

An attacker may execute commands in the security context of the user or automation process that sources the generated file. This can expose files, secrets, environment variables, and resources accessible to that process. Exploitation does not inherently provide privilege escalation and depends on a downstream shell-sourcing step.

Remediation

View remediation

Remediation Suggestions

• Enforce valid environment-variable names with a strict allowlist.
• Implement a well-defined dotenv encoder that safely represents all supported values.
• Reject unsupported control characters and multiline input.
• Warn users not to source generated output in a shell.
• Maintain a single canonical implementation or ensure both copies receive identical security fixes.
• Add automated tests covering shell metacharacters, command substitution, quotes, backslashes, newlines, and invalid keys.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: confmt
description: Format, convert, flatten, and diff configuration files. Supports JSON, TOML (Python 3.11+), and .env formats. Use when asked to pretty-print a config, flatten nested JSON to dot-notation, convert JSON to env vars, diff two config files to find changes, or sort config keys. Handles JSON↔flat↔env conversion. Zero dependencies.
---

# confmt 📝

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

---
name: confmt
description: Format, convert, flatten, and diff configuration files. Supports JSON, TOML (Python 3.11+), and .env formats. Use when asked to pretty-print a config, flatten nested JSON to dot-notation, convert JSON to env vars, diff two config files to find changes, or sort config keys. Handles JSON↔flat↔env conversion. Zero dependencies.
---

# confmt 📝

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · confmt.py (reported line 28)May include surrounding context.

python

def detect_format(path):
    ext = os.path.splitext(path)[1].lower()
    return {".json": "json", ".toml": "toml", ".env": "env", ".ini": "ini"}.get(ext, "json")

def parse_env(text):
    d = {}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/confmt.py (reported line 28)May include surrounding context.

python

def detect_format(path):
    ext = os.path.splitext(path)[1].lower()
    return {".json": "json", ".toml": "toml", ".env": "env", ".ini": "ini"}.get(ext, "json")

def parse_env(text):
    d = {}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The tool reads configuration files, including .env content, and prints values directly to stdout during format/convert/diff operations. In an agent setting, stdout is often captured in logs, chat transcripts, or tool results, so secrets such as API keys and passwords can be unintentionally disclosed even though the behavior is part of the tool’s intended functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The top-level docstring presents the tool as a config formatter/converter for JSON/TOML with zero dependencies, implying TOML support is part of the tool's behavior. In practice, TOML support only exists when tomllib is available, so the documentation overstates capability in environments below Python 3.11.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest limits supported formats to JSON, TOML, and .env, but detect_format maps .ini files to an "ini" format. However, no INI parser exists, and downstream logic falls back to json.loads for unrecognized formats, so the code's declared behavior and actual supported formats are inconsistent with the manifest and with itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.