T09 · Insecure Skill Coding Practices
Error
- Location
preinstall-check.sh:16- Finding
Allowlist validation can be bypassed through skill-name impersonation or regular-expression injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Security Scanner
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed security scanner, but its install-check controls can be bypassed and it makes persistent blocklist changes, so it should be reviewed before use.
Install only if you are comfortable treating this as an advisory scanner, not a reliable enforcement gate. Do not rely on its allowlist as proof a skill is safe, review any blocklist changes it makes, and prefer a scanner that binds approvals to content hashes and fails closed on scan errors.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
audit.sh:28- Finding
Option-like target paths can alter grep behavior and cause incomplete scans
- Content
View full analysis
/dev/null || true) ``` The resulting empty counters are later treated as a successful clean scan: ```bash if [ $CRITICAL -eq 0 ] && [ $HIGH -eq 0 ] && [ $MEDIUM -eq 0 ]; then echo -e "${GREEN}✅ CLEAN - No security issues found${NC}" exit 0 fi ``` ### Technical Analysis `SKILL_PATH` is controlled by the caller and is passed to `grep` without a `--` option terminator. On implementations such as GNU grep, a relative path beginning with `-` can be interpreted as a command-line option instead of a file or directory to scan. The command also discards diagnostics and converts every grep failure into a successful shell result through `2>/dev/null || true`. The scanner therefore cannot distinguish between “no pattern matched” and “the target was not scanned correctly.” If all checks fail or inspect no files, the finding counters remain zero and the script reports the target as clean. ### Attack Path 1. Create or reference a skill through an option-like relative path beginning with `-`. 2. Pass that value as the audit target. 3. `grep` interprets the target as an option rather than as the intended directory. 4. Any resulting diagnostic is suppressed, and `|| true` prevents the failure from stopping the audit. 5. No finding counter is incremented. 6. The final branch can report `CLEAN` even though the intended skill contents were not successfully scanned. ### Impact Assessment The issue permits alteration or evasion of the static scan when an attacker can influence the target path. It does not directly execute attacker-supplied commands or elevate operating-system privileges. Its security impact is the loss of scan integrity: prohibited behavior may remain undetected and an unscanned skill may receive a ...[truncated 22 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
audit.sh:28- Finding
Recursive scan omits content referenced through symbolic links
- Content
View full analysis
/dev/null || true) ``` ### Technical Analysis The scanner relies on recursive `grep -r` and does not separately enumerate, reject, or resolve symbolic links. Recursive grep generally does not follow symbolic links encountered while traversing a directory. Consequently, a symlink contained inside a submitted skill can reference executable code or instructions that are not included in the scan. The script also suppresses traversal diagnostics, so omitted or inaccessible entries do not make the audit fail. If a later skill loader follows those links, the effective skill content can differ from the content inspected by the scanner. ### Attack Path 1. Create a skill directory containing apparently benign regular files. 2. Add an internal symbolic link that points to a file or directory containing a prohibited behavior. 3. Submit the containing skill directory to `audit.sh`. 4. Recursive grep omits the linked target while traversing the directory. 5. The scanner reports no finding for the linked content. 6. A subsequent loader or interpreter follows the symlink and consumes or executes the uninspected content. ### Impact Assessment An attacker can conceal relevant code or instructions from the static scanner and create a discrepancy between audited and consumed content. The flaw does not itself follow or execute the symlink and does not independently escalate privileges. The eventual scope depends on how the consuming agent handles symlinks and on the privileges available when the linked content is loaded or executed. ]]>- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh check_pattern "Network Exfiltration" "HIGH" "(requests\.post|requests\.put|urllib\.request\.urlopen|http\.client\.HTTPConnection|fetch\([^)]+{)" check_pattern "Credential File Access" "HIGH" "(open\([^)]*\.(ssh|aws|gnupg|config)|read.*id_rsa|read.*credentials)" check_pattern "Password Store Access" "HIGH" "subprocess\.(run|call|Popen).*pass\s+(show|insert)" check_pattern "Keyring/Keychain Access" "HIGH" "(keyring\.get|SecItemCopyMatching|security find-generic-password)" check_pattern "Shell Command Injection" "HIGH" "(os\.system\(|subprocess\.[^(]+\([^)]*shell=True.*\+)" # MEDIUM checks
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh check_pattern "Network Exfiltration" "HIGH" "(requests\.post|requests\.put|urllib\.request\.urlopen|http\.client\.HTTPConnection|fetch\([^)]+{)" check_pattern "Credential File Access" "HIGH" "(open\([^)]*\.(ssh|aws|gnupg|config)|read.*id_rsa|read.*credentials)" check_pattern "Password Store Access" "HIGH" "subprocess\.(run|call|Popen).*pass\s+(show|insert)" check_pattern "Keyring/Keychain Access" "HIGH" "(keyring\.get|SecItemCopyMatching|security find-generic-password)" check_pattern "Shell Command Injection" "HIGH" "(os\.system\(|subprocess\.[^(]+\([^)]*shell=True.*\+)" # MEDIUM checks
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh check_pattern "Network Exfiltration" "HIGH" "(requests\.post|requests\.put|urllib\.request\.urlopen|http\.client\.HTTPConnection|fetch\([^)]+{)" check_pattern "Credential File Access" "HIGH" "(open\([^)]*\.(ssh|aws|gnupg|config)|read.*id_rsa|read.*credentials)" check_pattern "Password Store Access" "HIGH" "subprocess\.(run|call|Popen).*pass\s+(show|insert)" check_pattern "Keyring/Keychain Access" "HIGH" "(keyring\.get|SecItemCopyMatching|security find-generic-password)" check_pattern "Shell Command Injection" "HIGH" "(os\.system\(|subprocess\.[^(]+\([^)]*shell=True.*\+)" # MEDIUM checks
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger conditions are very broad and include generic security-related workflows such as skill audit, security scan, and before loading external skill. A broadly auto-triggered skill that suggests shell execution and includes promotional external links can become an over-invoked component in sensitive contexts, increasing the chance of unintended execution, user confusion, or abuse as a socially trusted security authority.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script is presented as an audit tool, but on CRITICAL findings it also mutates local state by appending entries to a blocklist file. This side effect can surprise users and downstream automation, and it creates an enforcement mechanism that may persist beyond the current scan without explicit consent.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The usage/header comments describe a passive audit script, but the implementation performs enforcement-like persistence by maintaining a blocklist. That mismatch can mislead operators about side effects, which is a security-relevant transparency issue in tooling that may be run automatically.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Appending to a local blocklist without user-facing warning or confirmation introduces an undocumented persistent state change. In automated or shared environments this can cause denial of use, audit confusion, or policy drift if entries are added unexpectedly.
- Content
Static analysis
No suspicious patterns detected.