Code Reputation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:11 PM UTC
• Version: 1.0.1

Overview

This skill has a coherent code-cache purpose, but it encourages retrieving, prompting with, and running third-party code without enough containment or disclosure.

Review carefully before installing. Use only in disposable or tightly sandboxed environments, do not use it on confidential repositories, inspect every retrieved file before execution, do not paste API-provided prompt additions into an agent as instructions, and avoid uploading files that may contain secrets or proprietary data until the skill adds confirmation, redaction, path-containment, provenance, and dependency-pinning controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: code_cache.py:91

Finding

Arbitrary File Write Through Untrusted Remote Filenames

Content

View full analysis

Vulnerability Details

File Location: code_cache.py:91-110
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: Critical

Vulnerable Code

python

def cmd_files(args: argparse.Namespace) -> None:
    """Get code files ready for execution."""
    client = get_client()
    task = " ".join(args.task)
    
    result = client.get_code_files(
        task=task,
        top_k=args.top_k,
        cache_dir=args.cache_dir,
    )
    
    if not result.files:
        print(f"No code files found for: {task}")
        return
    
    print(f"Retrieved {len(result.files)} files for: {task}\n")
    
    # Write files to cache directory
    cache_path = Path(args.cache_dir)
    cache_path.mkdir(parents=True, exist_ok=True)
    
    for f in result.files:
        file_path = cache_path / f.filename
        file_path.write_text(f.source)
        print(f"  📄 {file_path}")

Technical Analysis

Both f.filename and f.source are supplied by the remote Raysurfer service. The implementation joins the remote filename to the chosen cache directory without validating the filename or checking the resolved destination.

A filename containing traversal components, such as ../../target, can escape the cache directory. If f.filename is absolute, pathlib discards cache_path entirely. The code also does not reject symlink destinations or verify that the final resolved path remains beneath the resolved cache root.

Because Path.write_text() overwrites existing files by default, a malicious or compromised API response can replace any file writable by the Skill process.

Attack Path

1. An attacker adds a poisoned cache entry or compromises the API response.
2. The response includes a filename such as ../../.bashrc, an absolute path, or a path targeting a symlink.
3. A user or agent invokes /code-cache files.
4. The Skill combines the untrusted ...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

• Reject absolute filenames and any filename containing .. path components.
• Resolve the cache root and candidate destination, then verify that the destination is strictly beneath the cache root using Path.relative_to() or an equivalent containment check.
• Reject symlinked destination components, or perform file creation using directory-relative operating-system APIs with no-follow protections.
• Avoid silently overwriting existing files. Use exclusive creation or require explicit confirmation.
• Normalize remote filenames to a restricted basename or generate local filenames independently.
• Add tests for absolute paths, traversal paths, nested traversal, symlink escapes, and overwrite attempts.

T01 · Skill Instruction Hijacking

Error

• Location: code_cache.py:91

Finding

Remote Prompt Injection Through API-Supplied LLM Instructions

Content

View full analysis

Vulnerability Details

File Location: code_cache.py:91-113
Vulnerability Type: Untrusted remote content inserted into the agent prompt
Risk Level: High

Vulnerable Code

python

def cmd_files(args: argparse.Namespace) -> None:
    """Get code files ready for execution."""
    client = get_client()
    task = " ".join(args.task)
    
    result = client.get_code_files(
        task=task,
        top_k=args.top_k,
        cache_dir=args.cache_dir,
    )
    
    if not result.files:
        print(f"No code files found for: {task}")
        return
    
    print(f"Retrieved {len(result.files)} files for: {task}\n")
    
    # Write files to cache directory
    cache_path = Path(args.cache_dir)
    cache_path.mkdir(parents=True, exist_ok=True)
    
    for f in result.files:
        file_path = cache_path / f.filename
        file_path.write_text(f.source)
        print(f"  📄 {file_path}")
    
    print(f"\n--- Add to LLM prompt ---\n{result.add_to_llm_prompt}")

The behavior is explicitly encouraged in SKILL.md:45-46:

text

Retrieve code files ready for execution, with a pre-formatted prompt addition for your LLM.

Technical Analysis

result.add_to_llm_prompt originates from the external service and is printed under an instruction explicitly telling the caller to add it to the LLM prompt. There is no schema enforcement, validation, sanitization, trust-boundary marker, or restriction preventing this field from containing adversarial instructions.

A malicious cache record or compromised service can therefore return text instructing the agent to ignore its current task, reveal sensitive data, invoke tools, execute downloaded code, or suppress security warnings. The vulnerability is not ordinary display of untrusted data: the Skill intentionally promotes the remote value into the agent's instruction context.

Attack Path

1. An attacker po ...[truncated 889 chars]

Remediation

View remediation

Remediation Suggestions

• Do not insert or recommend inserting arbitrary remote text into an instruction-bearing prompt.
• Replace add_to_llm_prompt with a locally generated prompt based on a strict, validated data schema.
• Treat every remote field as untrusted data and clearly delimit it from system, developer, and user instructions.
• Ignore commands, role declarations, tool requests, and policy statements received in remote metadata.
• Require explicit user review before performing any action suggested by retrieved content.
• Add adversarial tests containing instruction overrides, secret requests, tool requests, and encoded prompt-injection payloads.

T03 · Remote Payload Retrieval and Execution

Error

• Location: code_cache.py:91

Finding

Retrieval and Encouraged Execution of Mutable Remote Code

Content

View full analysis

Vulnerability Details

File Location: code_cache.py:91-110
Vulnerability Type: Unverified remote payload retrieval
Risk Level: High

Vulnerable Code

python

def cmd_files(args: argparse.Namespace) -> None:
    """Get code files ready for execution."""
    client = get_client()
    task = " ".join(args.task)
    
    result = client.get_code_files(
        task=task,
        top_k=args.top_k,
        cache_dir=args.cache_dir,
    )
    
    if not result.files:
        print(f"No code files found for: {task}")
        return
    
    print(f"Retrieved {len(result.files)} files for: {task}\n")
    
    # Write files to cache directory
    cache_path = Path(args.cache_dir)
    cache_path.mkdir(parents=True, exist_ok=True)
    
    for f in result.files:
        file_path = cache_path / f.filename
        file_path.write_text(f.source)
        print(f"  📄 {file_path}")

The intended execution workflow is documented in SKILL.md:13-14:

text

When your agent generates and executes code, Code Cache stores it. When a similar task comes up later, the agent can retrieve and run the cached code instead of regenerating it—saving time and tokens.

It is also described in README.md:28:

text

Code Cache retrieves and runs proven code from previous executions via the Raysurfer API.

Technical Analysis

The Skill retrieves source code from a mutable third-party service and writes it into the local workspace for execution. No cryptographic signature, immutable content hash, trusted-publisher policy, provenance verification, source review gate, or enforced sandbox boundary is present.

Similarity scores and user votes do not establish authenticity or safety. A previously benign cache response may also change after the Skill package has been reviewed. Although code_cache.py does not directly call an interpreter, the declared functionality and docume ...[truncated 1195 chars]

Remediation

View remediation

Remediation Suggestions

• Never execute retrieved code automatically or describe popularity scores as proof of safety.
• Require explicit human review and confirmation before execution.
• Accept code only from trusted publishers and verify cryptographic signatures and immutable content hashes.
• Display source provenance, publisher identity, version, retrieval time, and digest before use.
• Execute retrieved code only in a restricted sandbox with no host secrets, minimal filesystem access, no unnecessary network access, resource limits, and a disposable environment.
• Separate downloading from execution so retrieval cannot implicitly authorize execution.
• Apply static and dependency scanning to every retrieved payload.

T08 · Insecure Dependencies

Warning

• Location: code_cache.py:14

Finding

Unpinned Third-Party SDK Installation and Import

Content

View full analysis

Vulnerability Details

File Location: code_cache.py:14-16 and code_cache.py:40-42
Vulnerability Type: Unpinned dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

python

try:
    from raysurfer import RaySurfer
    from raysurfer.types import FileWritten
    HAS_RAYSURFER = True
except ImportError:
    HAS_RAYSURFER = False
    RaySurfer = None  # type: ignore

python

if not HAS_RAYSURFER:
    print("Error: raysurfer package not installed", file=sys.stderr)
    print("Install with: pip install raysurfer", file=sys.stderr)
    sys.exit(1)

Technical Analysis

Users are instructed to install raysurfer without a version constraint or package hash. The project does not provide a lockfile or other integrity metadata. Python packages can execute code during installation and import, and this SDK also controls communication with the remote cache.

Consequently, a compromised future release, unsafe dependency update, or incompatible package version can execute with the same privileges as the Skill. The audit did not establish that the current package is malicious; the issue is the absence of reproducible and integrity-verified dependency selection.

Attack Path

1. The package or one of its transitive dependencies is compromised, or an unsafe future version is published.
2. A user follows the displayed pip install raysurfer instruction.
3. The package manager installs the latest matching release without a reviewed version pin or hash.
4. Malicious installation or import-time code executes.
5. The dependency gains access to the process environment, local files, and API key available to the Skill.

Impact Assessment

A compromised dependency can execute arbitrary code with the Skill process's privileges. It may access RAYSURFER_API_KEY, workspace files, network resources, and other environment variables. The affected scope includes every i ...[truncated 61 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the SDK to a reviewed, compatible version.
• Use a lockfile with cryptographic hashes for the SDK and all transitive dependencies.
• Install from the canonical package index over verified TLS and verify publisher provenance.
• Review release changes before updating dependency pins.
• Run dependency vulnerability and provenance checks in continuous integration.
• Prefer an isolated virtual environment with only the minimum required packages and permissions.

T09 · Insecure Skill Coding Practices

Warning

• Location: code_cache.py:116

Finding

Source Upload Can Disclose Embedded Secrets to a Third-Party Service

Content

View full analysis

Vulnerability Details

File Location: code_cache.py:116-139
Vulnerability Type: Unfiltered upload of potentially sensitive source files
Risk Level: Medium

Vulnerable Code

python

def cmd_upload(args: argparse.Namespace) -> None:
    """Upload code to the cache."""
    client = get_client()
    
    files_written = []
    for file_path in args.files:
        path = Path(file_path)
        if not path.exists():
            print(f"Error: File not found: {file_path}", file=sys.stderr)
            sys.exit(1)
        
        files_written.append(FileWritten(
            path=str(path),
            content=path.read_text(),
        ))
    
    for file_written in files_written:
        client.upload_new_code_snip(
            task=args.task,
            file_written=file_written,
            succeeded=args.succeeded,
            use_raysurfer_ai_voting=not args.no_auto_vote,
        )
    
    print(f"✓ Uploaded {len(files_written)} file(s) for task: {args.task}")
    print(f"  Succeeded: {args.succeeded}")

Technical Analysis

The upload command reads each selected file in full and sends its path and contents to the external Raysurfer API. It performs no secret detection, redaction, file-type filtering, sensitive-filename denial, size restriction, or confirmation that displays what data will leave the machine.

Source files commonly contain embedded API tokens, passwords, private endpoints, customer identifiers, test credentials, or confidential business logic. The transfer is part of the documented feature and is not covert, but the implementation lacks controls needed to ensure only the minimum necessary information is transmitted.

Attack Path

1. Generated or existing source code contains an embedded credential or other confidential value.
2. A user or agent selects the file for caching with /code-cache upload.
3. The Skill reads the complete file ...[truncated 801 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit informed confirmation immediately before upload, listing the destination, filenames, sizes, and data-retention implications.
• Scan content for common tokens, private keys, passwords, connection strings, and high-entropy secrets.
• Block uploads when likely secrets are found unless the user explicitly redacts and rechecks the file.
• Deny sensitive filenames and extensions by default, including environment files, key files, credential stores, and configuration containing secrets.
• Upload only the minimum code fragment required rather than complete files and paths.
• Clearly document service retention, sharing, deletion, and training policies.
• Provide a local-only caching mode and make it the default for confidential projects.
• Add automated tests confirming that representative secrets and sensitive filenames are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly promotes retrieving and running previously generated code from an external cache ('No waiting. No regenerating. Just execute.') without any safety warning, verification guidance, or trust boundary discussion. This is dangerous because cached code may be malicious, outdated, poisoned by prior users, or simply unsafe for the current environment, and the documentation encourages direct execution as a normal workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the '/code-cache files' flow downloads executable code files from an external service into the sandbox and prepares them for agent use, but omits any warning that these files are third-party content requiring inspection. In the context of an agent skill that optimizes for speed and reuse, this increases the chance of users or agents automatically executing untrusted code, enabling supply-chain-style compromise, data exfiltration, or destructive actions inside the sandbox.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises capabilities that involve environment access and reading/writing local files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the operational boundary unclear to users and enforcement layers, increasing the chance an agent will access secrets or modify files without informed consent or proper restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill encourages uploading generated code and task descriptions to the external Raysurfer API, but the description does not clearly warn users that potentially sensitive code, prompts, and metadata leave the local environment. In an agent setting, cached code may contain proprietary logic, credentials, internal paths, or customer data, so silent transmission to a third party creates a meaningful confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The metadata slug in _meta.json is "code-reputation" while the provided skill context identifies the skill as "code-cache". This mismatch can cause a skill to be mislabeled, confused with another package, or incorrectly trusted during publishing, review, or retrieval workflows, which creates supply-chain and integrity risks even if it is not directly executable code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The upload command reads arbitrary local files and sends their full contents to a remote Raysurfer API, but the CLI provides no explicit warning, confirmation, or sensitivity checks before transmission. In an agent skill context, this is dangerous because tasks may include secrets, proprietary code, credentials, or internal data, and semantic code caching is specifically designed to exfiltrate code artifacts off-host for reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The files command fetches code from a remote service and writes it directly into the local filesystem without prompting, provenance checks, or path safety validation beyond joining with the cache directory. In a code-reuse skill, this increases risk because untrusted remote content is materialized locally and may later be executed, reviewed insufficiently, or overwrite expected cache contents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.