Security audit

GOG Stale Games Cleaner

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent and disclosed, but its script has unsafe environment-variable handling that can lead to command execution and email-header manipulation.

Review this skill before installing or running it. Use dry-run first, only run it in a trusted environment, and avoid passing untrusted values through STALE_DAYS or EMAIL_TO. The publisher should validate numeric configuration and email recipients before this is treated as low risk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gog-stale-scan.sh:25
Finding: Shell Command Execution Through Unvalidated STALE_DAYS Arithmetic Expression
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi if (( 10#$STALE_DAYS < 1 || 10#$STALE_DAYS > 36500 )); then echo "Invalid STALE_DAYS: value is outside the allowed range" >&2 exit 1 fi CUTOFF_EPOCH=$(( $(date +%s) - 10#$STALE_DAYS * 86400 )) ``` The `10#` prefix forces decimal interpretation and avoids unexpected octal handling for values with leading zeroes. Validation must occur before the variable is referenced inside any arithmetic expansion. Apply the same allow-list approach to every environment-controlled value that may enter shell arithmetic or command syntax. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gog-stale-scan.sh:75
Finding: Email Header Injection Through Unvalidated EMAIL_TO Configuration
Content: View full analysis
"$TMPFILE" </dev/null | grep -A1 "$EMAIL_ACCOUNT" | tail -1 | awk '{print $NF}' || echo "") ${TO_HEADER} Subject: ${SUBJECT} Content-Type: text/html ${HTML_BODY} HEREDOC ``` ### Technical Analysis `EMAIL_TO` is accepted from the environment and interpolated directly into the header section of an MML email template. The script does not reject carriage-return or newline characters and does not parse the value as a single structured mailbox address. A crafted value containing a line break can terminate the intended `To` header and introduce additional headers such as `Bcc`, `Cc`, or altered MIME metadata. Depending on Himalaya's template parser, an attacker may also be able to modify the boundary between headers and the message body. The temporary file itself is created with `mktemp`, which mitigates predictable-file and symlink attacks. The vulnerability arises from unsafe construction of the message contents, not from the temporary filename. ### Attack Path 1. An attacker gains control over the `EMAIL_TO` environment variable used for a non-dry-run invocation. 2. The attacker provides a value containing a newline followed by an additional email header, such as an unintended recipient header. 3. The script copies the value verbatim into `TO_HEADER`. 4. The generated MML template contains the attacker-supplied header. 5. `himalaya template send` parses and sends the manipulated message. 6. The stale-game report may be delivered to an unintended recipient or have its message metadata altered. ### Impact Assessment The report contains the user's insta ...[truncated 536 chars]
Remediation: View remediation
&2 exit 1 fi ``` Additionally: 1. Validate that the value represents exactly one permitted mailbox address. 2. Prefer a structured Himalaya recipient option or API over manually assembling raw message headers. 3. If raw templates are unavoidable, serialize all headers through a library or tool that performs standards-compliant encoding and prevents header-boundary injection. 4. Consider requiring an explicitly configured recipient rather than deriving routing behavior from loosely controlled environment data. 5. Test malicious values containing CR, LF, CRLF, `Bcc:`, `Cc:`, and blank lines to verify that they are rejected before the email template is created or sent. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill’s stated purpose is cleanup-oriented, but its documented behavior includes sending library-derived data through an external email account and creating Apple Reminders entries, which are actions against external services with privacy and side-effect implications. Even though these behaviors are described later in the document, the top-level declaration does not clearly communicate the permission-sensitive operations, increasing the risk of users or agents invoking it without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description does not prominently warn that a normal run will transmit game-usage information by email and create reminder items automatically. This can lead to unintended disclosure of personal activity data and unexpected state changes in linked services, especially when an agent chooses the skill based only on its short description.
Content: No source excerpt is available for this finding.