Web Research Brief

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:15 AM UTC
• Version: 0.1.0

Overview

This is a straightforward research workflow skill with minor caution around broad activation wording and an unsafe helper script temp-directory pattern.

Installing this skill is reasonable if you want an agent to perform web research with citations. Be aware it may activate for broad research-like phrases, and avoid running the included shell helper with untrusted topic strings unless its temporary directory handling is hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/research_quick.sh:5

Finding

Path Traversal Through Unsanitized Topic in Output Directory Construction

Content

View full analysis

Vulnerability Details

File Location: scripts/research_quick.sh, lines 5–9
Vulnerability Type: User-controlled path traversal and unsafe temporary directory handling
Risk Level: Medium

Vulnerable Code

bash

set -euo pipefail

TOPIC="${1:?Usage: research_quick.sh TOPIC [FRESHNESS]}"
FRESHNESS="${2:-month}"
OUTDIR="/tmp/research-$(echo "$TOPIC" | tr ' ' '_' | head -c 40)"
mkdir -p "$OUTDIR"

Technical Analysis

The script incorporates the user-supplied TOPIC directly into a filesystem path. Its only normalization replaces spaces with underscores; it does not reject directory separators, .. path components, control characters, or symbolic-link interactions.

Although the final variable is quoted and therefore is not vulnerable to shell word splitting or direct command injection, quoting does not prevent filesystem path traversal. A topic containing slash-separated parent-directory components can cause the resolved path to leave the intended /tmp/research-* namespace.

The use of a predictable path under the shared /tmp directory also permits collisions with pre-existing paths. An attacker able to create entries in /tmp may prepare directories or symbolic links that influence where mkdir -p resolves subsequent path components.

Attack Path

1. An attacker supplies a crafted topic containing path separators and parent-directory components, for example:

   bash

   ./scripts/research_quick.sh 'foo/../../../var/tmp/attacker-dir'
   

2. The script constructs the following path:

   text

   /tmp/research-foo/../../../var/tmp/attacker-dir
   

3. mkdir -p resolves the .. components and attempts to create the resulting directory outside the intended research output location.

4. Directory creation succeeds wherever the account running the script has write permission. If the script is invoked by a more privileged account, the writable scope increases accordin ...[truncated 1216 chars]

Remediation

View remediation

Remediation Suggestions

Avoid deriving a temporary directory path directly from user input. Create an unpredictable directory under a fixed trusted base using mktemp:

bash

set -euo pipefail

TOPIC="${1:?Usage: research_quick.sh TOPIC [FRESHNESS]}"
FRESHNESS="${2:-month}"
OUTDIR="$(mktemp -d -- /tmp/research-XXXXXXXXXX)"

If a human-readable topic must appear in the directory name, apply strict allowlist validation and retain an unpredictable suffix:

bash

SAFE_TOPIC="$(printf '%s' "$TOPIC" |
  LC_ALL=C tr -cd 'A-Za-z0-9._-' |
  cut -c1-40)"

[[ -n "$SAFE_TOPIC" ]] || SAFE_TOPIC="topic"
OUTDIR="$(mktemp -d -- "/tmp/research-${SAFE_TOPIC}-XXXXXXXXXX")"

Additional hardening should include:

1. Explicitly reject /, backslashes, .. path components, newlines, and other control characters when accepting a topic for use in a filename.
2. Use a dedicated base directory with restrictive permissions rather than a predictable path directly under shared /tmp.
3. Set a restrictive umask, such as umask 077, before creating temporary resources.
4. If constructing paths remains necessary, resolve and verify the canonical destination before use, ensuring it remains beneath the approved base directory.
5. Do not run the script with elevated privileges when its arguments can be influenced by an untrusted user.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is broad and includes common phrases like "find out about," "compare," and "what's the latest on," which can appear in ordinary conversations unrelated to an explicit request for a research workflow. This can cause unintended skill activation, leading the agent to perform web searches or fetch external content when a simpler or safer response would have been more appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.