Security audit

Imanju App Dev Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it needs review because it can modify project files and contains an under-scoped automatic code-cleanup instruction.

Install only if you are comfortable with a Chinese-language app-development workflow that can create module directories, write lock records, and potentially guide cleanup of code. Use it in a version-controlled workspace, review diffs before accepting changes, avoid untrusted module names or output paths, and require explicit confirmation before any deletion or lock operation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_module.py:48
Finding: Arbitrary filesystem writes through unrestricted module and output paths
Content: View full analysis
2 else "." generate_module(module_name, output_dir) ``` ### Technical Analysis The script uses user-controlled `module_name` and `output_dir` values to construct filesystem paths without validating their format or confirming that the resolved destination remains inside an approved project directory. `os.path.join()` does not impose a security boundary. If `module_name` is absolute, it supersedes `output_dir`. A module name containing traversal components such as `../` can also escape the selected output directory. The script then passes the resulting path to `os.makedirs()` and writes a generated `README.md` beneath it. The existing-directory check reduces overwrite opportunities because generation stops when `module_dir` already exists. It does not prevent the creation of a new directory and files at an unintended writable location. ### Attack Path 1. An attacker or untrusted project specification supplies an absolute or traversal-bearing module ...[truncated 1147 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lock_module.sh:7
Finding: Path traversal and out-of-scope symbolic-link creation in module locking
Content: View full analysis
"$LOCK_FILE" << EOF { "module": "$MODULE_NAME", "locked_at": "$(date -Iseconds)", "locked_by": "${USER:-developer}", "status": "locked" } EOF ln -sf "$LOCK_FILE" "$LOCK_DIR/${MODULE_NAME}_latest.lock" ``` ### Technical Analysis `MODULE_NAME` is inserted directly into the lock-record path and the latest-lock symbolic-link destination. Shell quoting prevents word splitting and ordinary shell metacharacter injection, but it does not prevent filesystem path traversal. A value containing `../` can cause path resolution to escape `.locks`, provided the relevant parent directories exist. The `cat` redirection may create or truncate a timestamp-suffixed file outside `.locks`. More importantly, `ln -sf` may replace an out-of-scope destination whose resolved filename ends with `_latest.lock`. The symbolic-link target is also stored as a relative path. Depending on where the destination link is created, that target may not resolve as intended. This weakens the reliability of the lock mechanism in addition to the traversal risk. ### Attack Path 1. An attacker supplies a module name containing one or more traversal components. 2. An agent executes the documented lock command with that module name. 3. The shell constructs the lock-record path using the unvalidated input. 4. Path resolution escapes `.locks`. 5. The script creates a timestamped file outside the lock directory. 6. `ln -sf` creates or replaces an out-of-scope symbolic-link destination. Successful traversal depends on the selected path and the existence and writability of relevant pa ...[truncated 550 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` 2. Explicitly reject `/`, `\`, `..`, control characters, newlines, and leading hyphens. 3. Resolve and verify that both the record and link destinations remain under a canonical lock directory. 4. Use an absolute lock-directory path anchored to the project root rather than the caller's current working directory. 5. Use option terminators where supported, such as `mkdir -p -- "$LOCK_DIR"` and `ln -sfn -- "$target" "$link"`. 6. Construct the symbolic-link target relative to the link directory correctly, or use a canonical absolute target where portability permits. 7. Avoid blindly replacing an existing destination. Verify that it is an expected symbolic link before updating it. 8. Consider implementing the operation in Python with `pathlib.Path.resolve()` and explicit containment checks. 9. Add automated tests for traversal input, absolute paths, whitespace, control characters, symlinked lock directories, and existing destination files. ]]>

other

Warning

Location: SKILL.md:48
Finding: Ambiguous automatic code-deletion instruction lacks destructive-operation safeguards
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the implementation actually creates lock metadata, writes to the local filesystem, and creates symlinks without those behaviors being clearly declared, the skill hides materially relevant operational side effects. Undisclosed filesystem writes and symlink creation can be abused to alter repository state or redirect writes into unintended locations, especially in agentic environments handling trusted project files.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the implementation actually creates lock metadata, writes to the local filesystem, and creates symlinks without those behaviors being clearly declared, the skill hides materially relevant operational side effects. Undisclosed filesystem writes and symlink creation can be abused to alter repository state or redirect writes into unintended locations, especially in agentic environments handling trusted project files.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: If the implementation actually creates lock metadata, writes to the local filesystem, and creates symlinks without those behaviors being clearly declared, the skill hides materially relevant operational side effects. Undisclosed filesystem writes and symlink creation can be abused to alter repository state or redirect writes into unintended locations, especially in agentic environments handling trusted project files.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill advertises scripts that validate structure, generate module scaffolding, and lock modules, which implies file read/write behavior, but it does not declare any tool scope such as permissions or allowed-tools. Undeclared filesystem capability reduces transparency and weakens containment, making it easier for an agent to perform local repository modifications without explicit authorization boundaries.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Overly broad trigger keywords increase the chance that the skill activates in unrelated APP-development contexts where its file-manipulation or project-convention assumptions may be inappropriate. In agent systems, accidental activation can lead to unintended reads/writes, confusing workflow takeover, or application of unsafe repository operations outside the intended scenario.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Broad activation guidance without exclusion criteria makes over-triggering more likely, particularly because the skill claims wide applicability across greenfield development, refactoring, standard-setting, and audits. In a mixed-skill environment, that can cause the agent to select a filesystem-affecting skill when a user only wanted conceptual advice, increasing the chance of unintended state changes or misleading outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is written as a normative specification and begins with a Chinese-only title and content, with no indication that other languages are supported or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in or explicit justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script’s comments and user-visible messages are written in Chinese, including the usage and success output later in the file, which indicates a fixed language choice. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entire checklist is written in Chinese and provides no indication that language selection is optional or that the document is intended only for a Chinese-speaking or region-specific context. Under the policy rules, fixed language requirements without user opt-in or documented justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template is entirely written in Chinese, including headings and field labels, with no indication that language selection is optional or that the template is intended only for a Chinese-speaking or region-specific context. That creates a natural-language locale policy concern under the rule for forced language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file uses a single fixed language throughout the skill content and does not indicate that users can choose another language. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation unless the locale limitation is justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing output throughout the script are written only in Chinese, indicating a fixed language choice for the skill. The file does not offer a language/locale option or explain that the tool is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.