Security audit

Changelog

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as a changelog tool, but its script is mainly a persistent local text logger/exporter with unclear scope and unsafe export handling.

Review this carefully before installing. Use it only if you intentionally want a local plaintext activity log under ~/.local/share/changelog, and avoid passing secrets, private prompts, tokens, or sensitive changelog drafts to its commands. Treat exported JSON/CSV as untrusted and inspect or sanitize it before sharing or opening in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:63
Finding: Unescaped User-Controlled Data in JSON and CSV Exports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 63–83 **Vulnerability Type**: Improper output encoding, JSON injection, and CSV formula injection **Risk Level**: Medium ### Vulnerable Code ```bash for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` The relevant unsafe output operations are at lines 68 and 80. ### Technical Analysis Arguments supplied to commands such as `check`, `generate`, and `report` are stored without normalization in log files under `~/.local/share/changelog/`. The export function subsequently inserts those stored values directly into JSON and CSV output. For JSON output, the script uses string interpolation without escaping quotation marks, backslashes, control characters, or line breaks. A value containing JSON syntax can terminate the intended string and inject additional properties or objects, or simply produce invalid JSON. Downstream programs may reject the export or process attacker-injected structure as trusted data. For CSV output, fields are concatenated with commas without RFC 4180 quoting. Commas, quotation marks, carriage returns, and line feeds can alter the row or column structure. In addition, values beginning with charact ...[truncated 1589 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate JSON through a proper serializer rather than manual string interpolation. For example, use `jq` with `--arg` so quotation marks, backslashes, control characters, and newlines are escaped correctly. 2. Implement RFC 4180-compliant CSV encoding: - Enclose every field in double quotes. - Replace each embedded double quote with two double quotes. - Preserve embedded commas and line breaks only inside properly quoted fields. 3. If CSV files may be opened in spreadsheet applications, neutralize formula-leading values. Prefix cells beginning with `=`, `+`, `-`, or `@` with a single quote or apply another documented spreadsheet-safe encoding policy. 4. Treat log contents as untrusted data even though the files are local, because command arguments and imported or modified log entries can be attacker-controlled. 5. Add regression tests covering quotation marks, backslashes, commas, carriage returns, newlines, Unicode characters, JSON fragments, and spreadsheet formula prefixes. 6. Validate generated JSON with a standards-compliant parser and test generated CSV with a standards-compliant CSV reader before reporting a successful export. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description is overly vague and implies a changelog-focused command-line tool, but the code behaves primarily as a generic local logging/record-keeping utility with multiple named commands that just append arbitrary input to log files. It also includes undeclared capabilities such as persistent storage in the user's home directory, export, search, recent activity, and status/statistics reporting. These are material behaviors not conveyed by the declared purpose, so the description does not accurately represent the code.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The manifest description says "command-line tool for everyday use" and "Use when you need changelog," which is vague and does not clearly bound when this skill should be invoked. This broad wording lacks specific trigger constraints or exclusion conditions, increasing the chance of unintended activation in ordinary contexts.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script’s behavior substantially differs from the stated 'changelog' purpose: instead of operating on changelog content, it mainly stores arbitrary user-provided text across many generic commands into persistent local logs. This mismatch is risky because users may disclose sensitive prompts, file contents, tokens, or operational data under the assumption they are invoking a normal changelog utility, while the tool silently builds a durable activity record.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The core logging design stores and later re-displays user-provided inputs in plain text, making accidental disclosure likely through local inspection, terminal output, or exports. Because the tool spans many generic commands, it can collect a wide range of unrelated sensitive content beyond what a changelog utility would reasonably need.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The export functionality aggregates all plain-text logs into json/csv/txt outputs, increasing the chance of bulk disclosure of previously entered data. For a tool presented as a changelog helper, broad retention and easy export are not well-justified and magnify privacy and data handling risk if local files are accessed by other users, backup systems, or malware.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: These command handlers append raw user input to persistent log files with no privacy notice, consent, redaction, or retention controls. In practice, users may pass secrets, internal changelog drafts, issue references, or copied content that then remains on disk and is later redisplayed or exported.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: The help output documents commands such as check, validate, generate, format, lint, explain, convert, template, diff, preview, fix, report, stats, export, status, help, and version, but it does not list 'search' or 'recent' even though both are implemented in dispatch. This documentation contradicts the actual interface exposed by the script and misstates the tool's available behaviors.

Static analysis

No suspicious patterns detected.