Ofek Galim

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:43 AM UTC
• Version: 0.1.4

Overview

This skill mostly matches homework monitoring, but it handles children’s credentials and can write student task data to external calendars with unsafe credential-loading and an unaudited external script boundary.

Review before installing. Use dedicated least-privilege school and calendar credentials, keep env files private and chmod 600, do not point WEBTOP_GALIM_ENV at untrusted files, audit or remove the external pywebtop dependency, and run calendar sync only after previewing with --dry-run and confirming the target calendar is not broadly shared.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/claude-code-wrapper.sh:5

Finding

Credential configuration is executed as arbitrary shell code

Content

View full analysis

&2 echo "Run: bash $ROOT_DIR/scripts/install.sh" >&2 exit 1 fi } ``` ### Technical Analysis The wrapper uses the Bash `.` command to source the selected credentials file. Sourcing does not treat the file as passive key/value data: it executes the entire file as shell code in the current process. The `WEBTOP_GALIM_ENV` environment variable can select any existing file. There is no validation of its ownership, permissions, canonical path, file type, or syntax before execution. A selected or modified file can therefore contain command substitutions, redirects, shell functions, external command invocations, or arbitrary scripts. Executable configuration semantics are not necessary for the declared functionality. The Python fetchers already parse these files as plain key/value data. The wrapper should apply equivalent strict parsing instead of executing the file. ### Attack Path 1. An attacker gains the ability to cre ...[truncated 1473 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/webtop_fetch_summary.py:6

Finding

Unaudited external Webtop script executes with inherited student credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose emphasizes checking and summarizing student tasks, but the skill also performs write actions to Google Calendar and configures reminder notifications. This mismatch can mislead users into approving a seemingly read-only skill that actually exports student data to external services and changes calendar state.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose emphasizes checking and summarizing student tasks, but the skill also performs write actions to Google Calendar and configures reminder notifications. This mismatch can mislead users into approving a seemingly read-only skill that actually exports student data to external services and changes calendar state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file repeatedly instructs Claude Code to summarize results 'in Hebrew' or build Hebrew-only reports, which imposes a specific language choice in natural-language instructions. Because no user opt-in or justification for the locale restriction is provided in the file, it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill for checking, monitoring, and summarizing student homework/tasks across school systems and sending alerts about new tasks. This prompt file additionally instructs the agent to run a sync operation for calendar synchronization and report what changed, which is a distinct integration/modification capability rather than simple inspection or summarization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The prompts instruct running a calendar synchronization command that may modify external calendar data, but they provide no warning, confirmation step, or clear statement that this is a write action. In an agent workflow, this increases the risk of unintended side effects such as creating, updating, or duplicating calendar entries without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly instructs the agent to source local environment files that contain usernames and passwords, but it provides no warning about sensitive-data handling, output redaction, or minimizing exposure. In an agentic context, this increases the risk that secrets are echoed, logged, included in summaries, or mishandled during troubleshooting, especially because the skill encourages repeated operational use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow recommends running the sync command, which can create or update calendar events in an external system, without a clear safety warning or explicit user confirmation step. That makes unintended modification of user data more likely, particularly when an autonomous agent follows the documented 'normal' workflow and may treat the operation as routine.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation describes commands that use shell execution, network access, environment-stored credentials, and file reads, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may invoke broader capabilities than a user expects, especially given the presence of student credentials and automation actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents calendar synchronization that writes school-task data into a family Google Calendar, but this write/export behavior is not clearly surfaced as a user warning in the primary description. Because the data concerns children's school tasks and due dates, silent synchronization increases the risk of unintended disclosure, persistence, and over-sharing across household or shared calendar participants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automation section states that a daily flow sends updates to a WhatsApp group, but the top-level skill description does not prominently warn users that student task summaries may be transmitted to a group chat. This is a privacy and consent risk because educational status and due items about children may be shared beyond the immediate operator's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file documents storing multiple children’s student IDs and passwords in a plaintext .env file under a fixed root-owned path and immediately shows how to run scripts that consume them, but provides no warnings about secure storage, file permissions, secret rotation, or the privacy sensitivity of children’s educational accounts. In the context of a skill that aggregates school tasks and submission status, this increases the risk of credential exposure, unauthorized access to student data, and accidental disclosure through logs, backups, or misconfigured workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This shell script sources an env file and maps/exports multiple username and password variables, including child account credentials, but provides no visible warning, confirmation, or explanatory comment to the user about handling sensitive credentials. For a code file, accessing sensitive environment variables without any disclosure meets the missing user warning criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The wrapper exposes a sync command that performs calendar synchronization, which goes beyond the stated skill purpose of checking, monitoring, and summarizing school tasks. In an agent setting, capability expansion matters because it enables state-changing actions on external systems that a user may not expect from a read-oriented homework monitoring skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/expanded_report.py (reported line 14)May include surrounding context.

python

def run_json(cmd):
    proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    if proc.returncode != 0:
        raise RuntimeError(proc.stderr or proc.stdout)
    return json.loads(proc.stdout)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code invokes other scripts via subprocess and then aggregates their output, which appears to include per-student task information. There is no confirmation prompt, user-facing log, or explanatory comment/docstring in this file disclosing that external scripts will be run to collect and combine this data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script fixes the target URL to the Hebrew site path and relies throughout on Hebrew UI labels and Hebrew-formatted output. This effectively forces a specific language/locale without any user opt-in or documented justification, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code loads usernames and passwords from environment files and later uses them for automated login to a remote education portal. Although the module docstring mentions login, there is no clear user-facing disclosure at runtime or prominent warning comment explaining that local credential files will be read and submitted to a third-party site for each child.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Both service URLs hard-code 'lang=he', and the rendered output is also fixed in Hebrew, which imposes a specific language choice without opt-in or documented justification. The policy explicitly calls for flagging language or locale constraints when the user is not offered a choice.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/fetch_tasks.py (reported line 54)May include surrounding context.

python

def choose_env_path() -> Path:
    override = Path(__import__('os').environ['WEBTOP_GALIM_ENV']) if 'WEBTOP_GALIM_ENV' in __import__('os').environ else None
    if override and override.exists():
        return override
    if DEFAULT_ENV_PATH.exists():

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/galim_fetch_tasks.py (reported line 49)May include surrounding context.

python

def choose_env_path() -> Path:
    override = Path(__import__('os').environ['WEBTOP_GALIM_ENV']) if 'WEBTOP_GALIM_ENV' in __import__('os').environ else None
    if override and override.exists():
        return override
    if DEFAULT_ENV_PATH.exists():

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code loads usernames and passwords for multiple children from local environment files and uses them for automated login, but the file contains no comments, logging, prompts, or other user-facing disclosure about handling sensitive credentials. For a code file, accessing credentials without any visible warning or explanation matches the missing user warnings criterion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function logs into external Galim services and retrieves task data over the network using supplied credentials, but there is no confirmation prompt, print/log statement, or inline documentation warning the user that account data will be transmitted to remote services. This is a safety-relevant network operation involving user data and credentials.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 35)May include surrounding context.

sh

OFEK_GALIM_WHATSAPP_GROUP=$GROUP_DEFAULT
GOOGLE_SA_FILE=$SA_DEFAULT
EOF
  chmod 600 "$ENV_FILE_DEFAULT"
  echo "Created env template: $ENV_FILE_DEFAULT"
else
  echo "Env file already exists: $ENV_FILE_DEFAULT"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sync_galim_calendar.py (reported line 23)May include surrounding context.

python

def run_galim_json(days: int):
    proc = subprocess.run(
        [sys.executable, str(GALIM_SCRIPT), '--json', '--hide-overdue', '--due-within-days', str(days)],
        capture_output=True,
        text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This script goes beyond passive monitoring/summarization and actively writes calendar events to Google Calendar, creating persistent side effects containing student task data. In a skill described as checking and summarizing homework, undisclosed mutation of a third-party account increases privacy and consent risk, especially because it handles children's information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.