Security audit

Stdio Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local file dropbox, but its implementation can store and operate on files outside the documented workspace boundary.

Review this before installing. The skill appears to be a simple local file-transfer helper rather than malware, but its filesystem boundary is not reliable as written. Use it only in a contained environment, avoid placing sensitive files near its boxes, and prefer a fixed version that stores data under the intended project directory, rejects symlinks, limits file/message size, and clearly warns before overwrites or deletes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/server.js:20
Finding: Filesystem storage is created outside the documented project boundary
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/server.js:37
Finding: Symbolic links bypass filesystem confinement for file reads and writes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/server.js:57
Finding: Unbounded protocol and file buffering permits denial of service
Content: View full analysis
{ buf = Buffer.concat([buf, chunk]); parseMessages(); }); ``` The declared LSP body length is also accepted without an upper bound: ```js const len = parseInt(m[1], 10); const total = headerEnd + sepLen + len; if (buf.length < total) return; ``` ### Technical Analysis The server imposes no maximum on: - Buffered stdin data. - LSP `Content-Length`. - NDJSON line length. - Base64 input length. - Decoded output size. - Size of a file returned by `stdio_read`. Repeated `Buffer.concat` operations allocate a new buffer and copy existing data whenever another stdin chunk arrives. For a large incomplete request, this can produce substantial allocation and copying overhead. A declared but never completed large `Content-Length` causes the process to retain received data indefinitely while waiting for the remaining body. `stdio_read` loads an entire file and then creates an additional base64 representation, which is approximately one-third larger than the binary input. `stdio_write` similarly materializes the JSON ...[truncated 1584 chars]
Remediation: View remediation
MAX_MESSAGE_BYTES) { throw new Error('message exceeds maximum size'); } ``` 3. Terminate or reset the connection if buffered data exceeds the configured maximum, including incomplete NDJSON records. 4. Validate base64 input length before decoding and reject decoded data larger than the file limit. 5. Check file size with `fstat` before reading, while recognizing that descriptor-based streaming is safer than a separate pathname check. 6. Stream large reads and writes instead of using whole-file buffers. If MCP response constraints require base64 text, impose a conservative maximum file size. 7. Replace repeated `Buffer.concat` with a bounded framing parser that retains chunks without repeatedly copying all accumulated data. 8. Use asynchronous filesystem APIs to avoid blocking the event loop. 9. Apply operating-system resource limits and supervision so that a single failed process cannot consume excessive host memory. 10. Add tests for oversized headers, incomplete bodies, long NDJSON records, large base64 payloads, and oversized inbox files. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code implements direct file writes, moves with overwrite, and deletions via stdio_write, stdio_move, and stdio_delete, including irreversible actions like fs.unlinkSync, but provides no confirmation prompt, warning message, or user-facing disclosure at execution time. Although the tool descriptions state what the operations do, they do not warn users about destructive effects such as replacement or deletion of existing files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes absolute on-disk paths, including the resolved repository root, through the stdio_paths tool. Even without arbitrary path access, this leaks environment structure that can aid follow-on targeting, reduce isolation assumptions, and reveal more host context than is necessary for an inbox/outbox bridge.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The stdio_paths capability provides path-discovery unrelated to the core stated purpose of moving files through inbox/outbox/tmp. Unnecessary discovery features expand attack surface by giving clients environmental reconnaissance data that can be combined with other weaknesses or operational mistakes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown instructs the agent to use stdio_move to claim files by moving them to tmp, which changes file location and could affect a user's expected workflow. Although the document describes the inbox/tmp/outbox model, it does not explicitly warn users that inputs may be relocated during processing or that outputs may be written to disk.
Content: No source excerpt is available for this finding.