Security audit

Workspace Zip Backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill has a clear purpose, but its restore script can overwrite files in an unexpected location despite showing the user a target directory.

Review this skill before installing. Use backup archives as sensitive files, restore only from trusted archives, and avoid the provided restore script unless it is fixed to extract into the intended target directory and avoid silent overwrites.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:170
Finding: Restore Operation Ignores the Target Directory and Silently Overwrites Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:97
Finding: Whitespace-Delimited xargs Causes Unsafe Backup Filename Handling
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The restore script accepts a target directory parameter and even creates it, but then runs unzip -o "$BACKUP_ZIP" without -d "$TARGET_DIR", causing extraction into the current working directory instead. This can place restored files in the wrong location and overwrite unrelated markdown files where the command is run, which is especially risky because the documentation tells users the target directory will be honored.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation states that restore will extract into the user-specified target directory, but the actual script ignores TARGET_DIR during extraction. This mismatch is security-relevant because users may trust the documented destination and accidentally overwrite files in their current directory or restore data into the wrong workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly notes that backups made from absolute paths will restore to the same absolute paths, which can overwrite existing files outside the intended workspace if users restore an archive naively. In a backup/restore skill, that behavior is especially risky because users reasonably expect restore operations to be safe and scoped, and markdown-only filtering does not prevent destructive overwrites.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 121)May include surrounding context.
md
1. **路径处理** - 备份时如果使用绝对路径，还原时也会还原到相同路径 2. **增量备份** - 重复备份到同一个zip会追加文件，建议使用日期命名 3. **大文件排除** - 脚本只备份 `.md`，会自动忽略图片、视频、node_modules、git 数据等 4. **权限** - 还原到系统目录需要适当权限，普通用户还原到自己的 home 目录不需要 sudo 1. **Path handling** - If you backup with absolute paths, it will restore to the same paths 2. **Incremental backup** - Reusing the same zip file will append files, recommend date-based naming

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 126)May include surrounding context.
md
1. **路径处理** - 备份时如果使用绝对路径，还原时也会还原到相同路径 2. **增量备份** - 重复备份到同一个zip会追加文件，建议使用日期命名 3. **大文件排除** - 脚本只备份 `.md`，会自动忽略图片、视频、node_modules、git 数据等 4. **权限** - 还原到系统目录需要适当权限，普通用户还原到自己的 home 目录不需要 sudo 1. **Path handling** - If you backup with absolute paths, it will restore to the same paths 2. **Incremental backup** - Reusing the same zip file will append files, recommend date-based naming

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.
md
1. **路径处理** - 备份时如果使用绝对路径，还原时也会还原到相同路径 2. **增量备份** - 重复备份到同一个zip会追加文件，建议使用日期命名 3. **大文件排除** - 脚本只备份 `.md`，会自动忽略图片、视频、node_modules、git 数据等 4. **权限** - 还原到系统目录需要适当权限，普通用户还原到自己的 home 目录不需要 sudo 1. **Path handling** - If you backup with absolute paths, it will restore to the same paths 2. **Incremental backup** - Reusing the same zip file will append files, recommend date-based naming

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 431)May include surrounding context.
md
1. **路径处理** - 备份时如果使用绝对路径，还原时也会还原到相同路径 2. **增量备份** - 重复备份到同一个zip会追加文件，建议使用日期命名 3. **大文件排除** - 脚本只备份 `.md`，会自动忽略图片、视频、node_modules、git 数据等 4. **权限** - 还原到系统目录需要适当权限，普通用户还原到自己的 home 目录不需要 sudo 1. **Path handling** - If you backup with absolute paths, it will restore to the same paths 2. **Incremental backup** - Reusing the same zip file will append files, recommend date-based naming

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is designed to package all .md files, and in this workspace context markdown may contain notes, credentials, memory files, prompts, or other sensitive operational data. Because the skill emphasizes easy sharing and migration without warning about sensitive content, users may unintentionally create and distribute a zip archive containing confidential information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The restore path uses unzip -o, which overwrites existing files without prompting, yet the instructions around restore do not clearly warn users about overwrite behavior. In a workspace context this can silently replace notes, skill files, or memory documents, causing data loss or rollback to stale content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file structure section says the project contains only a single markdown file, while earlier installation steps direct users to materialize that content into executable files and move them into ~/.local/bin. This is a direct documentation-level contradiction about what artifacts the skill effectively produces and uses.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.