Security audit
Security checks for vulnerabilities and agentic risk
The skill’s standards lookups, local storage, and user-controlled offline downloads fit its stated purpose.
Routine lookups need no bulk download. Optional offline downloads are large and persist locally; use a dedicated RFC directory because corpus sync can replace or delete RFC-named files. Prefer HTTPS retrieval when source integrity matters: the rsync mirror connection does not authenticate its source, and the prebuilt index relies on the project’s GitHub releases.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
RFC_URL = "https://www.rfc-editor.org/rfc/rfc{number}.txt"
RSYNC_MODULE = "rsync.rfc-editor.org::rfcs-text-only/"
# How long the index is served without asking the RFC Editor whether it moved.
# Revalidation is a conditional GET the CDN answers 304 to, so a refresh past
# this costs a round trip rather than 2 MB, and a day is as fine-grained as the
# corpus gets: RFCs publish in weekday batches at roughly one a day.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _run_search(cmd: list[str]) -> list[str]:
try:
proc = subprocess.run(
cmd, capture_output=True, text=True, check=False, timeout=SEARCH_TIMEOUT_SECONDS
)
except subprocess.TimeoutExpired as exc:
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def _run_search(cmd: list[str]) -> list[str]:
try:
proc = subprocess.run(
cmd, capture_output=True, text=True, check=False, timeout=SEARCH_TIMEOUT_SECONDS
)
except subprocess.TimeoutExpired as exc:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What `sync --index` costs, for messages written before the release listing
# is fetched. Measured on the build this version was released with.
INDEX_DOWNLOAD_SIZE = "about 270 MB"
INDEX_RELEASES_URL = "https://api.github.com/repos/shbernal/rfc-ai-tooling/releases?per_page=50"
INDEX_TAG_PREFIX = "index-"
INDEX_ASSET = f"{SECTION_INDEX_NAME}.gz"
The subprocess invocation does not use a shell, but the command it executes downloads documents through an unauthenticated rsync daemon connection using rsync.rfc-editor.org::rfcs-text-only/. A network attacker able to intercept that connection could alter the RFC corpus or index without detection; this matters because the skill subsequently presents those documents as authoritative specification text to an agent.
print("Cancelled.")
return 1
mirror.mkdir(parents=True, exist_ok=True)
result = subprocess.run(cmd, check=False)
if result.returncode == 0 and not dry_run:
(mirror / SYNC_STAMP).write_text(f"synced {formatdate(usegmt=True)}\n", encoding="utf-8")
print(f"\nDone. {count_documents(mirror)} documents in {mirror}")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
print("Cancelled.")
return 1
mirror.mkdir(parents=True, exist_ok=True)
result = subprocess.run(cmd, check=False)
if result.returncode == 0 and not dry_run:
(mirror / SYNC_STAMP).write_text(f"synced {formatdate(usegmt=True)}\n", encoding="utf-8")
print(f"\nDone. {count_documents(mirror)} documents in {mirror}")
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
for match in _REFS.finditer(metadata):
refs = [int(n) for n in _RFC_REF.findall(match.group(2))]
key = match.group(1).lower().replace(" ", "_")
getattr(record, key).extend(refs)
for match in _ALSO.finditer(metadata):
record.also.append(match.group(1).strip())
status_match = _STATUS.search(metadata)