furniture-fit-checker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 1.0.0

Overview

This is a local furniture-measurement helper with no network, credential, persistence, or hidden agent-control behavior, though its results should be treated as approximate.

Install only if you are comfortable running a local Python measurement helper. Use explicit units, measure the narrowest real route points, and do not rely on a successful result as a guarantee for heavy or risky moves; avoid feeding unrealistic or untrusted huge dimensions with the floorplan option.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fit_checker.py:248

Finding

Unbounded Floorplan Allocation Enables Local Denial of Service

Content

View full analysis

Vulnerability Details

File Location: scripts/fit_checker.py, lines 248-250
Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

Vulnerable Code

python

W = max(int(round(room_w / 10)), 20)
H = max(int(round(room_d / 10)), 10)
grid = [[" "] * W for _ in range(H)]

Technical Analysis

The room_w and room_d values originate from the command-line --room argument and are parsed without any upper-bound or finite-number validation. When the --floorplan option is enabled, these values directly determine the width and height of a two-dimensional character grid.

The allocation grows proportionally to W × H. An attacker or untrusted automation input can therefore provide unrealistically large room dimensions and force the process to allocate excessive memory. Exceptionally large numeric values may also convert to non-finite floating-point values, causing an uncaught exception during integer conversion.

Attack Path

1. An attacker supplies oversized dimensions through the --room argument.
2. parse_list() accepts the syntactically valid measurements and converts them to floating-point centimeter values.
3. The room command performs its normal fit calculation.
4. With --floorplan enabled, floorplan() derives W and H directly from the attacker-controlled measurements.
5. The nested list allocation consumes excessive memory, potentially making the process or host unresponsive or causing operating-system termination.

Example:

bash

python3 scripts/fit_checker.py room \
  --item 1x1cm \
  --room 10000000x10000000cm \
  --floorplan

Impact Assessment

Successful exploitation can cause local denial of service through memory exhaustion, severe resource pressure, process termination, or an uncaught conversion error. This is particularly relevant when an AI agent or automated service invokes the utility with measurements derived from untrusted input.

The vulnerability does not provide co ...[truncated 190 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate every parsed measurement with math.isfinite() and reject NaN or infinity.
2. Enforce realistic maximum room dimensions before performing calculations or rendering.
3. Define explicit maximum values for W, H, and the total cell count W * H.
4. Use adaptive scaling so large rooms are rendered within a fixed terminal canvas rather than at a constant ten-centimeter-per-character scale.
5. Return a clear validation error when the requested floorplan exceeds rendering limits.
6. Defensively handle OverflowError and MemoryError, while treating pre-allocation validation as the primary control.
7. Add regression tests covering oversized and non-finite-equivalent numeric inputs.

A hardened implementation should validate before allocation, for example:

python

if not all(math.isfinite(v) and v > 0 for v in (room_w, room_d)):
    raise ValueError("room dimensions must be positive finite values")

W = max(int(round(room_w / 10)), 20)
H = max(int(round(room_d / 10)), 10)

MAX_WIDTH = 240
MAX_HEIGHT = 120
MAX_CELLS = 20_000

if W > MAX_WIDTH or H > MAX_HEIGHT or W * H > MAX_CELLS:
    raise ValueError("room dimensions exceed floorplan rendering limits")

grid = [[" "] * W for _ in range(H)]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code presents a fit verdict that could influence a physical moving decision, but the user-facing safety caveats appear only in the failure branch. A successful result is printed without any warning that the calculation is simplified and that real-world clearance constraints along the full route still matter.

Content

No source excerpt is available for this finding.