Security audit

Cache

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local cache tool, but it should be reviewed because it can store API or session data in plaintext files without enforcing private file permissions.

Review before installing if you might cache tokens, session data, private API responses, or personal information. Use it only for data you are comfortable storing in plaintext under ~/.cache-tool, avoid exporting cache backups into shared or source-controlled locations, and be aware that flush can delete the cache without confirmation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:7
Finding: Cache Data Stored in Plaintext Without Enforced Restrictive Permissions
Content: View full analysis
"$CONFIG_FILE" fi ``` ### Technical Analysis The script creates its data directory, cache database, and configuration file without explicitly setting restrictive permissions. Their effective permissions therefore depend on the invoking process's `umask`. With a common `umask` of `022`, the directory may be created as `0755` and files as `0644`, allowing other local users to traverse the directory and read cached data. Cache values are serialized directly as plaintext JSON in `~/.cache-tool/data.jsonl`. The documented use cases include API responses and session data, which may contain tokens, personal data, or other sensitive content. No encryption or warning against storing credentials is provided. The script also does not verify that the cache paths are regular files rather than symbolic links. Although exploitation requires control over the relevant path or home-directory context, validating file types would provide additional defense against unintended file access. ### Attack Path 1. A user runs the Skill with a permissive `umask`, such as `022`. 2. The script creates `~/.cache-tool` and `data.jsonl` without applying explicit modes. 3. The user stores an API response, session value, token, or other sensitive data through the `set` or `import` command. 4. The value is written in plaintext to `~/.cache-tool/data.jsonl`. 5. On a multi-user system, another local account or process with filesystem access reads the cache file and obtains the stored values. Exploitation is limited to environments where another principal ...[truncated 614 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents commands that read and write local files and use environment/code capabilities, but it declares no explicit tool scope or permission boundaries. In an agent setting, this can cause the runtime to grant broader-than-expected access or leave users unaware that the skill can modify persistent local state under the user's home directory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill exposes a destructive flush operation, including pattern-based deletion, but does not warn users that it can permanently remove cached data. In agent-driven use, a vague or unguarded destructive command increases the chance of accidental data loss, especially when commands are generated or parameterized automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The export feature writes cached contents to an arbitrary JSON file, but the skill does not warn that cached values may contain sensitive API responses, session data, or personal information. This can lead to unintended disclosure if exported files are written to insecure locations, committed to source control, or shared with other processes/users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The flush command deletes the entire cache when no pattern is provided by truncating the data file, which is a destructive and irreversible operation. Although the help text documents the command, the code provides no confirmation prompt or prior user-facing warning at the point of execution before all entries are deleted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.