Security audit

my-content-organizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a file organizer, but it needs review because it can broadly move or overwrite files and its hidden-file safety note is inaccurate.

Install only if you are comfortable reviewing the dry run carefully and running it in a directory you explicitly choose. Avoid using it on project roots, home directories, or folders containing dotfiles or important existing category folders unless the move commands are revised to exclude hidden files, reject symlinks, and prevent overwrites.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:71
Finding: Existing destination files can be silently overwritten
Content: View full analysis
/dev/null;; pdf|doc|docx|txt|md|rtf|odt|xps) mv "$f" documents/ 2>/dev/null;; xls|xlsx|csv|tsv|ods) mv "$f" spreadsheets/ 2>/dev/null;; zip|tar|gz|bz2|7z|rar) mv "$f" archives/ 2>/dev/null;; py|js|ts|html|css|json|yaml|yml|sh|rb) mv "$f" code/ 2>/dev/null;; mp3|mp4|wav|flac|mkv|mov|avi) mv "$f" media/ 2>/dev/null;; *) mv "$f" other/ 2>/dev/null;; esac done ``` ### Technical Analysis The execution phase invokes `mv` without a no-clobber option or an explicit destination-collision check. If a category directory already contains a file with the same basename as a source file, standard non-interactive `mv` behavior can replace the destination file. The documented dry run only reports the target category and does not determine whether the final destination path already exists. In addition, `2>/dev/null` suppresses diagnostic messages, making move failures and other abnormal behavior less visible to the user. ### Attack Path 1. Create or identify an existing file such as `images/photo.jpg`. 2. Place a different top-level file named `photo.jpg` in the workspace. 3. Run the documented organization procedure. 4. The image branch executes `mv "./photo.jpg" images/`. 5. The existing `images/photo.jpg` can be replaced by the top-level file without a collision warning. ### Impact Assessment This issue can cause irreversible loss or replacement of files already stored in category directories. An attacker able to place a same-named source file in the worksp ...[truncated 332 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:48
Finding: Pre-existing category symlinks can redirect file moves outside the workspace
Content: View full analysis
/dev/null;; pdf|doc|docx|txt|md|rtf|odt|xps) mv "$f" documents/ 2>/dev/null;; xls|xlsx|csv|tsv|ods) mv "$f" spreadsheets/ 2>/dev/null;; zip|tar|gz|bz2|7z|rar) mv "$f" archives/ 2>/dev/null;; py|js|ts|html|css|json|yaml|yml|sh|rb) mv "$f" code/ 2>/dev/null;; mp3|mp4|wav|flac|mkv|mov|avi) mv "$f" media/ 2>/dev/null;; *) mv "$f" other/ 2>/dev/null;; esac done ``` ### Technical Analysis The procedure assumes that `images`, `documents`, and the other category paths are genuine directories beneath the selected workspace. It does not reject symbolic links or validate the canonical destination paths. `mkdir -p` does not safely establish ownership of a path when that path already resolves to an existing directory through a symbolic link. The subsequent `mv "$f" category/` operation follows the category path. A pre-existing category symlink can therefore redirect files to another directory writable by the current user. Combined with the lack of collision protection, redirected files may also overwrite same-named files at the symlink target. ### Attack Path 1. An attacker with write access to the workspace creates a category symlink, for example: `images -> /path/to/another/writable/directory`. 2. The victim places or already has a top-level image file in the workspace. 3. The victim follows the Skill instructions and runs `mkdir -p` followed by the move loop. 4. The procedure does n ...[truncated 707 chars]
Remediation: View remediation
/dev/null`. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
[ "$f" = "./SKILL.md" ] && continue

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use the skill when the workspace is cluttered, downloads need sorting, screenshots need cleanup, or files need organizing for backup, which are broad situations rather than narrowly scoped activation criteria. These phrases could match many ordinary user requests and there are no exclusion conditions or negative examples to limit unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Examples like "Organize my workspace," "Where did my screenshots go?" and "Downloads folder is a mess" are broad, conversational phrases that can arise in normal dialogue without clearly indicating that automatic file-moving behavior should be invoked. The section does not define when the skill should not activate, increasing the risk of accidental use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill provides a bulk file-move command that modifies user files in place, but it does not present a prominent safety warning or require explicit confirmation before execution. In an agentic setting, that increases the risk of unintended file reorganization, disruption of project layouts, and accidental movement of important files when the workspace context is misunderstood.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The notes claim hidden files are skipped, but find . -maxdepth 1 -type f will also return top-level dotfiles such as .env, .gitignore, and shell config files. This mismatch can cause sensitive or operationally important hidden files to be silently moved into category folders, potentially breaking tooling or exposing secrets during later sharing or backup.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The Notes section explicitly states 'Always dry run first — never skip the preview step,' which communicates an intent of mandatory preview-before-change behavior. However, the execution commands at L69-L85 can be run independently and contain no guard or confirmation that a dry run actually occurred, so the documented intent is not enforced by the code examples.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.