clear-skills

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:48 PM UTC
• Version: 1.0.0

Overview

This skill is a real cleanup tool, but it can delete broad AI-tool configuration and workspace directories beyond narrow rule or skill files.

Review this skill carefully before installing. Use dry-run first, avoid default all-platform global cleanup, do not run it as administrator or root, and do not rely on the backup as guaranteed protection. Only proceed if you are comfortable with deleting entire AI-tool configuration directories and possible workspace data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/clear_agent_rules.py:418

Finding

Overbroad Recursive Deletion of Configuration and Potentially Sensitive Data

Content

View full analysis

Vulnerability Details

File Location: scripts/clear_agent_rules.py:168, scripts/clear_agent_rules.py:207-238, and scripts/clear_agent_rules.py:418-433
Vulnerability Type: Overbroad destructive file operation
Risk Level: High

The implementation deletes entire application configuration directories and a generic project-level config.toml, despite the documentation stating that only AI rule or skill files are removed.

Vulnerable Code

python

{"name": "OpenHands 配置文件",             "platform": "openhands", "path": "config.toml"},

python

{"name": "Continue 全局配置目录",           "platform": "continue", "path": home(".continue")},

{"name": "Claude Code 全局指令文件",        "platform": "claude",   "path": home(".claude", "CLAUDE.md")},
{"name": "Claude Code 全局配置目录",        "platform": "claude",   "path": home(".claude")},

{"name": "OpenCode 全局配置目录",           "platform": "opencode", "path": home(".config", "opencode")},
{"name": "OpenCode 全局 AGENTS.md",        "platform": "opencode", "path": home(".config", "opencode", "AGENTS.md")},
{"name": "OpenCode Claude 兼容目录",        "platform": "opencode", "path": home(".claude")},

{"name": "Kiro 全局配置目录",             "platform": "kiro",     "path": home(".kiro")},
{"name": "Kiro MCP 配置文件",              "platform": "kiro",     "path": home(".kiro", "mcp-config.json")},

{"name": "OpenHands 全局配置目录",           "platform": "openhands", "path": home(".openhands")},

{"name": "PI 编码代理全局配置",           "platform": "pi",       "path": home(".pi", "agent", "settings.json")},
{"name": "PI 全局配置目录",               "platform": "pi",       "path": home(".pi")},

python

def do_delete(targets):
    """执行删除，返回 (success_count, fail_count)"""
    section("执行清除")
    success, fail = 0, 0
    for t in targets:
        try:
            if t["path"].is_dir():
                shutil.rmtree(str(t["path"]))
            else:
                t["path"].unlin
...[truncated 2687 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace directory-level targets with explicit allowlists of documented rule files and rule-only subdirectories.
2. Do not recursively delete complete roots such as ~/.claude, ~/.continue, ~/.kiro, ~/.openhands, or ~/.pi.
3. Remove the generic project-root config.toml target, or verify platform ownership through a strict schema and platform-specific markers before including it.
4. Enumerate and display every individual file that will be deleted rather than displaying only a parent directory.
5. Resolve and validate each path immediately before deletion, ensuring that it remains inside an approved project or user configuration boundary.
6. Reject symlinks and other path redirections, or handle them without traversing their targets.
7. Require separate explicit confirmation for project-level and global deletion.
8. Update the documentation so that it accurately describes every type of data that may be removed.
9. Add automated tests proving that credentials, histories, generic configuration files, and unrelated files survive cleanup.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clear_agent_rules.py:383

Finding

Backup Failures Do Not Prevent Irreversible Deletion

Content

View full analysis

Vulnerability Details

File Location: scripts/clear_agent_rules.py:383-414 and scripts/clear_agent_rules.py:515-520
Vulnerability Type: Fail-open backup and destructive-operation workflow
Risk Level: High

The backup routine catches copy failures and continues, but the caller subsequently deletes every target regardless of whether its backup succeeded.

Vulnerable Code

python

def do_backup(targets, project_root):
    """将所有目标备份到桌面，返回备份目录路径"""
    ts = datetime.now().strftime("%Y%m%d_%H%M%S")
    desktop = HOME / "Desktop"
    desktop.mkdir(parents=True, exist_ok=True)
    backup_root = desktop / f"agent-rules-backup-{ts}"
    backup_root.mkdir(parents=True, exist_ok=True)

    section("执行备份")
    for t in targets:
        try:
            rel = (f"project/{t['path'].relative_to(project_root)}"
                   if t["scope"] == "project"
                   else f"global/{t['path'].relative_to(HOME)}")
        except ValueError:
            rel = f"{t['scope']}/{t['path'].name}"

        dest = backup_root / rel
        dest.parent.mkdir(parents=True, exist_ok=True)

        try:
            if t["path"].is_dir():
                shutil.copytree(str(t["path"]), str(dest), dirs_exist_ok=True)
            else:
                shutil.copy2(str(t["path"]), str(dest))
            print(f"  {c('✔', GREEN)} 已备份: {t['name']}")
            print(f"      {c(str(t['path']), GRAY)}")
        except Exception as e:
            print(f"  {c('✘', RED)} 备份失败: {t['name']} — {e}")

    print()
    print(f"  {c('📦 备份保存在:', GREEN)} {backup_root}")
    return backup_root

python

backup_root = None
if backup_flag:
    backup_root = do_backup(targets, project_root)

# ── 删除 ──
success, fail = do_delete(targets)

Technical Analysis

do_backup handles each copy exception by printing an error and then continuing to the next target. It returns only the bac ...[truncated 1984 chars]

Remediation

View remediation

Remediation Suggestions

1. Make do_backup return a per-target result containing success status, destination path, and failure reason.
2. Delete only targets whose backups completed and passed verification.
3. Abort the entire operation if any backup fails unless the user receives a new warning and explicitly confirms deletion without backup.
4. Verify that each destination exists and matches the source before deleting the source. At minimum, compare file counts, sizes, and metadata; use cryptographic hashes for regular files when practical.
5. Write backups to a temporary staging directory and atomically rename the directory only after the complete backup succeeds.
6. Check available storage before copying and report insufficient capacity before any deletion begins.
7. Return a nonzero exit status when backup or deletion failures occur.
8. Clearly distinguish complete and partial backups in the final report rather than always presenting the backup root as successful.
9. Add tests that simulate permission failures, disk exhaustion, copy exceptions, and partial directory copies, confirming that affected originals are retained.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is to remove agent rule/skill files, but the behavior includes undeclared backup to Desktop, additional platform/path coverage, and deletion of broader configuration directories or files for some tools. This mismatch is dangerous because users may consent to narrow cleanup while the skill performs wider filesystem modification, potentially deleting configuration or sensitive data outside the expected scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script’s stated purpose is to remove AI rule/skill/instruction artifacts, but the global target list includes broad application configuration directories such as ~/.claude, ~/.continue, ~/.kiro, ~/.openhands, ~/.factory, ~/.openclaw, and similar shared folders. Deleting whole config trees can remove unrelated settings, credentials, histories, workspace metadata, and other user data beyond rule files, creating destructive behavior far beyond the advertised scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The target home('.copaw', 'workspaces') is an entire workspace directory, which is not equivalent to an AI rule or skill file. Removing it can destroy project/session data and user work product, making the skill materially more dangerous because it is marketed as a one-click cleanup tool for rules rather than a workspace wipe utility.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes destructive filesystem behavior and, per the finding, has effective file-write and environment-access capability but does not declare any tool scope or permission boundary. In a cleanup skill that can delete project and global files across many platforms, missing explicit permission constraints increases the risk of overbroad or unintended destructive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The project target 'config.toml' for OpenHands and the global target '.openhands' are generic configuration artifacts with unclear relation to agent rule or skill cleanup. Because these names are broad and may contain unrelated runtime or user configuration, deleting them risks unintended loss of settings and environment state outside the stated function of clearing instruction files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest explicitly defines activation phrases in Chinese and English, but nowhere indicates whether the skill is intended to operate only for those languages or how users can opt into or change language behavior. Under the policy rule, forcing specific language triggers without user choice can be a locale-policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.