Comonyx Admin

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:55 PM UTC
• Version: 1.0.1

Overview

The skill’s admin export/email purpose is disclosed, but its documented email workflow can turn recipient or path text into shell execution while handling sensitive company data.

Install only in a controlled admin environment. Do not use the documented one-line email command with untrusted recipient, subject, body, or file path values; require structured execution, recipient validation, and explicit confirmation before exporting or emailing company data. Store SMTP credentials carefully and require encrypted SMTP transport before authentication.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: TOOLS.md:31

Finding

Shell Command Injection Through User-Controlled Email and Attachment Values

Content

View full analysis

' ATTACHMENT_PATH='' && echo "Cosmonyx companies export attached." > /tmp/companies_body.txt && cd "/scripts" && python3 send-email.py /tmp/companies_body.txt ``` The same unsafe construction is repeated in the full command on line 37: ```bash export SMTP_HOST=in-v3.mailjet.com SMTP_USERNAME=... SMTP_PASSWORD=... SMTP_PORT=587 SMTP_DEFAULT_EMAIL=... SMTP_DEFAULT_NAME=IdentityGram EMAIL_TO='' ATTACHMENT_PATH='' && echo "Cosmonyx companies export attached." > /tmp/companies_body.txt && cd "/scripts" && python3 send-email.py /tmp/companies_body.txt ``` ### Technical Analysis The instructions require an agent to replace `` with a user-provided email address and `` with an attachment path, then execute the resulting string through a shell. Single quotes do not make this safe when the interpolated value itself can contain a single quote. A malicious value can terminate the quoted assignment and append arbitrary shell operators and commands. `SKILL.md`, lines 169–172, directs the agent to set these values and execute the documented one-line command. Although the normal attachment path is generated internally, the recipient is explicitly supplied by the user. The command therefore creates a direct path from untrusted input to shell execution. ### Attack Path 1. An attacker asks the Skill to email an export. 2. When prompted for an address, the attacker supplies a value such as: ```text x'; id > /tmp/comonyx-command-output; # ``` 3. The agent substitutes that value into the documented command: ```bash export EMAIL_TO='x'; id > /tmp/comonyx-command-output; #' ATTACHMENT_PATH='...' ``` 4. The shell closes the assignment at the injected quote and executes `id`. ...[truncated 686 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send-email.py:105

Finding

SMTP Authentication Can Occur Without Transport Encryption on Custom Ports

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 7)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 18)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 34)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 35)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 36)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 37)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 38)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TOOLS.md (reported line 39)May include surrounding context.

md

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send-email.py (reported line 4)May include surrounding context.

python

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send-email.py (reported line 20)May include surrounding context.

python

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send-email.py (reported line 78)May include surrounding context.

python

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send-email.py (reported line 81)May include surrounding context.

python

#!/usr/bin/env python3
"""
Send email with optional attachment (e.g. Cosmonyx Admin PDF/Excel export).
Reads SMTP_* and EMAIL_TO, ATTACHMENT_PATH from a .env file (skill root) and/or environment.
Usage: python3 send-email.py [body_file]
  Default body file: /tmp/companies_body.txt
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send-email.py (reported line 23)May include surrounding context.

python

"""Load .env from the skill root (parent of this script's directory)."""
    script_dir = os.path.dirname(os.path.abspath(__file__))
    skill_root = os.path.dirname(script_dir)
    env_path = os.path.join(skill_root, ".env")
    if not os.path.isfile(env_path):
        return
    try:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to read local files such as TOOLS.md and optionally SKILL.yaml, and to rely on environment-based SMTP configuration, but it declares no explicit tool scope or permissions. That creates a mismatch between documented capabilities and declared access controls, increasing the chance an agent runtime will grant broader-than-necessary file or environment access without clear review boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs the agent to fetch the full set of company records, export them to local files, and optionally email them, but it does not require a clear upfront warning or explicit confirmation about the volume and sensitivity of the data being handled. In an admin context this may be legitimate, yet it still raises data-minimization and exfiltration risk because bulk company data can include sensitive business and personal information that is easy to spread via downloads and email.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs the agent to email exported company files to arbitrary recipients using SMTP, but it does not require an explicit user confirmation that recipient addresses and attachment contents will be transmitted to an external mail service. In an admin/export skill, this creates a realistic risk of unintended data exfiltration or privacy violations, especially if exports contain sensitive company data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description advertises high-privilege actions such as signing in with admin credentials, fetching all companies, exporting records, and sending emails, but it does not define meaningful trigger constraints, authorization boundaries, recipient restrictions, or approval steps. In an agent skill, this broad and underspecified scope increases the risk of overbroad execution, data exfiltration, or misuse of admin capabilities if invoked with ambiguous prompts or insufficient guardrails.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.