My System Info Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:57 PM UTC
• Version: 1.0.0

Overview

This skill does what it says: it creates a local Markdown system report, but the report may contain sensitive host details and the file-writing logic could be safer.

Install only if you are comfortable creating a local report that may include hostnames, usernames, IP addresses, mounted filesystems, running processes, and services. Generate reports in a trusted working directory, do not run it as a privileged user unless necessary, and avoid sharing the Markdown output publicly without reviewing or redacting it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Note

• Location: scripts/generate_system_report.sh:18
• Finding: Broad Collection of Sensitive Host Reconnaissance Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_system_report.sh`, lines 18–76 **Vulnerability Type**: Excessive system information collection **Risk Level**: Low ### Complete Code Snippet ```bash hostname grep PRETTY_NAME /etc/os-release 2>/dev/null | cut -d'"' -f2 || uname -a uname -r whoami uptime -p lscpu | awk 'NR>1 {printf "| %s | %s |\n", $1, $2}' free -h lsblk df -h ip addr top -bn1 | head -20 systemctl list-units --type=service --state=running 2>/dev/null ``` ### Technical Analysis The script consolidates several categories of operationally sensitive host information into one report: - Host identity and operating-system details - Current execution user - CPU and memory characteristics - Block devices, mounted filesystems, and disk usage - Network interface names and IP addresses - Active processes - Running system services This behavior is consistent with the documented system-reporting purpose and no code was found that transmits the resulting data over a network. Nevertheless, the aggregated report constitutes sensitive reconnaissance material. It can provide an attacker with a detailed map of the host, including reachable network interfaces, valuable filesystems, active software, and potentially exploitable services. ### Attack Path 1. A user invokes the system-report Skill. 2. The script collects host, user, storage, network, process, and service information. 3. All collected data is stored together in a timestamped Markdown report. 4. Another local user, an unintended report recipient, or a process with access to the output directory reads the report. 5. The exposed operational details are used to identify attack targets, relevant services, network paths, or valuable mounted storage. This finding does not establish remote exfiltration or unauthorized access by the Skill itself. Exploitation requires a separate means of obtaining the generated report. ### Impact Assessment The report may disclose system top ...[truncated 305 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make detailed network, process, storage, and service sections explicitly opt-in. 2. Redact hostnames, usernames, IP addresses, mount paths, and other identifying data by default. 3. Add a clear warning that generated reports may contain sensitive operational information. 4. Apply restrictive permissions by setting `umask 077` before creating the report. 5. Store reports only in a directory owned by and accessible to the invoking user. 6. Provide separate report modes, such as `summary` and `full`, with the least-sensitive mode as the default. 7. Define a retention policy and securely remove reports after they are no longer required. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_system_report.sh:4
• Finding: Predictable Report Path Permits Symbolic-Link File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_system_report.sh`, lines 4–14 and 79 **Vulnerability Type**: Predictable file creation and symbolic-link following **Risk Level**: Medium ### Complete Code Snippet ```bash SYSTEM_TOOL_RESULTS_DIR="system-tool-results" if [ ! -d "$SYSTEM_TOOL_RESULTS_DIR" ]; then mkdir -p "$SYSTEM_TOOL_RESULTS_DIR" fi TIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S") REPORT_FILE="$SYSTEM_TOOL_RESULTS_DIR/system_report_$TIMESTAMP.md" { # Report generation commands } > "$REPORT_FILE" ``` ### Technical Analysis The script creates its output under a relative directory and constructs the report filename from a timestamp with one-second precision. It then opens the selected path using ordinary shell redirection. Shell redirection follows an existing symbolic link and truncates its target before report generation. The script does not: - Verify that the output directory is owned by the invoking user - Reject symbolic links - Create the report with exclusive-create semantics - Use a securely randomized filename - Set restrictive directory and file permissions - Confirm that the destination is a newly created regular file Consequently, if an attacker can write to the working directory or the existing `system-tool-results` directory, the attacker can attempt to predict the report filename and pre-create it as a symbolic link. When the Skill runs, the redirection may overwrite a file writable by the Skill's execution account. The `output_dir` parameter declared in `skill.json` is not consumed by the script. This creates a configuration mismatch and prevents callers from reliably selecting a trusted output directory through the declared interface. ### Attack Path 1. The attacker obtains write access to the Skill's current working directory or its `system-tool-results` subdirectory. 2. The attacker predicts the second in which the Skill will execute. 3. The attacker creates a symbolic link such as: `system-to ...[truncated 1167 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set restrictive defaults before creating any output: ```bash umask 077 ``` 2. Honor the declared `output_dir` parameter and resolve it to an approved absolute path. 3. Create the output directory with mode `0700`, then verify that it: - Is a real directory rather than a symbolic link - Is owned by the expected user - Is not writable by untrusted users 4. Create the report atomically with an unpredictable name: ```bash REPORT_FILE=$(mktemp --tmpdir="$SYSTEM_TOOL_RESULTS_DIR" \ 'system_report_XXXXXX.md') || exit 1 ``` 5. If the timestamp must remain in the final filename, first write to a securely created temporary file and then rename it after checking that the destination does not exist. 6. Use exclusive creation semantics, such as Bash noclobber mode with appropriate error handling: ```bash set -o noclobber : > "$REPORT_FILE" || exit 1 ``` 7. Explicitly reject an existing destination that is a symbolic link or is not a regular file. 8. Add `set -euo pipefail` and validate the result of directory and file-creation operations so the script fails closed. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly states it will collect broad system information, including network, process, and service data, and automatically save a report to disk, but it provides no warning, consent step, or discussion of sensitivity. In an agent environment, this can expose host details, running services, usernames, and filesystem information that may aid reconnaissance or leak operationally sensitive data.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The usage section specifies only Chinese trigger phrases for calling the skill. This can be a natural-language policy concern when a skill enforces a specific language without documenting that it is region-specific or offering alternatives.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The manifest description states the skill generates and outputs the report in Markdown using Chinese-language wording indicating a Chinese-localized skill, but it does not offer any user choice of language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Static analysis

No suspicious patterns detected.