ztp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:49 PM UTC
• Version: 2.0.0

Overview

This security-audit skill mostly matches its scanning purpose, but its default Python-file scan can execute the untrusted code it says it will not execute.

Review this skill before installing. Do not use its default scanner on untrusted Python files unless it is run in a disposable, locked-down environment or the dynamic import path is removed or made explicitly opt-in. Expect it to read scanned files, run local audit commands if directed, and create or overwrite SECURITY_REPORT.md.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shield_pro.py:640

Finding

Execution of Untrusted Python Code During Security Audit

Content

View full analysis

List[Dict[str, Any]]: findings = [] file_path = Path(target_path) if file_path.suffix != ".py": return [] try: module_name = file_path.stem spec = importlib.util.spec_from_file_location(module_name, target_path) if spec and spec.loader: module = importlib.util.module_from_spec(spec) with SafeImportHarness(): try: spec.loader.exec_module(module) except SecurityTrap as e: findings.append( { "severity": "CRITICAL", "file": str(target_path), "line": 0, "issue": f"Dynamic Trap Trigerred: {str(e)}", } ) except Exception: pass ``` The command-line interface invokes this dynamic analysis automatically for individual Python files: ```python else: findings.extend(scan_file(str(target_path))) if target_path.suffix == ".py": findings.extend(scan_dynamic(str(target_path))) findings.extend(scan_semantic(str(target_path), findings)) ``` ### Technical Analysis `spec.loader.exec_module(module)` executes all top-level statements in the target Python file. Because the target is the untrusted artifact being audited, this converts a security-scanning operation into an arbitrary Python code-execution path. `SafeImportHarness` does not provide an operating-system security boundary. It replaces only a limited set of module names and methods with mocks. It does not comprehensively restrict: - Built-in filesystem fun ...[truncated 1908 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/shield_pro.py:800

Finding

Unconditional Overwrite of a Fixed Report File

Content

View full analysis

str: ``` The report is written in truncating mode without checking whether the destination already exists: ```python with open(output_path, "w", encoding="utf-8") as f: f.write(report_content) return os.path.abspath(output_path) ``` The CLI invokes the function without requiring an explicit output destination: ```python report_path = generate_markdown_report(findings) ``` ### Technical Analysis The default output path is the fixed relative filename `SECURITY_REPORT.md`. Opening it with mode `"w"` truncates any existing file at that path before writing the report. The CLI neither asks for confirmation nor refuses to replace an existing file. Consequently, running an audit from a directory that already contains a file with this name can destroy or replace its contents. Because the path is relative, the affected destination depends on the process’s working directory rather than the target being scanned or an explicitly selected report directory. ### Attack Path 1. A user starts the auditor in a directory containing an existing `SECURITY_REPORT.md`. 2. The user invokes the documented audit command without specifying an output path. 3. The CLI calls `generate_markdown_report(findings)` using the fixed default filename. 4. `open(output_path, "w")` truncates the existing file. 5. The original contents are replaced by the generated audit report. ### Impact Assessment The direct impact is loss of integrity and availability for an existing file named `SECURITY_REPORT.md` in the working directory. Exploitation does not grant additional privileges; modificati ...[truncated 201 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description frames the capability as protocol-based validation, while the documented actions include broader forensic and supply-chain style checks that are not mapped to a specific SEP-2026 control set. Although not inherently malicious, this mislabeling can confuse operators about what assurance is being provided and lead to incorrect approval or rejection decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill description frames the capability as protocol-based validation, while the documented actions include broader forensic and supply-chain style checks that are not mapped to a specific SEP-2026 control set. Although not inherently malicious, this mislabeling can confuse operators about what assurance is being provided and lead to incorrect approval or rejection decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description frames the capability as protocol-based validation, while the documented actions include broader forensic and supply-chain style checks that are not mapped to a specific SEP-2026 control set. Although not inherently malicious, this mislabeling can confuse operators about what assurance is being provided and lead to incorrect approval or rejection decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description frames the capability as protocol-based validation, while the documented actions include broader forensic and supply-chain style checks that are not mapped to a specific SEP-2026 control set. Although not inherently malicious, this mislabeling can confuse operators about what assurance is being provided and lead to incorrect approval or rejection decisions.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The code invokes os.popen(...) to execute a shell command while generating a report. Although the command string is constant and not obviously user-controlled, it still introduces unnecessary subprocess execution, shell dependence, and an avoidable command-execution primitive inside a security tool.

Content

Scanner excerpt · scripts/shield_pro.py (reported line 832)May include surrounding context.

python

report_content = f"""# 🛡️ Shield Pro Security Report v{__version__}

**Date:** {os.popen('date -u +"%Y-%m-%dT%H:%M:%SZ"').read().strip()}
**Scan Status:** {status_icon} **{status_text}**

## 1. Executive Summary

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test_integration.py (reported line 74)May include surrounding context.

python

def test_scan_python_file(tmp_path):
    p = tmp_path / "malicious.py"
    p.write_text("import os\neval(input())\nos.system('rm -rf /')")
    findings = scan_file(str(p))
    # Should catch eval (CRITICAL) and os.system (CRITICAL)
    assert any(f["severity"] == "CRITICAL" for f in findings)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test_integration.py (reported line 74)May include surrounding context.

python

def test_scan_python_file(tmp_path):
    p = tmp_path / "malicious.py"
    p.write_text("import os\neval(input())\nos.system('rm -rf /')")
    findings = scan_file(str(p))
    # Should catch eval (CRITICAL) and os.system (CRITICAL)
    assert any(f["severity"] == "CRITICAL" for f in findings)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises operational commands that invoke shell tools and imply access to files, environment, and potentially networked scanners, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a security-audit skill, undeclared capability is especially risky because users may trust it as a gatekeeper while it can exercise broader execution surfaces than documented.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames this skill as a mandatory Zero Trust protocol validator for new code, skills, and MCP servers. In practice, the file implements broad multi-format security linting, anti-phishing Markdown checks, supply-chain checks, and report generation, which goes beyond a focused SEP-2026 validation role.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

scan_dynamic imports and executes untrusted Python modules, which runs top-level attacker-controlled code. The SafeImportHarness only mocks a few modules and methods, so malicious code can still execute through unmocked stdlib functionality, side effects during class creation/decorators/imports, CPU or memory exhaustion, or alternative execution paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

A security audit skill can reasonably analyze files, but reading OPENCLAW_AI_API_KEY introduces credential access capability unrelated to the manifest's stated validation scope, especially since no actual API call is performed here. This creates an unnecessary sensitive-data touchpoint for a mandatory audit skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code executes os.popen('date -u +"%Y-%m-%dT%H:%M:%SZ"') to run a shell command while generating the report. Although this action has an internal docstring describing report generation, there is no user-facing disclosure, prompt, or warning near the operation indicating that a subprocess will be invoked.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scan_semantic docstring says it identifies risky functions requiring further semantic review, implying meaningful semantic analysis. The code merely extracts risky functions, reads an API key, and if the key is absent adds a generic recommendation; it performs no actual semantic review in either branch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The function writes a markdown report to disk with open(output_path, "w", encoding="utf-8"), which modifies the filesystem. While the function name and docstring describe report generation, there is no explicit user-facing warning or confirmation that running the skill will create or overwrite a file.

Content

No source excerpt is available for this finding.