T09 · Insecure Skill Coding Practices
- Location
SKILL.md:64- Finding
Integrity Verification Uses a Collision-Prone Content Fingerprint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:64-75
Vulnerability Type: Weak integrity verification
Risk Level: MediumVulnerable Code Snippet:
markdown ## Integrity Check Compare files by reading them and noting their content fingerprint (first/last lines + file size). No hashing exec needed — the `read` tool is sufficient for detecting file changes. **Baseline** (user-initiated only): - User says "baseline {skill}" - Agent reads all files in `./skills/{name}/` - Saves file list + sizes + first/last lines to `memory/skill-guard/{name}-baseline.txt` - Shows the baseline to user for review **Verify** (user-initiated only): - User says "integrity check {skill}" - Agent reads current files and compares against saved baseline - Reports any differencesTechnical Analysis
The proposed fingerprint consists only of each file's first line, last line, and byte size. These attributes do not cryptographically bind the baseline to the complete file contents. An attacker can change content between the retained boundary lines and preserve the original file size by replacing text with an equal-length payload or adding compensating padding.
Consequently, two materially different files can produce the same recorded fingerprint. The statement that the
readtool is sufficient for detecting file changes is therefore inaccurate under the documented comparison method.Attack Path
- A legitimate skill is installed and the user explicitly creates a baseline.
- The baseline records only the file list, file sizes, and first and last lines.
- An attacker with an existing ability to modify a skill file replaces content between its first and last lines.
- The attacker preserves the original byte count, using equal-length replacement content or padding.
- The user invokes the integrity check.
- The recorded boundary lines and size still match, so the modified file may be reported as unc ...[truncated 427 chars]
- Remediation
View remediation
Remediation Suggestions
- Compute and retain a cryptographic digest, such as SHA-256, over the complete byte content of every monitored file.
- Use an available structured hashing API rather than a shell command where possible, preserving the intended no-shell security boundary.
- Record normalized relative paths, file types, permissions where relevant, and cryptographic digests in the baseline.
- Protect baseline files against unauthorized modification. If the threat model includes writable local storage, authenticate the baseline with a keyed MAC or digital signature stored outside the scanned directory.
- During verification, report added, removed, renamed, type-changed, and digest-mismatched files.
- Do not describe sizes and boundary lines as an integrity fingerprint; they may remain as diagnostic metadata but must not determine trust.