T09 · Insecure Skill Coding Practices
Error
- Location
canary.py:97- Finding
Protected Path Controls Can Be Bypassed Through Symbolic Links
- Content
View full analysis
- Remediation
View remediation
Security audit
Canary
Security checks for vulnerabilities and agentic risk
Overview
This security-monitoring skill is not clearly malicious, but its protection claims are stronger than the implementation and it can store sensitive command or path data in plaintext logs.
Install only if you treat Canary as a best-effort advisory monitor, not a sandbox or reliable security boundary. Use OS permissions, containers, and real auditing for enforcement; avoid passing secrets in command strings; restrict log and tripwire file permissions; and verify any claimed rate-limit or protected-path behavior in your own environment before relying on it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
canary_tripwire.py:144- Finding
Tripwire Integrity Checks Can Generate Their Own Access Alerts
- Content
View full analysis
created_time + 60: alert = self._trigger_alert(path, 'ACCESSED', info['severity']) triggered.append(alert) ``` ### Technical Analysis The checker reads the tripwire file before inspecting its access timestamp. On filesystems that update access time for the read, Canary's own `open(..., 'r')` operation can change `st_atime`. Once the tripwire is more than 60 seconds old, that self-induced timestamp can satisfy the alert condition. The reverse failure is also possible. Filesystems mounted with `noatime`, or using delayed or relative access-time semantics, may not update `st_atime` when another process reads the file. A genuine unauthorized read may therefore remain undetected. The implementation also compares access time only to the original creation time. It does not maintain a reliable observation baseline that distinguishes Canary's own access from third-party access. Repea ...[truncated 1309 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
canary.py:97- Finding
Configured File and Network Rate Limits Are Not Enforced
- Content
View full analysis
Tuple[bool, Optional[str]]: if self.halted: return False, "Canary: System halted due to safety violations" expanded_path = os.path.expanduser(path) abs_path = os.path.abspath(expanded_path) for protected in self.protected_paths: protected_expanded = os.path.expanduser(protected) protected_abs = os.path.abspath(protected_expanded) if abs_path.startswith(protected_abs): reason = f"Canary: Protected path access blocked: {path}" self._log_violation( 'critical', f"Attempted {operation} on protected path: {path}" ) return False, reason for pattern in self.forbidden_patterns: if re.search(pattern, path, re.IGNORECASE): reason = f"Canary: Forbidden pattern in path: {pattern}" self._log_violation( 'high', f"Forbidden pattern in path: {path}" ) return False, reason self._log_action(operation, path, 'info') return True, None ``` The generic rate-limit implementation is present, but only command checking calls it: ```python def _check_rate_limit(self, action_type: str) -> bool: limits = self.config.get('rate_limits', {}).get(action_type) if not limits: return True now = time.time() wind ...[truncated 2337 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
canary.py:140- Finding
Commands and File Paths Are Stored Verbatim in Plaintext Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (69)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example:
python # This is blocked: canary.check_command('rm -rf /') # This might NOT be blocked (obfuscated): canary.check_command('r''m -rf /') # Space in command name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
canary.check_command('rm -rf /')
This might NOT be blocked (obfuscated):
canary.check_command('r''m -rf /') # Space in command name canary.check_command('RM -RF /') # Case may bypass patterns
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
This might NOT be blocked (obfuscated):
canary.check_command('r''m -rf /') # Space in command name canary.check_command('RM -RF /') # Case may bypass patterns
text **Why:** Full semantic analysis requires complex parsing and execution simulation.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
This might NOT be blocked (obfuscated):
canary.check_command('r''m -rf /') # Space in command name canary.check_command('RM -RF /') # Case may bypass patterns
text **Why:** Full semantic analysis requires complex parsing and execution simulation.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md **Limitation:** Canary checks actions but doesn't enforce sandboxing. **Example:** - Canary blocks `rm /etc/passwd` - Agent can still try to run it (Canary just logs it) - Enforcement depends on agent respecting Canary's response
YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
res OS-level isolation (containers, VMs, chroot).
Workaround:
- Run agent in container with limited permissions
- Use Canary + Docker/Podman for defense-in-depth
- Agent code must respect Canary checks (design agents to honor safety)
6. Pattern Bypass via Encoding
Limitation: Patterns can be bypassed with base64, hex, or other encoding.
Example:
bash # This is blocked: rm -rf / # This might NOT be blocked: echo "cm0gLXJmIC8=" | base64 -d | sh # Decodes to "rm -rf /"Why: Detecting all encoding schemes is intractable.
Workaround:
- Add patterns for common encoding patterns (
base64 -d,echo | sh) - Monitor for unusual command sequences
- Review audit logs for suspicious activity
7. No Permission Enforcement
Limitation: Canary doesn't modify file system permissions.
Example:
- Canary protects
~/.ssh/ - Agent could still access it if OS permissions allow
- Canary logs it, doesn't block at filesystem level
Why: Files
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Workaround:** - Use OS permissions + Canary together - Set restrictive file permissions (`chmod 600 ~/.ssh/id_rsa`) - Run agent with limited user account ---
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md **Forbidden Patterns:** - Regular expression matching for dangerous commands - Detects `rm -rf /`, `chmod 777`, `curl | sh`, etc. - Extensible pattern library **Rate Limiting:**
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md **Forbidden Patterns:** - Regular expression matching for dangerous commands - Detects `rm -rf /`, `chmod 777`, `curl | sh`, etc. - Extensible pattern library **Rate Limiting:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md **Forbidden Patterns:** - Regular expression matching for dangerous commands - Detects `rm -rf /`, `chmod 777`, `curl | sh`, etc. - Extensible pattern library **Rate Limiting:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md **Forbidden Patterns:** - Regular expression matching for dangerous commands - Detects `rm -rf /`, `chmod 777`, `curl | sh`, etc. - Extensible pattern library **Rate Limiting:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md **Forbidden Patterns:** - Regular expression matching for dangerous commands - Detects `rm -rf /`, `chmod 777`, `curl | sh`, etc. - Extensible pattern library **Rate Limiting:**
Static analysis
No suspicious patterns detected.