Security audit

My System Info Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it creates a local Markdown system report, but the report may contain sensitive host details and the file-writing logic could be safer.

Install only if you are comfortable creating a local report that may include hostnames, usernames, IP addresses, mounted filesystems, running processes, and services. Generate reports in a trusted working directory, do not run it as a privileged user unless necessary, and avoid sharing the Markdown output publicly without reviewing or redacting it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Note

Location: scripts/generate_system_report.sh:18
Finding: Broad Collection of Sensitive Host Reconnaissance Data
Content: View full analysis
/dev/null | cut -d'"' -f2 || uname -a uname -r whoami uptime -p lscpu | awk 'NR>1 {printf "| %s | %s |\n", $1, $2}' free -h lsblk df -h ip addr top -bn1 | head -20 systemctl list-units --type=service --state=running 2>/dev/null ``` ### Technical Analysis The script consolidates several categories of operationally sensitive host information into one report: - Host identity and operating-system details - Current execution user - CPU and memory characteristics - Block devices, mounted filesystems, and disk usage - Network interface names and IP addresses - Active processes - Running system services This behavior is consistent with the documented system-reporting purpose and no code was found that transmits the resulting data over a network. Nevertheless, the aggregated report constitutes sensitive reconnaissance material. It can provide an attacker with a detailed map of the host, including reachable network interfaces, valuable filesystems, active software, and potentially exploitable services. ### Attack Path 1. A user invokes the system-report Skill. 2. The script collects host, user, storage, network, process, and service information. 3. All collected data is stored together in a timestamped Markdown report. 4. Another local user, an unintended report recipient, or a process with access to the output directory reads the report. 5. The exposed operational details are used to identify attack targets, relevant services, network paths, or valuable mounted storage. This finding does not establish remote exfiltration or unauthorized access by the Skill itself. Exploitation requires a separate means of obtaining the generated report. ### Impact Assessment The report may disclose system top ...[truncated 305 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_system_report.sh:4
Finding: Predictable Report Path Permits Symbolic-Link File Overwrite
Content: View full analysis
"$REPORT_FILE" ``` ### Technical Analysis The script creates its output under a relative directory and constructs the report filename from a timestamp with one-second precision. It then opens the selected path using ordinary shell redirection. Shell redirection follows an existing symbolic link and truncates its target before report generation. The script does not: - Verify that the output directory is owned by the invoking user - Reject symbolic links - Create the report with exclusive-create semantics - Use a securely randomized filename - Set restrictive directory and file permissions - Confirm that the destination is a newly created regular file Consequently, if an attacker can write to the working directory or the existing `system-tool-results` directory, the attacker can attempt to predict the report filename and pre-create it as a symbolic link. When the Skill runs, the redirection may overwrite a file writable by the Skill's execution account. The `output_dir` parameter declared in `skill.json` is not consumed by the script. This creates a configuration mismatch and prevents callers from reliably selecting a trusted output directory through the declared interface. ### Attack Path 1. The attacker obtains write access to the Skill's current working directory or its `system-tool-results` subdirectory. 2. The attacker predicts the second in which the Skill will execute. 3. The attacker creates a symbolic link such as: `system-to ...[truncated 1167 chars]
Remediation: View remediation
"$REPORT_FILE" || exit 1 ``` 7. Explicitly reject an existing destination that is a symbolic link or is not a regular file. 8. Add `set -euo pipefail` and validate the result of directory and file-creation operations so the script fails closed. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly states it will collect broad system information, including network, process, and service data, and automatically save a report to disk, but it provides no warning, consent step, or discussion of sensitivity. In an agent environment, this can expose host details, running services, usernames, and filesystem information that may aid reconnaissance or leak operationally sensitive data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The usage section specifies only Chinese trigger phrases for calling the skill. This can be a natural-language policy concern when a skill enforces a specific language without documenting that it is region-specific or offering alternatives.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description states the skill generates and outputs the report in Markdown using Chinese-language wording indicating a Chinese-localized skill, but it does not offer any user choice of language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.