Security audit

cipher65536

Security checks for vulnerabilities and agentic risk

Overview

This is a file-to-text encoder, but it needs Review because it encourages restriction bypass, overstates weak custom encryption, and can write decoded files to attacker-chosen paths.

Review carefully before installing. Do not rely on scramble mode for sensitive encryption, do not use it to evade platform or security policies, decode only trusted files or always provide an explicit safe --output path, and protect any generated .key files as secrets. Prefer installing from the pinned requirements file rather than the unpinned pip command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/skill.py:314
Finding: Arbitrary File Write Through Untrusted Decoded Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/skill.py:47
Finding: Unauthenticated Deterministic Stream Encryption With Keystream Reuse
Content: View full analysis
bytes: """Derives a pseudo-random byte stream from an integer seed (SHAKE-256).""" seed_bytes = seed.to_bytes(32, 'big') return hashlib.shake_256(seed_bytes).digest(length) ``` ```python def xor_bytes(data: bytes, seed: int) -> bytes: keystream = secure_keystream(seed, len(data)) return bytes(a ^ b for a, b in zip(data, keystream)) def encrypt_body(text: str, seed: int) -> str: data_bytes = text.encode('utf-8') encrypted_bytes = xor_bytes(data_bytes, seed) return base65536.encode(encrypted_bytes) def decrypt_body(encrypted_b65536: str, seed: int) -> str: encrypted_bytes = base65536.decode(encrypted_b65536) decrypted_bytes = xor_bytes(encrypted_bytes, seed) return decrypted_bytes.decode('utf-8') ``` ```python # Encrypt real metadata real_meta_json = json.dumps(real_metadata).encode('utf-8') meta_key_bytes = secure_keystream(key_int, len(real_meta_json)) encrypted_meta = bytes([a ^ b for a, b in zip(real_meta_json, meta_key_bytes)]) encrypted_meta_b65536 = base65536.encode(encrypted_meta) ``` ```python encrypted_meta = base65536.decode(encrypted_meta_b65536.strip()) meta_key_bytes = secure_keystream(key_int, len(encrypted_meta)) real_meta_json_bytes = bytes([a ^ b for a, b in zip(encrypted_meta, meta_key_bytes)]) ``` ### Technical Analysis The encryption scheme derives a stream directly from the integer key using SHAKE-256 and XORs that stream with plaintext. It does not use a nonce, initialization vector, message-specific salt, or authentication tag. The encrypted body and encrypted metadata both derive their streams from the same key and both begin at stream offset ...[truncated 2170 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/skill.py:305
Finding: Unbounded Gzip Decompression of Attacker-Controlled Data
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Installation Instructions Bypass the Project's Pinned Dependency Version
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill makes strong cryptographic security claims, including resistance to known-plaintext and ciphertext-only attacks, despite describing only XOR-based protection over encoded text. Such claims can mislead users into trusting the tool for sensitive data protection when the scheme lacks authenticated modern cryptography and may fail catastrophically if keys are reused or handling is flawed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Promoting the skill as a way to bypass upload restrictions materially increases misuse risk because it frames the tool around defeating external controls. In context, the combination of text-based file transformation, concealment language, and evasion-oriented use cases makes the skill more dangerous than a neutral encoding utility.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill opens localhost TCP listeners and makes client connections as part of key generation, which introduces unnecessary network-facing behavior for a file encoder/decoder. Even though it binds only to 127.0.0.1, this expands the attack surface, can interfere with local services or sandbox policies, and creates a stealthy capability inconsistent with the minimal privileges expected for such a tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Phrases like 'safely bypass platform file format restrictions' and 'prevent eavesdropping' overstate what the tool can guarantee. Users may incorrectly believe the transfer is inherently safe or private, leading them to send sensitive or prohibited content through channels that remain logged, inspected, or policy-restricted.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly markets the tool as a way to bypass platform restrictions and transfer arbitrary binaries through text-only chat interfaces. In this skill context, that increases the risk of policy evasion, covert payload delivery, and movement of executables or archives through channels designed to block them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README makes strong cryptographic claims such as resistance to known-plaintext and ciphertext-only attacks without evidence of a standard, reviewed design or clear limitations. This can mislead users into trusting a homegrown XOR-based scheme for sensitive data, increasing the chance of confidentiality failure if the scheme is weaker than advertised.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The use-case section promotes concealment and embedding of encoded files in benign-looking carriers such as images or code comments, which is directly useful for covert exfiltration and payload smuggling. Given the skill's emphasis on arbitrary binary transfer and metadata concealment, this context makes the misuse potential materially higher.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents and invokes file read/write and shell execution behaviors but declares no explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause overbroad execution or insufficient review of dangerous capabilities, increasing the chance of unintended filesystem or command access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation explicitly lists bypassing upload restrictions as a use case, which signals an intent to evade platform security controls rather than support a legitimate encoding workflow. A skill that helps users circumvent content or attachment controls can be abused for stealthy exfiltration, malware transfer, or policy evasion.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly states that encryption keys are written directly to a .key file, but it does not prominently warn users that this creates sensitive key material on disk. Storing raw keys on disk increases exposure to backup leakage, malware, unintended sharing, and forensic recovery, and the claimed 0600 permissions do not eliminate those risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a Base65536 file encoding/decoding tool with optional XOR encryption, but does not state that the skill will create and manage additional plaintext key files on disk. The implementation auto-generates a key file, handles name collision logic, writes timestamps and key material, and changes file permissions, which is behavior materially beyond straightforward file transformation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The document states that the tool establishes TCP connections to 127.0.0.1, binds ephemeral ports, and performs send/recv loops to collect timing jitter. Even though this is loopback-only, it affects system/network behavior and should be disclosed to users in the skill description as part of expected operational impact.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.