T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build-cidata-iso.sh:36- Finding
Arbitrary Local Code Execution Through Password Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Hyperv Create Vm
Security checks for vulnerabilities and agentic risk
Overview
The skill is aligned with creating Docker-ready Hyper-V VMs, but it exposes sensitive VM credentials and includes unsafe high-privilege provisioning paths that need review before use.
Install only if you are comfortable reviewing and hardening the scripts first. Use explicit VM names from a safe character set, provide an explicit SSH public key, avoid returning or logging passwords, verify downloaded binaries and images, and reduce the deploy user's privileges where possible. Treat VMs created by this skill as administrative infrastructure until the template-injection and path-handling issues are fixed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build-cidata-iso.sh:28- Finding
Unsafe Temporary Path Construction Permits Destructive Path Traversal
- Content
View full analysis
-cidata` namespace. 4. `rm -rf "$WORK_DIR"` recursively deletes the resolved target. 5. The script recreates the path and writes generated cloud-init files there. ### Impact Assessment Exploitation can delete or overwrite directories accessible to the build user, subject to the constructed `-cidata` suffix and filesystem permissions. If the script is run with elevated privileges, the deletion scope increases acc ...[truncated 98 chars]- Remediation
View remediation
&2 exit 1 fi ``` - Reject `/`, `\`, `..`, control characters, and leading hyphens. - Create a unique private workspace with `mktemp -d` instead of constructing a predictable directory. - Register a cleanup trap and verify that the selected path is inside the expected temporary root before deletion. - Set a restrictive `umask`, such as `umask 077`, before writing credential-bearing cloud-init files. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build-cidata-iso.sh:43- Finding
Cloud-Init Template Injection Through Unescaped User Inputs
- Content
View full analysis
"$WORK_DIR/user-data" # Add extra packages if specified if [ -n "$EXTRA_PKGS" ]; then for pkg in $(echo "$EXTRA_PKGS" | tr ',' ' '); do echo " - $pkg" >> "$WORK_DIR/user-data" done fi # Generate meta-data from template sed "s|VM_NAME_PLACEHOLDER|${VM_NAME}|g" \ "$SCRIPT_DIR/cloud-init-meta-data.yaml" > "$WORK_DIR/meta-data" ``` ### Technical Analysis The VM name, generated password hash, SSH public key, and package values are inserted into `sed` expressions or YAML without context-aware escaping. Characters meaningful to `sed`, including the selected `|` delimiter, backslashes, and replacement metacharacters, can alter or break the substitution expression. Inputs containing newlines or YAML syntax can also change the structure of `user-data` or `meta-data`. This is particularly security-sensitive because cloud-init processes `user-data` as root during initial boot. The extra-package logic is additionally structurally incorrect: it appends package-looking entries to the end of the document, after the existing `ssh_pwauth` setting rather than inside the `packages` list. Crafted multiline values could introduce new top-level cloud-init modules such as `runcmd`, users, files, or SSH configuration. ### Attack Path 1. An attacker controls a VM name, SSH public-key argument, or extra-package argument. 2. The attacker includes `sed` metacharacters, line breaks, or YAML directives. 3. The raw value is inserted into the template without escaping or schema validation. 4. ...[truncated 599 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/cloud-init-user-data.yaml:24- Finding
Unverified Remote Docker Compose Binary Installed as Root
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/cloud-init-user-data.yaml:5- Finding
Deploy Account Is Granted Multiple Root-Equivalent Privilege Paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs returning plaintext SSH credentials to the caller, which creates immediate secret exposure risk in chat logs, agent transcripts, observability systems, and downstream integrations. Because this skill provisions a Docker-ready VM with remote SSH access, disclosure of the password could directly enable unauthorized access to newly created infrastructure.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh set -euo pipefail VM_NAME="${1:?Usage: VM_PASSWORD=<pass> $0 <vm-name> [ssh-public-key] [extra-packages]}" SSH_KEY="${2:-$(cat ~/.ssh/id_ed25519.pub 2>/dev/null || echo 'NO_KEY')}" EXTRA_PKGS="${3:-}" # Read password from env var or stdin (never CLI args)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Line L056 says the skill applies 'Any time you need a fresh Linux VM on a Windows Hyper-V host,' which is a broad natural-language condition rather than a specific invocation phrase or constrained scope. This can overlap with many ordinary requests and does not clearly distinguish when this skill should or should not activate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance explicitly disables Hyper-V Secure Boot for Ubuntu cloud images without warning about the reduced boot-chain protections. While this appears operationally motivated rather than malicious, removing Secure Boot lowers resistance to boot-level tampering and should not be presented as a default fix without discussing alternatives or compensating controls.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
yaml - htop runcmd: - systemctl enable docker - systemctl start docker - usermod -aG docker deploy - mkdir -p /usr/local/lib/docker/cli-plugins
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This shell script unconditionally runs
rm -rf "$WORK_DIR", which is a destructive file deletion operation. While the script includes general usage comments and some status output, there is no specific warning or confirmation around this deletion step itself.- Content
Static analysis
No suspicious patterns detected.