T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dev-backup.sh:211- Finding
Command and Option Injection in the tar Backup Fallback
- Content
View full analysis
- Remediation
View remediation
Security audit
Dev Backup
Security checks for vulnerabilities and agentic risk
Overview
This backup skill is mostly purpose-aligned, but its restore and tar fallback behavior create real local file-safety and command-execution risks.
Install only if you understand it will read and write whole project directories. Use it on trusted project paths, ensure rsync is available, avoid restoring snapshots with missing or mismatched checksums, and do not rely on restore to remove files created after a snapshot.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dev-backup.sh:142- Finding
Snapshot Integrity Verification Fails Open During Restore
- Content
View full analysis
/dev/null | sort | sha256sum | cut -d' ' -f1) if [[ "$STORED_CHECKSUM" == "$CURRENT_CHECKSUM" ]]; then echo " Checksum: ✅ VERIFICATO (${STORED_CHECKSUM:0:16}...) — integrità OK" else echo " Checksum: ⚠️ NON CORRISPONDE! (${STORED_CHECKSUM:0:16}... vs ${CURRENT_CHECKSUM:0:16}...)" echo " ATTENZIONE: Lo snapshot potrebbe essere stato modificato o corrotto!" fi else echo " Checksum: ℹ️ Nessun checksum disponibile per questo snapshot" fi ``` The restore subsequently continues: ```bash # Copy snapshot back to project dir if command -v rsync &>/dev/null; then rsync -a \ --exclude '.checksum' \ "${TARGET}/" "${PROJECT_DIR}/" else cp -a "${TARGET}/." "${PROJECT_DIR}/" fi ``` ### Technical Analysis The script calculates and compares the snapshot checksum, but a missing or mismatched checksum only produces a warning. It does not terminate the restore operation. After interactive confirmation, the script copies the snapshot into the target project regardless of the integrity result. The security check therefore fails open: content already identified as modified or unverifiable is treated the same as verified content. SHA-256 can detect snapshot modification, but detection provides no protection unless failure changes control flow. This behavior also conflicts with the documented expectation that snapshot integrity is verified during restoration. ### Attack Path 1. An attacker gains write access to a snapshot directory or to the storage location containing the backups. 2. The attacker modifies a snapsho ...[truncated 1096 chars]- Remediation
View remediation
&2 exit 1 fi STORED_CHECKSUM="$(cut -d' ' -f1 -- "$TARGET/.checksum")" CURRENT_CHECKSUM="$( find "$TARGET" -type f ! -name '.checksum' -exec sha256sum -- {} \; | LC_ALL=C sort | sha256sum | cut -d' ' -f1 )" if [[ ! "$STORED_CHECKSUM" =~ ^[[:xdigit:]]{64}$ ]] || [[ "$STORED_CHECKSUM" != "$CURRENT_CHECKSUM" ]]; then echo "Error: Snapshot integrity verification failed; restore aborted." >&2 exit 1 fi ``` Further hardening should include: - Permit bypass only through an explicit option such as `--force-unsafe-restore`, accompanied by a separate high-visibility confirmation. - Apply restrictive ownership and permissions to the backup directory so untrusted users cannot alter snapshots or `.checksum`. - Consider an HMAC or digital signature if snapshots must remain trustworthy against users who can modify both the snapshot and its checksum. - Treat checksum utility and file-read errors as verification failures rather than suppressing them with `2>/dev/null`. - Record the integrity result and selected snapshot in an audit log before restoration. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
When rsync is unavailable, the fallback tar path archives the entire project directory without applying the documented exclusions for .git, node_modules, .env, logs, caches, or backups. This can capture sensitive secrets, large dependency trees, and nested backup content, increasing the chance of credential exposure, excessive storage use, and unintended propagation of confidential or hazardous files into snapshots.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md if command -v rsync &>/dev/null; then rsync -a \ --exclude '.git' --exclude 'node_modules' --exclude '.vite' \ --exclude '.cache' --exclude '*.log' --exclude '.env' \ --exclude 'backups' \ "${PROJECT_DIR}/" "${SNAPSHOT_DIR}/" else
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh if command -v rsync &>/dev/null; then rsync -a \ --exclude '.git' --exclude 'node_modules' --exclude '.vite' \ --exclude '.cache' --exclude '*.log' --exclude '.env' \ --exclude 'backups' \ "${PROJECT_DIR}/" "${SNAPSHOT_DIR}/" else
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh else # Fallback: tar with explicit exclusions matching rsync defaults EXCLUDES="" for excl in .git node_modules .vite .cache '*.log' .env backups; do EXCLUDES="$EXCLUDES --exclude $excl" done tar -C "$(dirname "$PROJECT_DIR")" -cf - \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This file contains user-facing operational and safety instructions only in Italian, which effectively forces a specific language for using the skill. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file contains key activation rules and safety instructions only in Italian, while other parts of the document are in English. That creates a locale policy issue because the skill effectively imposes a specific language for critical behavior and warnings without user opt-in or an explicit language choice.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The restore documentation promises destructive synchronization semantics ('newer files will be deleted'), but the implementation only copies snapshot contents back with rsync -a or cp -a and never removes files that exist only in the target. This mismatch is dangerous because operators may rely on the documented rollback behavior for safety or incident recovery and end up with residual files, code, or artifacts that should have been removed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language strings in the embedded script use Italian for checksum, warning, dry-run, and destructive-operation messages. Because these are user-facing operational and safety messages, forcing a locale without offering a choice can violate language/locale policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This shell script includes multiple user-facing messages and the restore confirmation prompt entirely in Italian, such as checksum status, dry-run guidance, destructive-operation warning, and the required confirmation input. Because the script does not offer any language selection or document a justified locale restriction, it violates the language/locale policy for natural-language content.
- Content