File Auto Organizer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:40 AM UTC
• Version: 1.0.0

Overview

This file-organizer is mostly purpose-aligned, but it can move user files without preview or confirmation and has a collision bug that may overwrite existing files.

Review before installing. Only run it on folders you are prepared to reorganize, test it on a copy first, and avoid important directories until it adds preview/dry-run behavior and safer collision handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/organizer.py:52

Finding

Existing Files Can Be Overwritten During Type-Based Organization

Content

View full analysis

Vulnerability Details

File Location: scripts/organizer.py, lines 52–58
Vulnerability Type: Unsafe destination collision handling
Risk Level: Medium

Vulnerable Code

python

target_dir = folder / category

if not target_dir.exists():
    target_dir.mkdir(exist_ok=True)

new_path = target_dir / item.name
# Avoid overwriting files with the same name
if new_path.exists():
    new_path = target_dir / f"{item.stem}_{item.suffix}"

shutil.move(str(item), str(new_path))

Technical Analysis

The code checks whether the original destination exists, but its fallback destination is not checked for another collision. For a source file named report.txt, the fallback expression produces report_.txt. If both Documents/report.txt and Documents/report_.txt already exist, the program still passes the occupied fallback path to shutil.move.

On platforms where the underlying move or rename operation replaces an existing destination, this silently overwrites Documents/report_.txt. On platforms that reject replacement, the operation can instead fail and interrupt organization. The existence check and move are also separate operations, so another process could create the destination between them.

Attack Path

1. The victim selects a directory containing a source file named report.txt.
2. The directory already contains Documents/report.txt.
3. The directory also contains Documents/report_.txt, which holds data the victim wants to preserve.
4. The victim runs:

   bash

   python3 scripts/organizer.py by-type /path/to/directory
   

5. The organizer detects the first collision and selects Documents/report_.txt.
6. Because it does not verify that fallback path, shutil.move may replace the existing fallback file.

An attacker who can create files in the selected directory can prepare this collision layout, but exploitation does not require an attacker: ordinary repeated org ...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

Generate and validate candidate names until a free destination is found:

python

new_path = target_dir / item.name
counter = 1

while new_path.exists():
    new_path = target_dir / f"{item.stem}_{counter}{item.suffix}"
    counter += 1

shutil.move(str(item), str(new_path))

Where supported, use an atomic no-replace operation to prevent a time-of-check/time-of-use race. If atomic no-replace semantics are unavailable, catch destination-collision errors and retry with a new candidate. The application should also log every final source and destination and clearly report failures instead of silently replacing files.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/organizer.py:106

Finding

Existing Files Can Be Overwritten During Date-Based Organization

Content

View full analysis

Vulnerability Details

File Location: scripts/organizer.py, lines 106–111
Vulnerability Type: Unsafe destination collision handling
Risk Level: Medium

Vulnerable Code

python

target_dir = folder / target
if not target_dir.exists():
    target_dir.mkdir(exist_ok=True)

new_path = target_dir / item.name
if new_path.exists():
    new_path = target_dir / f"{item.stem}_{item.suffix}"

shutil.move(str(item), str(new_path))

Technical Analysis

Date-based organization uses the same incomplete collision strategy as type-based organization. It verifies only the original destination and then constructs a single fallback name without checking whether that fallback already exists.

For example, if Today/photo.jpg exists, a source file named photo.jpg is redirected to Today/photo_.jpg. If that fallback also exists, shutil.move may replace it on platforms with replacement semantics. The check and move are not atomic, which additionally permits another local process to create or replace the destination after the check.

Attack Path

1. The victim selects a directory containing photo.jpg whose modification time classifies it as Today.
2. Today/photo.jpg already exists.
3. Today/photo_.jpg also exists and contains data the victim wants to retain.
4. The victim runs:

   bash

   python3 scripts/organizer.py by-date /path/to/directory
   

5. The program selects the occupied fallback Today/photo_.jpg.
6. The move operation may overwrite that existing file.

A local attacker with write access to the selected directory could deliberately arrange these names. The same data-loss condition can also arise unintentionally through normal repeated use.

Impact Assessment

Successful exploitation destroys or replaces files inside the generated date directories, including Today, Yesterday, This Week, This Month, and Older. The operation runs with the invoking user ...[truncated 176 chars]

Remediation

View remediation

Remediation Suggestions

Replace the single fallback with a loop that generates unique names, preserving the extension correctly:

python

new_path = target_dir / item.name
counter = 1

while new_path.exists():
    new_path = target_dir / f"{item.stem}_{counter}{item.suffix}"
    counter += 1

shutil.move(str(item), str(new_path))

Prefer an atomic move operation with no-replace semantics and retry if a concurrent collision occurs. Add explicit exception handling so a collision or filesystem error cannot terminate the entire organization operation without a clear report. Automated tests should cover cases where the original destination and multiple numbered fallback names already exist.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises optional duplicate-file deletion but does not present any explicit safety warning, confirmation requirement, or description of how duplicates are determined. In a file-management context, deletion is destructive and mistakes can permanently remove user data or delete non-identical files that only appear similar under weak matching logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description, triggers, and usage guidance are entirely in Chinese, which imposes a specific language/locale without any opt-in or justification that the skill is region-specific. Under the stated policy, language constraints should either be optional for the user or clearly documented as necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are very broad and map to common user requests such as organizing files or cleaning the desktop. This can cause the skill to activate in situations where a user did not specifically intend to invoke it, increasing the chance of unintended file operations in a destructive domain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code moves user files into newly created category subfolders, which changes the folder layout and can be disruptive or hard to reverse, but there is no confirmation prompt before the operation. Although the script prints a completion message afterward, it does not disclose the upcoming modification in a docstring, comment, or user-facing pre-action warning at the point of execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This branch moves files into date-based subfolders, which is a safety-relevant file write/reorganization operation, but the script does not ask the user to confirm or clearly warn that files will be relocated before doing so. The post-action success output is not sufficient disclosure because it appears only after the changes are already made.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script presents user-facing text in Chinese across help and status messages while the top-level description is in English, effectively imposing a locale without any explicit user opt-in or language selection. This can violate language-choice policy where tools should not force a specific language unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.