Signus Signature Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:26 AM UTC
• Version: 1.0.2

Overview

The skill appears to generate Signus signature images as described, but its file-writing and ZIP extraction safeguards are weak enough that it should be reviewed before installation.

Install only if you are comfortable sending signature identity data to api.signus.ai and storing generated signature images locally. Before broad use, the maintainer should sanitize path components, enforce output-directory containment before every write, avoid remote IDs as filenames, add network and archive size limits, update or replace adm-zip, and define cleanup or retention behavior for generated signatures.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_font_signatures.js:115

Finding

User-Controlled Path Traversal in Output Directory Construction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_font_signatures.js:166

Finding

API-Controlled Signature Identifier Used as an Unvalidated File Path

Content

View full analysis

= countLimit) break; const generationId = item.generationId; const sigId = item.generatedSignatureId; if (!generationId || !sigId) continue; const fileType = String(item?.files?.[0]?.fileType || 'CLEAN').toUpperCase(); const fileName = fileType === 'WATERMARK' ? 'watermark.png' : 'clean.png'; try { const img = await downloadSignature(generationId, sigId, fileName); const filePath = path.join(outputDir, `${sigId}.png`); fs.writeFileSync(filePath, img); signatures.push({ id: sigId, filePath }); } catch (err) { log(err.message); } } ``` ### Technical Analysis `item.generatedSignatureId` is obtained from the remote API response and is therefore outside the local trust boundary. The value is interpolated directly into a local filename without format validation or path-containment enforcement. A value containing traversal components, such as `../../target`, causes `path.join(outputDir, `${sigId}.png`)` to resolve outside `outputDir`. The downloaded response body is then written to the resulting path. The network origin remains fixed to `https://api.signus.ai`, so exploitation requires the trusted service, its response path, or the communication trust boundary to return a malicious identifier. This is therefore principally a defense-in-depth failure against a compromised or malfunctioning upstream API. ### Attack Path 1. The Signus API, or an attacker capable of controlling its effective response, returns a JSON item with a malicious `generatedSignatureId`. 2. The malicious identifier contains one or more `../` path components. 3. The script accepts the identifier because it only checks whether the value is present. 4. The sc ...[truncated 922 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_font_signatures.js:75

Finding

Unbounded Buffering and Extraction of Remote Content

Content

View full analysis

!f.endsWith('.zip')); const limited = countLimit ? images.slice(0, countLimit) : images; ``` The extraction helper also imposes no archive limits: ```js function extractZipBuffer(zipBuffer, outputDir) { try { const zip = new AdmZip(zipBuffer); zip.extractAllTo(outputDir, true); } catch (err) { fail('Failed to extract ZIP response', { message: err.message }); } } ``` ### Technical Analysis Remote HTTP response bodies are fully loaded int ...[truncated 1920 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Known Vulnerable Dependency: adm-zip==0.5.16 — 2 advisory(ies): CVE-2026-76845 (adm-zip extraction follows destination symlinks, allowing arbitrary file overwri); CVE-2026-39244 (adm-zip: Crafted ZIP file triggers 4GB memory allocation)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins adm-zip to version 0.5.16, which is reported as affected by multiple high-severity issues including symlink-following during extraction and crafted ZIP-induced excessive memory allocation. If this skill ever processes untrusted ZIP content, an attacker could potentially overwrite arbitrary files via symlink traversal or trigger denial of service through memory exhaustion; the skill context does not justify ZIP handling, so carrying this dependency increases unnecessary risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: adm-zip==0.5.16 — 2 advisory(ies): CVE-2026-76845 (adm-zip extraction follows destination symlinks, allowing arbitrary file overwri); CVE-2026-39244 (adm-zip: Crafted ZIP file triggers 4GB memory allocation)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package explicitly depends on adm-zip 0.5.16, which is identified as having multiple known vulnerabilities, including unsafe extraction behavior through destination symlinks and a crafted ZIP memory-allocation denial-of-service issue. If this skill ever processes ZIP content directly or indirectly, an attacker could cause file overwrite outside the intended directory or crash/exhaust memory in the runtime.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly directs the runtime to make outbound network requests to https://api.signus.ai, but the manifest declares no permissions or allowed-tools scope. This creates a governance gap: reviewers and policy enforcement may not realize the skill can access external services, increasing the risk of unintended data egress or unauthorized network use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# Signus Font Signature

## User-facing language
- Always write user-facing text in English unless the user explicitly asks for another language.

## Runtime requirements
- Node.js 18+.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends user-provided identity data such as name, firstName, lastName, or initials to an external Signus API over the network, but the script itself provides no user-facing disclosure, consent check, or data-minimization control. In a skill specifically meant to generate signatures, this transfer is expected for functionality, but it still creates a real privacy/security risk because sensitive personal identity data is disclosed to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script writes downloaded/generated signature files into a persistent directory under the user's home folder without an explicit warning, retention policy, or permission check. Because signature images can be sensitive and reusable for impersonation or fraud, silently persisting them increases exposure if the local machine, account, or agent workspace is later accessed by another party.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is specified with a caret range, which allows future 0.5.x releases to be installed without explicit review. In a security-sensitive skill, unpinned dependencies increase supply-chain risk and make builds non-reproducible, though by itself this is generally a lower-severity issue than a known vulnerable package.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"private": true,
  "description": "Skill runtime dependencies for Signus font signature generation",
  "dependencies": {
    "adm-zip": "^0.5.16"
  }
}

Static analysis

No suspicious patterns detected.