FocusTimer Pomodoro Timer via Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:50 PM UTC
• Version: 1.0.0

Overview

This local Pomodoro timer is mostly coherent, but it needs review because its code can write session data to an unrestricted caller-chosen file path.

Review before installing if you care about local activity privacy or file integrity. Use only in a trusted workspace, avoid exposing dataFile to untrusted input, and prefer a fixed app-owned storage path with deletion controls and visible write errors.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/focus-timer.js:15

Finding

User-Controlled Arbitrary File Overwrite Through Unrestricted Data Path

Content

View full analysis

Vulnerability Details

File Location: src/focus-timer.js, lines 15 and 88–90
Vulnerability Type: Unrestricted file write path
Risk Level: Medium

Vulnerable Code

javascript

this.dataFile = options.dataFile || './focus-data.json';

javascript

_save() {
  try { fs.writeFileSync(this.dataFile, JSON.stringify(this.sessions, null, 2)); } catch {}
}

Technical Analysis

The constructor accepts options.dataFile without validating, normalizing, or restricting the supplied path. The _save() method subsequently passes that path directly to fs.writeFileSync(), which creates or replaces the selected file with serialized session data.

If an untrusted caller can control the FocusTimer constructor options, it can provide an absolute path or a traversal-based relative path targeting any file writable by the Node.js process. Calling complete() invokes _save() and overwrites the target.

The empty catch block suppresses all filesystem errors. This makes unintended writes and attempted exploitation difficult to detect and prevents the caller from responding safely to persistence failures.

Attack Path

1. An attacker gains influence over the options.dataFile value passed to FocusTimer.
2. The attacker supplies the path of a sensitive file writable by the application process, for example:

   javascript

   const timer = new FocusTimer({
     dataFile: '/path/to/writable/application-config.json'
   });
   

3. The attacker or application calls timer.start() to create an active session.
4. The attacker or application calls timer.complete().
5. complete() adds a session and invokes _save().
6. _save() replaces the selected file with attacker-influenced session JSON.

Impact Assessment

Exploitation permits corruption or replacement of arbitrary files that are writable by the hosting Node.js process. Potential targets include application configurat ...[truncated 392 chars]

Remediation

View remediation

Remediation Suggestions

1. Store session data under a fixed, application-owned directory rather than accepting unrestricted paths.
2. Resolve and normalize the requested path with path.resolve(), then verify that it remains within the approved storage directory.
3. Reject absolute paths, traversal sequences, symlinks, directories, and unexpected filename extensions.
4. Open files with restrictive permissions appropriate to the platform, such as mode 0o600 for user-private data.
5. Use atomic persistence: write to a securely created temporary file in the same directory, flush it, and rename it over the destination.
6. Do not suppress filesystem exceptions. Return or log sanitized errors so failed and suspicious writes can be detected.
7. Run the hosting process with least-privilege filesystem permissions.
8. If caller-selected storage is required, accept a logical storage identifier and map it to a server-controlled path rather than accepting a raw filesystem path.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as a simple chat-based timer, but the analysis indicates it also reads and writes persistent local data and fails to implement a described pause feature. This mismatch is security-relevant because users may expose task names, work patterns, and activity history to unanticipated storage, reducing informed consent and increasing privacy risk if local files are accessible to other processes or users.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Static analysis

No suspicious patterns detected.