CAN: Clock Address Naming

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:19 PM UTC
• Version: 1.9.0

Overview

This skill appears locally focused and not malicious, but it encourages persistent logging and caching of agent/tool outputs without clear privacy, permission, or cleanup controls.

Review before installing if your agent handles private reports, customer data, credentials, proprietary API responses, or regulated content. Use this only with explicit opt-in logging, avoid storing raw tool outputs by default, restrict ~/.can permissions, redact sensitive WHAT values, and define retention and deletion practices.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:126

Finding

Cached Tool Outputs May Be Stored with Permissive Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: README.md:126-133
Vulnerability Type: Plaintext storage of potentially sensitive tool or API output with inherited default permissions
Risk Level: Medium

bash

RESULT=$(curl -s api.example.com/data)
WHEN=$(date +%s%3N)
WHERE=$(echo -n "$RESULT" | sha256sum | awk '{print $1}')
echo -e "$WHEN\t$WHERE\tapi.example.com/data" >> ~/.can/index.tsv
echo -n "$RESULT" > ~/.can/store/$WHERE

Technical Analysis

The documented workflow writes the complete response returned by an API or MCP-style tool to ~/.can/store/$WHERE in plaintext. It also appends activity metadata to ~/.can/index.tsv. The workflow does not establish restrictive permissions for the CAN directory, store directory, index, or cached response.

Shell redirection creates files according to the process's current umask. With a common 022 umask, newly created files are ordinarily mode 0644, making them readable by other local users when parent-directory traversal permissions permit access. API and MCP responses can contain confidential reports, personal information, internal operational data, access tokens, or other secrets. The WHAT field can additionally expose queried resources and tool activity.

SHA-256 content addressing provides integrity identification, but it does not provide confidentiality or access control. The content hash used as a filename does not protect the plaintext response.

Attack Path

1. A user or agent follows the documented workflow while operating with a permissive default umask.
2. A tool or API returns sensitive content in RESULT.
3. The response is written in plaintext to ~/.can/store/$WHERE, while associated metadata is appended to ~/.can/index.tsv.
4. The resulting files inherit default permissions rather than explicitly restricted permissions.
5. Another local account or process with filesystem access to the user's CAN directory reads the index and ca ...[truncated 811 chars]

Remediation

View remediation

Remediation Suggestions

Establish a private storage area and restrictive creation mask before writing any content:

bash

umask 077
install -d -m 700 "$HOME/.can/store"
touch "$HOME/.can/index.tsv"
chmod 600 "$HOME/.can/index.tsv"

printf '%s\t%s\t%s\n' "$WHEN" "$WHERE" "api.example.com/data" >> "$HOME/.can/index.tsv"
printf '%s' "$RESULT" > "$HOME/.can/store/$WHERE"
chmod 600 "$HOME/.can/store/$WHERE"

Additional hardening should include:

• Do not cache secrets or sensitive responses by default.
• Obtain explicit user approval before persisting confidential tool output.
• Document retention periods and provide a secure deletion mechanism.
• Consider encrypting cached sensitive content with a user-controlled key.
• Validate existing directory ownership and reject symbolic links before writing.
• Use printf instead of echo -e to avoid implementation-dependent escape processing.
• Redact credentials and sensitive query identifiers from the WHAT metadata field.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 135)May include surrounding context.

Agent calls an API via MCP. Gets a result. Hashes it, timestamps it, logs the tool name.

bash

RESULT=$(curl -s api.example.com/data)
WHEN=$(date +%s%3N)
WHERE=$(echo -n "$RESULT" | sha256sum | awk '{print $1}')
echo -e "$WHEN\t$WHERE\tapi.example.com/data" >> ~/.can/index.tsv

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The concrete implementation shown in the README is a local bash command that hashes content and appends to ~/.can/index.tsv. However, the description expands CAN into a peer-to-peer verification/routing system with asking peers, caching from peers, and trust propagation, which is materially broader than the actual documented behavior and conflicts with the earlier 'zero dependencies'/'not a network protocol' framing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is not merely omitted detail: the documentation explicitly denies protocol/network behavior, then describes CAN as if it supports network routing and peer query semantics. Those statements create an active contradiction about whether CAN is only a local verification format or a networked system behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example encourages fetching remote API data and storing both content-derived hashes and metadata in a persistent local cache without discussing sensitivity, retention, or access controls. In an agent/MCP context, API responses may contain secrets, personal data, or proprietary outputs, so silently persisting them can create confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The documented behavior establishes session persistence by creating a durable directory and log file in ~/.can. In an agent skill, persistent state can outlive the current task and accumulate potentially sensitive metadata across runs, making this more dangerous than an ordinary shell example because users may not expect long-term retention by an automation component.

Content

Scanner excerpt · README.md (reported line 180)May include surrounding context.

Try it

bash

mkdir -p ~/.can
echo -e "WHEN\tWHERE\tWHAT" > ~/.can/index.tsv

# stamp something

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly promotes persistent local logging of MCP-retrieved data to ~/.can/index.tsv without any warning about retention, sensitivity, or user consent. Even if only hashes and metadata are stored in some examples, the documented purpose is to create durable historical records of tool outputs, which can expose usage patterns, sensitive identifiers, or facilitate unintended retention of data derived from private tool responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The MCP example shows an agent taking a live tool result and creating a persistent local log entry tied to that result, again without any warning about sensitive content, regulated data, or user expectations around persistence. In agent/tooling contexts, MCP responses may contain confidential business, personal, or proprietary information, so normalizing automatic local retention increases the chance of privacy leaks, unauthorized forensic recovery, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The quick-start commands create and modify persistent files under the user's home directory without warning, which is a transparency and safety issue. While the writes are local and limited, users should be clearly informed that running the commands changes persistent state and may record filenames or hashes of local content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.