Security audit

Bat

Security checks for vulnerabilities and agentic risk

Overview

This is a local note/logging command-line skill with disclosed local persistence and no evidence of network access, credential use, privilege escalation, or destructive behavior.

Install only if you are comfortable with notes and command history being stored locally in plain-text files under the Bat data directory. Do not put secrets or sensitive credentials in entries or search terms, and do not rely on remove to delete stored notes because it only logs a removal action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill’s stated purpose emphasizes simple local note logging, search, and export, but the documented behavior expands into persistent command-history logging and several ancillary commands that are not central to that purpose. This matters because users may disclose sensitive notes or operational context without realizing that all commands are also recorded in a separate history file, creating unexpected data retention and privacy risk; additionally, advertising a remove capability that only marks entries as removed can mislead users into believing data was deleted when it remains recoverable.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a focused local notes/activity-log tool for adding notes, searching entries, and exporting a simple log. The help text and command surface instead present a generic 'Multi-purpose utility tool' with unrelated commands such as run, config, status, init, info, and remove, which broadens the apparent behavior beyond the declared purpose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text advertises 'remove' as a command, implying entries can be deleted from the local log. However, the implementation only prints 'Removed' and writes to history without modifying the data file, so the documentation contradicts actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script persistently logs command arguments to history.log and stores user content under a local data directory without clear disclosure in the help or description. This can expose sensitive notes, search terms, or operational context to other local processes/users with access to the account, and users may not realize that all actions are being retained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The add command writes arbitrary user-provided text to a persistent log file with no explicit warning that entries are stored long-term. In a note-taking skill this storage is somewhat expected, but the lack of clear notice still creates privacy risk, especially if users enter secrets or assume ephemeral behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.