Trash Cli

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:23 AM UTC
• Version: 1.0.5

Overview

This is a straightforward trash-cli guide, but users should handle permanent trash removal and sudo setup examples carefully.

Install only from package sources you trust. Prefer recoverable commands such as trash-put and trash-restore for normal use, and confirm matches before using trash-empty or trash-rm because those remove items from trash permanently. Do not run the /.Trash sudo setup unless you understand that it changes a system-wide directory on the filesystem.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-26
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Medium

yaml

{
  "id": "pip",
  "kind": "pip",
  "package": "trash-cli",
  "label": "Install trash-cli (pip)",
}

The installation documentation also presents the corresponding unpinned command:

bash

pip install trash-cli

Technical Analysis

The pip installation definition identifies trash-cli only by package name and does not constrain it to a reviewed version or verify its integrity. Consequently, the package resolved during installation can change after this Skill has been audited.

This is not evidence that the current trash-cli package is malicious. However, if the package source, maintainer account, distribution infrastructure, or a future release were compromised, the Skill could install attacker-controlled content. Python packages may execute code during installation or provide malicious executables that run when the Skill later invokes the installed commands.

Attack Path

1. An attacker compromises the package publisher, package repository, or a future package release.
2. The attacker publishes a malicious version under the expected trash-cli package name.
3. A user or agent follows the Skill metadata or documentation and installs the package without a version constraint.
4. The package manager resolves the attacker-controlled release.
5. Malicious behavior executes during installation or when one of the installed trash-* commands is invoked.

Impact Assessment

Exploitation could execute arbitrary code with the privileges of the account performing the installation or invoking the installed tools. Potential effects include modification or deletion of user files, credential theft, execution of additional payloads, and compromise of operations delegated to the affected agent.

The package declaration does not itself reque ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an explicitly reviewed version in both the installation metadata and documentation.
• Use a lock file or hash-verifying installation process where supported, such as pip requirements containing --hash entries.
• Prefer packages obtained from trusted operating-system repositories when their provenance and update process satisfy project requirements.
• Record the expected official package source and verify that the resolved package originates from it.
• Review and test dependency updates before changing the pinned version.
• Avoid performing package installation as root unless it is strictly required.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:210

Finding

Non-Atomic Creation of a Privileged World-Writable Trash Directory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:210-212
Vulnerability Type: Unsafe permissions transition on a system-wide directory
Risk Level: Low

bash

sudo mkdir --parent /.Trash
sudo chmod a+rw /.Trash
sudo chmod +t /.Trash

Technical Analysis

The commands create or reuse a root-level directory and apply its permissions in separate operations. The second command grants every local user read and write access before the third command enables the sticky bit.

During the interval between those commands, /.Trash is world-writable without sticky-bit protection. Another local user may be able to rename or remove entries owned by other users during that interval. Because the commands use sudo and operate on an absolute root-level path, an incorrect preexisting object or unexpected directory state could also make the permission changes affect a system-wide resource.

The issue requires the commands to be executed and generally requires a concurrent, untrusted local user. The documentation does not itself execute these commands.

Attack Path

1. An administrator follows the documented sequence on a multi-user system.
2. sudo chmod a+rw /.Trash makes the directory writable by all local users.
3. Before sudo chmod +t /.Trash completes, a local attacker accesses the directory.
4. The attacker creates, renames, or removes entries while sticky-bit ownership restrictions are absent.
5. This may interfere with files being placed into the shared trash directory or manipulate its state before the final permissions are applied.

Impact Assessment

The attacker does not obtain root privileges solely through this sequence. The direct impact is limited to manipulation of entries in /.Trash during the unsafe permissions window. On a multi-user system, this could cause deletion, replacement, denial of service, or integrity loss involving trash entries belonging to other users.

The scope is syste ...[truncated 205 chars]

Remediation

View remediation

Remediation Suggestions

• Create the directory with its final permissions atomically:

  bash

  sudo install -d -m 1777 /.Trash
  

• Before changing permissions, verify that /.Trash is an actual directory, is not a symbolic link, and has the expected owner and filesystem location.

• Use a command such as stat to inspect any existing path and avoid silently modifying an unexpected object.

• Confirm that a shared top-level trash directory is required for the relevant mounted filesystem before creating it.

• Document that this operation changes system-wide permissions and should be performed only by an administrator on a trusted system.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

bash

trash-restore                       # Interactive restore
trash-restore --overwrite          # Overwrite existing files
trash-restore --sort date          # Sort by date (default)
trash-restore --sort path          # Sort by path

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

- Enter the number to restore that file
- Use `0-2,3` to restore multiple files
- Use `--overwrite` to replace existing files

## trash-empty

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

trash-rm permanently removes matching items from the trash, and allowing broad patterns or full-path targeting increases the chance of destructive misuse. In a skill marketed primarily as safe, recoverable deletion, exposing irreversible pattern-based purging without strong safeguards makes accidental or overbroad deletion more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

trash-rm # Remove files matching pattern trash-rm '*.o' # Remove all .o files trash-rm foo # Remove all files named "foo" trash-rm /full/path # Remove by original path

text

**Note**: Use quotes to protect pattern from shell expansion.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

pip install trash-cli

# Via apt (Debian/Ubuntu)
sudo apt install trash-cli

# Via pacman (Arch Linux)
sudo pacman -S trash-cli

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

pip install trash-cli

# Via apt (Debian/Ubuntu)
sudo apt install trash-cli

# Via pacman (Arch Linux)
sudo pacman -S trash-cli

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

sudo pacman -S trash-cli

Via dnf (Fedora)

sudo dnf install trash-cli

text

## Commands Overview

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

sudo pacman -S trash-cli

Via dnf (Fedora)

sudo dnf install trash-cli

text

## Commands Overview

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is described as providing recoverable deletion via moving files to trash, but the documentation also teaches permanent deletion commands such as trash-empty and trash-rm. That broadens the operational scope from safe deletion to irreversible destruction, which can mislead an agent or user into performing actions with higher destructive impact than the manifest suggests.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The documentation instructs creating a top-level /.Trash directory with root privileges. While this may be valid system administration guidance, it causes privileged filesystem modification outside the user's home and can alter global trash behavior on a partition, increasing the blast radius if followed incorrectly.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

If you need to create a trash directory on a different partition:

bash

sudo mkdir --parent /.Trash
sudo chmod a+rw /.Trash
sudo chmod +t /.Trash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

sudo chmod a+rw /.Trash makes the top-level trash directory world-readable and world-writable. Even though the sticky bit is added later, broad permissions on a shared top-level directory can still create misuse opportunities and should be documented carefully because it modifies a global filesystem location with elevated privileges.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

bash

sudo mkdir --parent /.Trash
sudo chmod a+rw /.Trash
sudo chmod +t /.Trash

Static analysis

No suspicious patterns detected.