Code Generator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:07 PM UTC
• Version: 2.3.4

Overview

This is a local code-scaffolding skill with some quality and privacy caveats, but I found no evidence of exfiltration, destructive behavior, privilege escalation, or hidden agent control.

Install only if you are comfortable with a local template generator. Review generated code before running or deploying it, especially when descriptions or names came from an untrusted source. Avoid passing secrets or confidential project identifiers to the secondary script because it can write local command history, and do not deploy generated Flask debug templates unchanged.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/script.sh:531
• Finding: Undocumented Persistent Plaintext Activity History<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:6-7, 531-537` **Vulnerability Type**: Plaintext storage of user-supplied generation metadata **Risk Level**: Low ### Technical Analysis The undocumented secondary implementation creates a persistent data directory whenever it runs and records command metadata in a plaintext history file: ```bash DATA_DIR="${CODE_GEN_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/code-generator}" mkdir -p "$DATA_DIR" ``` ```bash cmd_history() { local log="$DATA_DIR/history.log" [ -f "$log" ] && tail -20 "$log" || echo "No history yet." } _log() { echo "$(date '+%Y-%m-%d %H:%M') | $1 | $2" >> "$DATA_DIR/history.log" } ``` Generator functions pass user-supplied project, class, resource, and model names to `_log`. These values can reveal confidential project identifiers or development activity. The script does not obtain explicit consent, redact sensitive values, impose retention limits, or explicitly establish restrictive permissions. This behavior is not disclosed in `SKILL.md`, which identifies only `scripts/codegen.sh` as the main script. The history file is local and no code was found that transmits it to an external party. ### Attack Path 1. A user invokes `scripts/script.sh` with a confidential project, model, class, or resource name. 2. The corresponding command passes that value to `_log`. 3. `_log` appends the timestamp, command type, and supplied value to `history.log`. 4. The record persists after the command terminates. 5. Another local process or account with sufficient filesystem access can inspect the retained metadata. ### Impact Assessment The issue does not provide privilege escalation, remote code execution, or network exfiltration. Its scope is limited to disclosure of locally retained command metadata to principals that can read the history file. Potentially exposed information includes project names, internal resource names, model names, and other user-supplied identi ...[truncated 141 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Disable command history by default and require explicit user opt-in. - Clearly document what data is stored, where it is stored, and how long it is retained. - Avoid recording raw user input; store only a generic command type where possible. - Create the directory with restrictive permissions, such as mode `0700`. - Create the history file with mode `0600`, independent of an unsafe user umask. - Add a command to clear history and support configurable retention limits. - Warn users not to place secrets, credentials, tokens, or confidential names in generator arguments. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/codegen.sh:18
• Finding: Generated Source Code Injection Through Unvalidated Descriptions and Names<![CDATA[ ## Vulnerability Details **File Location**: `scripts/codegen.sh:18-38` and multiple template substitutions in `scripts/script.sh:38-295` **Vulnerability Type**: Source code injection in generated output **Risk Level**: Medium ### Technical Analysis The generator accepts arbitrary command-line descriptions, exports them through an environment variable, and inserts them directly into generated source-code contexts: ```bash python3 << 'PYEOF' import os inp = os.environ.get("CODEGEN_INPUT", "").strip() if not inp: inp = "calculate fibonacci number" desc = inp print("=" * 60) print(" FUNCTION GENERATOR") print("=" * 60) print() print("Description: {}".format(desc)) print() words = desc.lower().replace("-", "_").replace(" ", "_") func_name = "_".join(words.split("_")[:4]) print("[Python] # {}.py".format(func_name)) print("-" * 40) print('def {}(n):'.format(func_name)) print(' """') print(' {}'.format(desc)) print(' ') print(' Args:') print(' n: Input parameter') print(' ') print(' Returns:') print(' Result of computation') print(' """') ``` The input is used both as an identifier and inside a Python docstring without identifier validation or context-aware escaping. A crafted multiline description can close the generated triple-quoted string and append arbitrary Python statements. Characters that are invalid in an identifier can also make the generated function definition syntactically invalid. The secondary generator follows a similar pattern. For example, it interpolates unvalidated names into generated class names, API routes, source strings, and framework templates: ```bash cmd_api() { local name="${1:?Usage: code-generator api <name> [framework]}" local fw="${2:-fastapi}" case "$fw" in fastapi|fast) cat << APIEOF from fastapi import FastAPI, HTTPException from pydantic import BaseModel from typing import List, Optional import uuid app = FastAPI(title="${name^} API") cl ...[truncated 1945 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Apply strict, language-specific validation to every generated identifier. - Permit only a conservative identifier character set and reject multiline identifier input. - Transform descriptive text into identifiers with a dedicated sanitizer rather than simple space replacement. - Escape descriptions according to their exact output context, including strings, comments, docstrings, paths, URLs, and template literals. - Reject control characters, embedded null bytes, and unexpected line breaks. - Use language-aware abstract syntax tree or template-generation libraries where practical. - Keep display descriptions separate from generated identifiers. - Parse, compile, or lint generated output before labeling it runnable. - Add adversarial tests covering quote termination, triple-quote termination, template-literal interpolation, newlines, comment termination, and invalid identifiers. - Clearly warn users to review generated code before executing or deploying it. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:289
• Finding: Generated Flask Application Enables Debug Mode by Default<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:289-291` **Vulnerability Type**: Unsafe development configuration in generated application **Risk Level**: Medium ### Technical Analysis The Flask API template starts the generated application with debug mode enabled: ```python if __name__ == '__main__': app.run(debug=True) ``` Flask debug mode is intended only for trusted development environments. It exposes detailed exception information and can activate the interactive Werkzeug debugger. If the generated application is made reachable by untrusted users, debugger functionality can expose application internals and may enable code execution under circumstances where the interactive debugger is accessible. The default Flask host is normally loopback-only, which limits immediate exposure. However, generated scaffolds are commonly modified, containerized, proxied, or deployed. Retaining `debug=True` after changing the binding or deployment configuration can turn this unsafe default into an externally exploitable condition. ### Attack Path 1. A user generates the Flask API scaffold through `scripts/script.sh`. 2. The generated source retains `app.run(debug=True)`. 3. The user runs or deploys the scaffold and makes it reachable by an untrusted network, directly or through a proxy or container configuration. 4. An attacker sends input that triggers an unhandled exception. 5. Flask returns detailed debugging information and potentially exposes interactive debugger functionality. 6. If the debugger can be accessed, the attacker may inspect application state and potentially execute Python code with the application process's privileges. This path requires the debug server to be exposed to the attacker; the template's ordinary loopback binding reduces exposure when used unchanged on a local workstation. ### Impact Assessment Potential impact includes: - Disclosure of stack traces, source locations, configuration details, and applicati ...[truncated 394 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Generate `app.run(debug=False)` or omit the `debug` argument entirely. - Require an explicit development-only environment variable to enable debugging. - Fail safely when debug mode is requested in a production environment. - Add a prominent generated-code warning that the Flask development server must not be used in production. - Recommend a production WSGI server and production-safe configuration. - Add automated tests that reject generated templates containing unconditional `debug=True`. - Keep debug configuration outside source code and separate development settings from deployment settings. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A documented-purpose/actual-behavior mismatch is security-relevant because users and reviewers may trust the skill to only generate code, while hidden undeclared behaviors such as local history logging introduce unexpected data handling. Misstated or unimplemented features also undermine transparency and can mask privacy-impacting or policy-bypassing behavior in supporting scripts.

Credential Access

High

• Category: Privilege Escalation

Content

case "$lang" in
        python|py)
            echo "__pycache__/"; echo "*.pyc"; echo ".venv/"; echo "dist/"; echo "*.egg-info/"
            echo ".env"; echo ".pytest_cache/"; echo ".mypy_cache/"
            ;;
        node|js|ts)
            echo "node_modules/"; echo "dist/"; echo ".env"; echo "*.log"; echo "coverage/"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

case "$lang" in
        python|py)
            echo "__pycache__/"; echo "*.pyc"; echo ".venv/"; echo "dist/"; echo "*.egg-info/"
            echo ".env"; echo ".pytest_cache/"; echo ".mypy_cache/"
            ;;
        node|js|ts)
            echo "node_modules/"; echo "dist/"; echo ".env"; echo "*.log"; echo "coverage/"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

case "$lang" in
        python|py)
            echo "__pycache__/"; echo "*.pyc"; echo ".venv/"; echo "dist/"; echo "*.egg-info/"
            echo ".env"; echo ".pytest_cache/"; echo ".mypy_cache/"
            ;;
        node|js|ts)
            echo "node_modules/"; echo "dist/"; echo ".env"; echo "*.log"; echo "coverage/"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The phrase "Describe what you need, get working code" is a very broad activation-style description without clear boundaries on what kinds of requests should or should not invoke the skill. Because the file does not provide exclusion conditions or negative examples, ordinary conversational requests about coding could unintentionally match this skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persistently logs user-supplied names and arguments to a history file under the user's data directory without notice, consent, retention controls, or sanitization. In this skill context, generated names and model fields may contain proprietary project names, internal API names, dataset labels, or other sensitive development metadata, creating an avoidable privacy and information-disclosure risk on shared systems or in backed-up home directories.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a multi-language code generator that can generate test code, CRUD operations, refactoring suggestions, and language conversion guides. In the command dispatch, `test`, `crud`, and `snippet` are placeholders that only print TODO messages, and there is no implementation for refactoring suggestions or language conversion at all, so the actual behavior does not match the stated skill capabilities.

Vague Triggers

Low

• Confidence: 85% confidence
• Finding: The listed commands are short generic terms like "function", "class", "test", and "convert", which can appear in many ordinary software conversations. Without context constraints or examples distinguishing invocation from normal discussion, the trigger scope is ambiguous for a markdown skill description.

Static analysis

No suspicious patterns detected.