Signus Font Signature

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:24 AM UTC
• Version: 1.0.1

Overview

This skill matches its stated purpose, but it needs Review because unsafe filename and ZIP handling can write outside its promised folder or exhaust local resources.

Install only after reviewing the path handling and ZIP-processing risks. Users should know that their supplied name or initials are sent to Signus and that generated signature files are stored locally; maintainers should validate path components, enforce output-directory boundaries, add response and extraction limits, and update or replace the ZIP dependency before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_font_signatures.js:111

Finding

User-Controlled Output Directory Path Traversal

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_font_signatures.js:184

Finding

API-Controlled Signature ID Allows File Path Traversal

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_font_signatures.js:68

Finding

Unbounded Remote Response Buffering and ZIP Extraction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Known Vulnerable Dependency: adm-zip==0.5.16 — 2 advisory(ies): CVE-2026-76845 (adm-zip extraction follows destination symlinks, allowing arbitrary file overwri); CVE-2026-39244 (adm-zip: Crafted ZIP file triggers 4GB memory allocation)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins adm-zip to version 0.5.16, which is flagged with known high-severity advisories for unsafe ZIP handling: extraction may follow destination symlinks and allow arbitrary file overwrite, and a crafted archive may trigger massive memory allocation leading to denial of service. This skill’s stated behavior explicitly includes ZIP response handling, which makes the dependency especially relevant rather than incidental.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: adm-zip==0.5.16 — 2 advisory(ies): CVE-2026-76845 (adm-zip extraction follows destination symlinks, allowing arbitrary file overwri); CVE-2026-39244 (adm-zip: Crafted ZIP file triggers 4GB memory allocation)

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill depends on adm-zip 0.5.16, which is flagged for vulnerabilities including following destination symlinks during extraction and a crafted ZIP-triggered large memory allocation. This skill explicitly handles ZIP responses, so the vulnerable library is directly relevant: a malicious or compromised upstream ZIP could cause arbitrary file overwrite in some extraction workflows or denial of service via memory exhaustion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly directs network access to an external API but does not declare any tool scope such as allowed-tools or permissions. That creates a policy gap where a runtime or agent may permit broader-than-intended outbound actions, reducing enforceable least-privilege controls and making future changes riskier.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# Signus Font Signature

## User-facing language
- Always write user-facing text in English unless the user explicitly asks for another language.

## Runtime requirements
- Node.js 18+.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L09 instructs the skill to always use English unless the user explicitly asks for another language. This imposes a specific language by default rather than offering a language choice or documenting a justified locale constraint, which matches the policy-violation criteria for language or locale restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script writes ZIP archives and extracted image files into a persistent directory under the user's home folder, which can leave sensitive signature artifacts stored locally without the user's awareness. While this behavior supports the skill's output flow, silent persistence of generated signatures increases privacy and data-retention risk if other local users, tools, or later processes can access the files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends user-supplied identity data such as name, firstName, lastName, or initials to external Signus API endpoints, which is a privacy-relevant data transfer. In the context of an agent skill, this can expose personal data to a third party without clear user disclosure or consent handling in the code, making the finding valid even though the transfer is functionally required.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a caret range, which permits automatic installation of newer patch/minor versions and reduces build reproducibility. In a security-sensitive skill that processes ZIP/image responses, non-pinned dependencies increase supply-chain risk and make it harder to guarantee which code is executed.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"private": true,
  "description": "Skill runtime dependencies for Signus font signature generation",
  "dependencies": {
    "adm-zip": "^0.5.16"
  }
}

Static analysis

No suspicious patterns detected.