Folder Tree Generator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:42 PM UTC
• Version: 1.0.0

Overview

This skill does generate folder trees, but its recursive scan can follow symbolic links outside the chosen folder and can run without a default depth limit.

Install only if you are comfortable with the skill enumerating local directory names and paths. Use an explicit small --depth value and avoid running it on untrusted folders or folders containing symbolic links until symlink handling and traversal limits are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:12

Finding

Unrestricted Symbolic-Link Traversal

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 12–29
Vulnerability Type: Unrestricted symbolic-link traversal and recursive resource exhaustion
Risk Level: Medium

js

try {
  stats = fs.statSync(dirPath);
} catch (err) {
  return { name, error: err.message };
}

const item = {
  name,
  type: stats.isDirectory() ? 'directory' : 'file',
  path: dirPath
};

if (stats.isDirectory()) {
  if (currentDepth < maxDepth) {
    try {
      const children = fs.readdirSync(dirPath)
        .filter(child => !ignore.includes(child))
        .map(child => generateStructure(path.join(dirPath, child), { ...options, currentDepth: currentDepth + 1 }));
      item.children = children;

Technical Analysis

fs.statSync() follows symbolic links. The recursive traversal does not use fs.lstatSync() to identify links, track visited filesystem objects, verify that resolved child paths remain under the initially selected directory, or impose a finite default depth or entry limit.

Consequently, a symbolic link inside a scanned directory can redirect traversal to any filesystem location readable by the process. If a link points to the scanned directory or one of its ancestors, recursion can repeatedly revisit the same directory. The default maxDepth is Infinity, so such a cycle can continue until the process exhausts stack, memory, file-processing capacity, or execution time.

Attack Path

1. An attacker creates or controls a directory that the victim or agent will scan.
2. The attacker adds a symbolic link targeting either:
   • a readable directory outside the intended scan root, or
   • the current directory or an ancestor, creating a traversal cycle.
3. The victim invokes the skill on the attacker-controlled directory without a finite --depth value.
4. fs.statSync() follows the link and classifies its target as a directory.
5. The recursive readdirSync() and `g ...[truncated 943 chars]

Remediation

View remediation

Remediation Suggestions

• Use fs.lstatSync() or fs.readdirSync() with directory entries to detect symbolic links, and do not traverse them by default.
• If following links is required, resolve each candidate with fs.realpathSync() and verify that the resolved path remains within the canonical initial root using a separator-aware containment check.
• Track visited filesystem objects by canonical path or device/inode pair to prevent cycles and repeated traversal.
• Set a conservative finite default recursion depth and enforce maximum node, output-size, and execution-time limits.
• Handle links explicitly in generated output, for example by returning an item with type: "symlink" and its target without recursively scanning it.
• Add tests covering links to ancestors, self-referential links, links outside the root, deeply nested trees, and traversal-limit enforcement.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.