Sumo Handoff Tools

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent handoff logger, but it stores potentially sensitive task metadata persistently and has an unscoped reader path that can escape the intended log directory.

Install only if you are comfortable with task summaries, file paths, artifact names, and next-step notes being stored in persistent plaintext under your home directory. Avoid putting secrets in handoff fields, restrict permissions on ~/.sumo/handoffs, and fix the reader's --date validation before using it in workflows where another user or prompt can influence arguments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: handoff_reader.py:28

Finding

Path Traversal Through Unvalidated Date Argument

Content

View full analysis

Vulnerability Details

File Location: handoff_reader.py, lines 28–34
Vulnerability Type: Path traversal and unauthorized local file read
Risk Level: Medium

Vulnerable Code

python

daily_file = HANDOFF_DIR / f"{date_str}.jsonl"
if not daily_file.exists():
    print(f"[WARN] File not found: {daily_file}")
    return []

handoffs = []
with open(daily_file, 'r', encoding='utf-8') as f:

The displayed warning text above is an English rendering of the original message; the executable path construction and file-opening logic are unchanged.

Technical Analysis

The date_str value originates from the command-line --date argument and is inserted directly into a filesystem path. The program does not verify that the value is a valid date or that the resolved file remains inside HANDOFF_DIR.

pathlib.Path does not automatically prevent traversal. A value containing parent-directory components can therefore escape ~/.sumo/handoffs. The mandatory .jsonl suffix limits accessible targets to filenames ending in that suffix, and the selected file must contain valid line-delimited JSON for parsing to succeed, but these restrictions do not eliminate the unauthorized read.

For example, a value conceptually equivalent to ../../shared/records causes the application to attempt to open:

text

~/.sumo/handoffs/../../shared/records.jsonl

Attack Path

1. An attacker obtains the ability to supply or influence the --date command-line argument.
2. The attacker provides a value containing ../ traversal components.
3. The application combines that value with HANDOFF_DIR and appends .jsonl.
4. The operating system resolves the traversal components to a location outside the intended handoff directory.
5. If the target is readable and contains compatible JSONL records, the application parses it.
6. Selected values from those records are printed to standard output.

Impact A

...[truncated 573 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the input with datetime.strptime(date_str, "%Y-%m-%d") and reject invalid values.
• Reformat the parsed date into a canonical YYYY-MM-DD string before constructing the filename.
• Resolve both the base directory and candidate file, then verify that the candidate is a descendant of the base directory.
• Reject path separators, parent-directory components, absolute paths, and unexpected filename characters.
• Handle malformed JSON and file-access failures without exposing unnecessary filesystem details.

Example hardening approach:

python

def validate_date(date_str):
    parsed = datetime.strptime(date_str, "%Y-%m-%d")
    return parsed.strftime("%Y-%m-%d")

safe_date = validate_date(date_str)
base = HANDOFF_DIR.resolve()
daily_file = (base / f"{safe_date}.jsonl").resolve()

if daily_file.parent != base:
    raise ValueError("The requested file is outside the handoff directory")

T09 · Insecure Skill Coding Practices

Note

• Location: handoff_writer.py:39

Finding

Persistent Sensitive Data Created Without Explicit Owner-Only Permissions

Content

View full analysis

Vulnerability Details

File Location: handoff_writer.py, lines 39–99
Vulnerability Type: Insecure plaintext storage and insufficiently explicit filesystem permissions
Risk Level: Low

Vulnerable Code

python

HANDOFF_DIR.mkdir(parents=True, exist_ok=True)

python

"context_snapshot": {
    "working_dir": working_dir or "",
    "last_modified_files": last_modified_files or []
},

python

with open(daily_file, 'a', encoding='utf-8') as f:
    f.write(json.dumps(handoff, ensure_ascii=False) + '\n')

Technical Analysis

The writer persistently records task summaries, artifact paths, future requirements, working directories, and modified-file names in plaintext JSONL files under ~/.sumo/handoffs.

The directory is created without an explicit owner-only mode, and the daily file is opened without explicitly setting restrictive permissions. Effective permissions therefore depend on the runtime environment and the user's umask. On a system with a permissive umask, other local users may be able to inspect stored operational metadata.

Existing files are also trusted without checking their type, ownership, permissions, or symlink status. This increases the risk when the handoff directory or its contents can be modified by another local principal.

Attack Path

1. A user invokes the writer with sensitive information in fields such as summary, artifacts, next_requirements, working_dir, or last_modified_files.
2. The program stores those values in plaintext under ~/.sumo/handoffs.
3. The process creates the directory and files according to ambient permission settings rather than enforcing owner-only access.
4. In a permissively configured multi-user environment, another local user reads the handoff records.
5. The local user obtains operational metadata, filesystem paths, task descriptions, or accidentally recorded secrets.

Impact Assessment

The issu ...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

• Create HANDOFF_DIR with owner-only permissions, such as mode 0700.
• Create new registry and JSONL files with mode 0600, using secure creation flags where possible.
• Verify and repair permissions on existing directories and files before use.
• Refuse to write through symbolic links and verify that target files are regular files owned by the expected user.
• Document that handoff records are persistent plaintext and must not contain passwords, access tokens, private keys, or other secrets.
• Consider field-level redaction or encryption when sensitive operational context must be retained.
• Use atomic replacement and file locking for registry updates to reduce corruption and race-condition risks.

Example permission hardening:

python

HANDOFF_DIR.mkdir(parents=True, exist_ok=True, mode=0o700)
os.chmod(HANDOFF_DIR, 0o700)

fd = os.open(
    daily_file,
    os.O_WRONLY | os.O_CREAT | os.O_APPEND,
    0o600,
)
with os.fdopen(fd, "a", encoding="utf-8") as f:
    f.write(json.dumps(handoff, ensure_ascii=False) + "\n")

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code accesses handoff logs under the user's home directory and later prints fields such as task labels, agent names, statuses, and output summaries to stdout. Although the file is a reader, there is no disclosure in the module docstring, comments, or CLI help that running it may reveal potentially sensitive operational data from local logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's user-facing documentation and help text are written exclusively in Traditional Chinese, and generated agent names also append Chinese text, which implies a fixed locale experience. There is no indication that language choice is optional or that the tool is intentionally region-specific, so this may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script persists structured handoff records containing task IDs, summaries, working directory paths, and modified file lists into predictable files under ~/.sumo/handoffs without any warning, consent flow, retention controls, or permission hardening. In an agent skill context, this can leak sensitive workspace and operational metadata to other local users, backup systems, or later processes that read the home directory, making the issue materially more dangerous than ordinary logging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, headings, and parameter descriptions are presented only in Traditional Chinese, which can force a specific language on users without opt-in. The policy allows language constraints only when users are offered a choice or when the limitation is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that it writes handoff logs to a persistent path under the user's home directory, but the documentation does not warn users about the persistence, retention, or sensitivity of data written there. This can lead to accidental storage of task details, summaries, artifacts, or next-step instructions that may contain sensitive information, especially in multi-agent or shared environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The user-facing documentation and console messages are written entirely in Traditional Chinese, which imposes a specific language/locale without any opt-in or alternative. Under the stated policy, a skill should not force a specific language unless it is explicitly justified or the user is given a choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.