ThinkTank Skill Finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 1.0.9

Overview

The skill is coherent, but its installer can add multiple unverified remote skills into the active agent skills folder without per-package confirmation, so it should be reviewed before use.

Install only if you trust the listed skill sources and are comfortable with remote skills being added to your active agent environment. Prefer the default restricted mode, review the skill list first, avoid custom registry or --dir values, and be aware that mirror misses can trigger an automatic fallback to another registry.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_bundle.py:286

Finding

Unpinned Remote Skill Installation Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/install_bundle.py:174

Finding

Installation Directory Traversal Outside the Configured Work Directory

Content

View full analysis

Tuple[Path, str, Path]: workdir_path = Path(workdir).expanduser().resolve() skills_dir_norm = skills_dir.strip().replace("\\", "/").strip("/") if not skills_dir_norm: print("Error: install dir must not be empty.", file=sys.stderr) sys.exit(1) install_path = workdir_path.joinpath(*skills_dir_norm.split("/")) return workdir_path, skills_dir_norm, install_path ``` The resulting path is created and passed to the package installer: ```python workdir_path, skills_dir_norm, install_path = resolve_install_target(workdir, skills_dir) workdir_path.mkdir(parents=True, exist_ok=True) install_path.mkdir(parents=True, exist_ok=True) ``` ### Technical Analysis The caller-controlled `skills_dir` value is normalized only by replacing backslashes and removing leading and trailing slashes. The implementation does not reject `..` components or resolve the final installation path before checking its containment. For example, if the work directory is `/home/user/.agents` and `--dir ../../target` is supplied, `install_path` represents a path outside `/home/user/.agents`. Calling `mkdir(parents=True)` processes the traversal components, and the same untrusted directory value is passed to `clawdhub`. The documented purpose is to install Skills below a work directory, normally `~/.agents/skills`. Allowing the destination to escape that boundary is unnecessary for the declared functionality. ### Attack Path 1. An attacker provides or recommends a command containing a traversal value, such as: ```text python scripts/install_bundle.py thinktank-core --workdir ~/.agents --dir ../../target ``` 2. `resolve_install_target` retains the `..` components. 3. `mkdir(parents=Tru ...[truncated 1123 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This is a true tool-parameter abuse risk because the helper passes a dynamically constructed string into a shell. In a skill installer context, arbitrary command execution is especially dangerous: an attacker who can influence the command parameter or trigger unsafe reuse could execute OS commands, tamper with installed skills, or compromise the user's workspace.

Content

Scanner excerpt · scripts/install_bundle.py (reported line 108)May include surrounding context.

python

return resolved

    probe_cmd = f"where {command}" if os.name == "nt" else f"command -v {command}"
    probe = subprocess.run(
        probe_cmd,
        shell=True,
        text=True,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill directs the agent to read local files and execute shell commands for search, installation, and verification, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may permit broader file and shell access than users expect, increasing the chance of unintended command execution or filesystem modification during skill use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger description includes broad natural-language phrases like finding, recommending, or installing skills for multiple research tasks, which can cause the skill to activate in many loosely related conversations. Over-triggering is dangerous here because the skill is capable of invoking shell commands and performing installations, so accidental activation could lead to unneeded external queries or package installs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that the skill installs into the user's home directory and may automatically fall back from a mirror to an external official source, but it does not prominently warn the user about local writes, network access, trust boundaries, or supply-chain risk. In context, this is more dangerous because the skill is specifically designed to fetch and install third-party content, so silent fallback behavior can expose users to unexpected remote sources and persistent local changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings in Chinese for bundle names, purposes, and mode descriptions, which effectively forces a specific language for users interacting with the tool. The file does not provide an opt-in, locale selection, or documented justification for this language constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The code builds a shell command string with an unquoted variable (probe_cmd = f"... {command}") and executes it with shell=True. Although current call sites pass fixed command names, this helper accepts arbitrary input and would allow shell metacharacter injection if reused with attacker-controlled data, leading to arbitrary command execution in the installer context.

Content

Scanner excerpt · scripts/install_bundle.py (reported line 108)May include surrounding context.

python

return resolved

    probe_cmd = f"where {command}" if os.name == "nt" else f"command -v {command}"
    probe = subprocess.run(
        probe_cmd,
        shell=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install_bundle.py (reported line 143)May include surrounding context.

python

sys.exit(1)

        command_expr = "& " + " ".join(powershell_quote(part) for part in [command, *args])
        return subprocess.run(
            [shell_path, "-NoProfile", "-Command", command_expr],
            text=True,
            encoding="utf-8",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install_bundle.py (reported line 162)May include surrounding context.

python

import shlex
    command_expr = " ".join(shlex.quote(part) for part in [command, *args])
    return subprocess.run(
        [shell_path, "-lc", command_expr],
        text=True,
        encoding="utf-8",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file is a plain-text CSV, so SQP-3 applies. The title "Market Analysis CN" on L39 signals a locale-specific constraint, but the row does not provide any indication that the language/locale is optional, user-selected, or otherwise justified as a region-specific compliance need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The title and entire maintenance document are written in Chinese, which constitutes a language-specific instruction/documentation choice. Under the policy, language constraints should either offer a user choice or be clearly documented as justified for a specific locale or region; no such opt-in or justification appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L099-L104 明确要求结果中的“简短描述（中文）”，这构成了对输出语言的固定要求。文档没有说明这是可选项，也没有提供依据用户偏好切换语言的机制，因此存在语言/locale 策略约束风险。

Content

No source excerpt is available for this finding.