Checklist

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:24 PM UTC
• Version: 1.2.1

Overview

The skill is a local checklist manager, but it substantially overstates safety features and has local file-handling flaws users should review before trusting it.

Review this skill before installing if you expect autonomous multi-agent coordination. It appears non-malicious and local-only, but do not rely on its advertised loop limits, deadlock prevention, or validation until those are implemented, and avoid passing untrusted template names because they can affect local checklist files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/checklist.sh:416
• Finding: Path Traversal in Checklist Template Selection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/checklist.sh:416-423` **Vulnerability Type**: Path traversal and unauthorized local file selection **Risk Level**: Medium ### Vulnerable Code ```bash local template_file="${TEMPLATES_DIR}/${name}.json" if [[ -f "$template_file" ]]; then cp "$template_file" "${ACTIVE_DIR}/current.json" # Reset all statuses local temp=$(mktemp) jq '.items[] |= {"id": .id, "text": .text, "status": "pending", "required": .required, "assigned_to": null, "completed_by": null, "depends_on": (.depends_on // [])}' \ "${ACTIVE_DIR}/current.json" > "$temp" && mv "$temp" "${ACTIVE_DIR}/current.json" ``` ### Technical Analysis The template name is supplied through the command-line interface and concatenated directly into a filesystem path: ```bash "${TEMPLATES_DIR}/${name}.json" ``` The implementation does not reject path separators, `..` components, absolute-path constructs, or other characters outside the expected template-name format. The `[[ -f "$template_file" ]]` test only confirms that the resolved path is a regular file; it does not confirm that the file remains inside `TEMPLATES_DIR`. Consequently, a crafted template name can escape `~/.checklist/templates` and select another user-readable file whose name ends in `.json`. The selected file is copied into `~/.checklist/active/current.json` before its structure is processed by `jq`. No privilege escalation is involved: access remains limited to files readable by the operating-system account running the script. ### Attack Path 1. An attacker who can invoke the CLI creates a readable JSON file outside the template directory, or identifies an existing one. 2. The attacker supplies a traversal sequence as the template name, for example: ```bash checklist create ../../../../tmp/target ``` 3. The application constructs a path similar to: ```text ~/.checklist/templates/../../../../tmp/target.json ``` 4. The regular-file ch ...[truncated 898 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict template names to a conservative identifier format: ```bash if [[ ! "$name" =~ ^[A-Za-z0-9_-]+$ ]]; then print_error "Invalid template name" return 1 fi ``` 2. Canonicalize both the template directory and candidate path, then verify that the candidate remains below the trusted directory: ```bash template_root=$(realpath "$TEMPLATES_DIR") template_file=$(realpath -m "${TEMPLATES_DIR}/${name}.json") if [[ "$template_file" != "$template_root/"* ]]; then print_error "Template path escapes the template directory" return 1 fi ``` 3. Validate the JSON schema before replacing active state. At minimum, require an object containing an `items` array with appropriately typed fields. 4. Process the selected file into a temporary file first, and move it into place only after every validation and transformation succeeds. Do not copy unvalidated content directly over `current.json`. 5. Add regression tests for names containing `../`, `/`, backslashes, absolute paths, embedded null-like input, and symbolic-link edge cases. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/checklist.sh:427
• Finding: Unescaped User Input in Generated JSON Checklist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/checklist.sh:427-433` **Vulnerability Type**: JSON injection and persistent state corruption **Risk Level**: Low ### Vulnerable Code ```bash cat > "${ACTIVE_DIR}/current.json" << EOF { "name": "$name", "description": "Custom checklist", "items": [] } EOF ``` ### Technical Analysis When no matching template exists, the script embeds the user-controlled checklist name directly into a JSON document. The value is not encoded as a JSON string before interpolation. Characters such as double quotes, backslashes, control characters, and newlines can therefore terminate or alter the intended string. Crafted input can inject additional object properties or produce malformed JSON. This is JSON data injection rather than shell command injection. Content introduced through the expanded here-document is written as data and is not evaluated again as shell syntax. ### Attack Path 1. An attacker invokes `create` with a checklist name containing JSON syntax, for example: ```bash checklist create 'project", "attacker_controlled": true, "alias": "x' ``` 2. The input is interpolated verbatim into `current.json`, producing content similar to: ```json { "name": "project", "attacker_controlled": true, "alias": "x", "description": "Custom checklist", "items": [] } ``` 3. The attacker has introduced properties that were not intended by the application. 4. Alternatively, unmatched quotes or escape sequences can create invalid JSON. 5. Subsequent commands that parse `current.json` with `jq` may fail, causing the checklist workflow to become unavailable until the file is repaired or replaced. ### Impact Assessment An attacker able to invoke the local checklist CLI can: - Inject additional properties into persistent checklist state. - Corrupt `~/.checklist/active/current.json`. - Cause subsequent checklist operations to fail, resulting in a local denial of service. - Poten ...[truncated 252 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Construct JSON through a serializer instead of interpolating input into a here-document: ```bash jq -n --arg name "$name" \ '{name: $name, description: "Custom checklist", items: []}' \ > "${ACTIVE_DIR}/current.json" ``` 2. Write generated content to a temporary file, validate it with `jq -e`, and atomically move it into place only after validation succeeds: ```bash temp=$(mktemp) jq -n --arg name "$name" \ '{name: $name, description: "Custom checklist", items: []}' > "$temp" jq -e . "$temp" >/dev/null mv "$temp" "${ACTIVE_DIR}/current.json" ``` 3. Apply a reasonable length limit and reject control characters if checklist names are intended to be human-readable identifiers. 4. Add tests covering quotes, backslashes, newlines, Unicode characters, empty values, and oversized names. 5. Consider applying restrictive permissions to checklist state files, such as mode `0600`, when checklist contents may contain operationally sensitive information. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims safety-critical workflow features such as sequential/parallel/loop execution, deadlock prevention, and loop safety, but the file provides only documentation-level commands and examples without evidence that these protections are actually enforced. In an agentic context, operators may rely on these guarantees and allow autonomous execution of repetitive or dependent tasks, which can lead to unsafe task ordering, uncontrolled looping, or conflicting multi-agent actions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The evaluation prompts are broad, imperative natural-language commands like 'Create a deployment checklist' and 'Register an agent named backend' without any explicit skill-invocation boundary or confirmation step. In a system that routes user text to skills, this increases the chance of accidental or adversarial triggering of checklist state changes during ordinary conversation, especially because the commands cover agent registration, assignment, mode switching, and workflow mutation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes sequential/parallel execution with dependencies, deadlock prevention, and loop safety. However, the claim logic simply selects the first pending unassigned item and does not verify that its dependencies are completed, which means actual execution behavior does not match the advertised coordination and safety semantics.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill description explicitly claims looping execution and loop safety, but the dependency command merely writes a depends_on field into the checklist data. There is no validation to prevent cyclic dependencies or logic to support safe loop execution, so the implemented behavior falls short of the stated capability.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

{"id": 2, "text": "Verify base image is up to date", "required": true},
    {"id": 3, "text": "Run container security scan", "required": true},
    {"id": 4, "text": "Fix critical vulnerabilities found", "required": true},
    {"id": 5, "text": "Don't run as root user", "required": true},
    {"id": 6, "text": "Use minimal base image (Alpine/distroless)", "required": false},
    {"id": 7, "text": "Remove unnecessary packages", "required": true},
    {"id": 8, "text": "Scan for secrets in image", "required": true},

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The markdown includes mode labels such as "Sequential (串行)" and similar bilingual command annotations, but nowhere explains that the skill is bilingual or lets the user choose a preferred language. This can violate a language/locale policy when a skill imposes or assumes a language presentation without explicit opt-in or documented justification.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This shell script immediately creates directories under the user's home directory and may copy template files into them as soon as it runs. While later commands print success messages, there is no prior comment, prompt, or explicit user-facing warning near initialization that the script will modify files in ~/.checklist on startup.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The create command copies or overwrites the active checklist file, and many other commands rewrite current.json and agents.json via temporary files and mv. Although success messages are printed after the fact, the usage/help text does not warn users that these commands persistently modify checklist state files in the home directory.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: This JSON manifest applies to SQP-1, and the description only says "Pre-deployment verification steps" without clarifying when this checklist should be invoked, by whom, or in what environments. The lack of scope constraints or exclusion conditions makes the activation context ambiguous for a skill/template manifest.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: This manifest file describes a broad 'Software release preparation and deployment workflow' but does not define any explicit trigger phrases, scope limits, or exclusion conditions. In a manifest context, that ambiguity can make invocation conditions overly broad for a release-related skill.

Static analysis

No suspicious patterns detected.