Security audit

Code Snippet

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local code-snippet manager; it has some disclosure and hardening gaps, but its file storage, search, delete, and optional clipboard behavior fit its stated purpose.

Install only if you are comfortable with snippets being stored in plaintext at ~/.code_snippets.json. Avoid saving secrets or credentials, check that the file is owner-readable only, and be aware that delete has no confirmation or undo and --copy writes snippet text to the system clipboard.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/snippet.py:9
Finding: Snippet Data Stored Without Explicitly Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description does not fully disclose persistent local file storage and clipboard-writing behavior, while also claiming highlighting that is not implemented. Undisclosed persistence and clipboard access are security-relevant because they can expose sensitive code snippets, overwrite user clipboard contents, or surprise users with side effects outside the stated purpose.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell usage and implies local file read/write through example commands, but it declares no explicit tool scope such as allowed-tools or permissions. This increases the chance the skill will be invoked with broader-than-necessary capabilities and makes it harder for reviewers and users to understand what local access the skill requires.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase "snippet" is overly broad in a developer context and may cause accidental activation during normal coding conversations. If the skill has file, shell, or clipboard side effects, unintended activation can lead to unexpected local actions or exposure of stored content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger phrase "代码库" is ambiguous and commonly used to mean a general code repository or codebase, so it may match unrelated requests. In this skill's context, that can route ordinary development queries into a stateful local-storage tool with side effects not expected by the user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script's title, help text, and runtime messages are consistently presented in Chinese, and there is no option for users to select another language or indication that the tool is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is described as a code snippet collection and search tool, but the get command can spawn an external program (xclip) via subprocess.run to manipulate the system clipboard. Launching subprocesses is not an obvious or necessary capability for a snippet storage/search skill as described in the manifest.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/snippet.py (reported line 95)May include surrounding context.
python
if args.copy: try: import subprocess subprocess.run(["xclip", "-selection", "clipboard"], input=snippet["code"].encode(), check=True) print("✅ 已复制到剪贴板") except:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The delete handler removes entries and immediately saves the modified collection back to the user's snippet file, which is a user-data-affecting operation. While it prints a success message afterward, there is no prior confirmation, warning comment/docstring, or other disclosure that the command performs irreversible deletion.
Content: No source excerpt is available for this finding.