Agent Rate Limiter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:29 PM UTC
• Version: 1.3.1

Overview

This is a coherent local rate-limit tracker that stores usage estimates in a JSON file, with no hidden network, credential, or unrelated destructive behavior found.

Install only if you want your agent to self-throttle based on heuristic local tracking. Use a private, per-instance RATE_LIMIT_STATE path, avoid shared writable directories, and understand that reset removes the skill's recorded usage history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rate-limiter.py:203

Finding

Predictable Temporary File Allows Symlink-Based File Truncation

Content

View full analysis

Vulnerability Details

File Location: scripts/rate-limiter.py, lines 203-210
Vulnerability Type: Predictable temporary file and unsafe symbolic-link handling
Risk Level: Medium

Vulnerable Code:

python

def save_state(state):
    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
    tmp = STATE_PATH.with_suffix(".tmp")
    # Write with restricted permissions (0o600)
    fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
    with os.fdopen(fd, "w") as f:
        f.write(json.dumps(state, indent=2) + "\n")
    tmp.rename(STATE_PATH)

Technical Analysis

The state-saving operation always uses a predictable temporary path derived from STATE_PATH. For the default rate-limit-state.json state file, the temporary file is rate-limit-state.tmp.

The temporary path is opened with O_CREAT | O_TRUNC, but without protections such as O_EXCL or O_NOFOLLOW. Consequently, if an attacker can write to the state directory, they can pre-create the temporary path as a symbolic link to another file. When the rate limiter next saves its state, os.open() follows that symbolic link, truncates the linked target, and writes JSON state data into it.

The application-level lock does not prevent this attack because it coordinates cooperating rate-limiter processes through a separate .lock file; it does not stop another local process from creating or replacing the predictable temporary path.

Attack Path

1. The attacker obtains write access to the directory containing the configured state file.
2. The attacker predicts the temporary filename by replacing the state file suffix with .tmp.
3. The attacker creates that path as a symbolic link to a target file writable by the rate-limiter process.
4. A user or automated process invokes any command that saves state, such as gate, record, status, pause, resume, set-limit, or reset.
5. os.open() follows the maliciou ...[truncated 978 chars]

Remediation

View remediation

Remediation Suggestions

• Create a randomized temporary file in the same directory as the destination by using tempfile.NamedTemporaryFile or tempfile.mkstemp.
• Open the temporary file with exclusive-creation and symbolic-link protections where supported, including O_CREAT, O_EXCL, and O_NOFOLLOW.
• Verify that the created object is a regular file with os.fstat() before writing.
• Preserve restrictive permissions such as mode 0600.
• Flush Python buffers and call os.fsync() before replacement to improve crash safety.
• Atomically install the completed state using os.replace().
• Optionally verify that the state directory is not writable by untrusted users.

Example hardened implementation:

python

import tempfile
import stat

def save_state(state):
    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)

    fd, tmp_name = tempfile.mkstemp(
        prefix=f".{STATE_PATH.name}.",
        suffix=".tmp",
        dir=str(STATE_PATH.parent),
    )

    try:
        os.fchmod(fd, 0o600)

        file_info = os.fstat(fd)
        if not stat.S_ISREG(file_info.st_mode):
            raise OSError("Temporary state path is not a regular file")

        with os.fdopen(fd, "w") as f:
            fd = -1
            f.write(json.dumps(state, indent=2) + "\n")
            f.flush()
            os.fsync(f.fileno())

        os.replace(tmp_name, STATE_PATH)
    finally:
        if fd != -1:
            os.close(fd)
        try:
            os.unlink(tmp_name)
        except FileNotFoundError:
            pass

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents and encourages execution of a Python script that reads environment variables, writes a JSON state file, and invokes external commands, but it does not declare any explicit tool scope or permissions in the manifest. This creates a trust and least-privilege gap: an agent or reviewer cannot tell up front what capabilities the skill expects, increasing the chance of over-broad execution in environments where file, env, or network access should be constrained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The markdown explains that python3 scripts/rate-limiter.py reset clears all history, but this warning appears only in a troubleshooting subsection rather than near the primary command listing where users first learn about reset. Because reset is a destructive operation affecting persisted state, the skill description should more prominently disclose that it deletes recorded usage history.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:147