Security audit

MD Formatter

Security checks for vulnerabilities and agentic risk

Overview

This markdown formatter is purpose-aligned, but its in-place formatting script can unexpectedly change content, so users should review diffs before relying on it.

Use this only on intended markdown files, preferably under version control or with a backup. Review the diff after running it, and avoid using it on sensitive, generated, or code-heavy documents until it has dry-run support and better Markdown parsing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: `. 3. The formatter processes all content as ordinary Markdown, including protected contexts such as fenced and inline code. 4. The global transformations change semantically meaningful content. 5. `Path.write_text()` overwrites the original file without presenting a diff, preserving a backup, or requesting confirmation. 6. The corrupted commands, code, or configuration may subsequently be copied, executed, published, or consumed by another system. ### Impact Assessment This issue does not provide privile ...[truncated 740 chars]:11
Finding: Context-Insensitive In-Place Rewriting Can Corrupt User-Controlled Files
Content: View full analysis
0: result.append(f"\n{line}\n" if i < len(lines) - 1 else line) continue if line.startswith("#"): level = len(line) - len(line.lstrip("#")) if level > current_level + 1: line = "#" * (current_level + 1) + line[level:] current_level = level result.append(line) return "\n".join(result) def fix_emphasis(text): """Prefer **bold** over __bold__, *italic* over _italic_.""" text = re.sub(r"\*\*(.+?)\*\*", r"**\1**", text) # already atx bold text = re.sub(r"__(.+?)__", r"**\1**", text) text = re.sub(r"_(.+?)_", r"*\1*", text) return text ``` ```python path = Path(sys.argv[1]) if not path.exists(): print(f"Error: {path} not found") sys.exit(1) text = path.read_text(encoding="utf-8") original = text text = fix_emphasis(text) text = fix_headings(text) text = fix_trailing_whitespace(text) text = fix_blank_lines(text) if text != original: path.write_ ...[truncated 2721 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to read and modify user-specified markdown files, which implies file read/write capability, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap: the agent may apply broader filesystem access than intended, increasing the risk of unintended file disclosure or modification if the skill is invoked on sensitive or attacker-influenced paths.
Content: No source excerpt is available for this finding.

Tainted flow: 'text' from pathlib.Path.read_text (line 79, file read) → pathlib.Path.write_text (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/format_md.py (reported line 82)May include surrounding context.
python
text = fix_blank_lines(text) if text != original: path.write_text(text, encoding="utf-8") print(f"Formatted: {path}") else: print(f"No changes needed: {path}")