Security audit

Communityhub

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local community-management helper, but it also stores user-provided data and command history with limited disclosure and weak filesystem safeguards.

Review this skill before installing if you may enter sensitive community, business, or member information. It stores some inputs and command history locally, has a misleading remove command, and includes an always-on promotional footer in one script's output. There is no evidence of credential theft, remote code loading, destructive behavior, or network exfiltration in the inspected files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: scripts/community.sh:29
Finding: Forced Promotional Content Contaminates Skill Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Environment-Controlled Data Directory Permits Symlink-Following File Writes
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } ``` ### Technical Analysis The storage directory can be selected through `COMMUNITYHUB_DIR` or `XDG_DATA_HOME`. The script creates or uses this directory without: - Canonicalizing and validating its path. - Checking directory ownership or permissions. - Rejecting symbolic links. - Applying restrictive directory and file permissions. - Opening files with protections equivalent to `O_NOFOLLOW`. - Verifying that `data.log` and `history.log` are regular files owned by the executing user. Shell append redirection follows symbolic links. Consequently, if an attacker can control the selected directory or pre-create entries inside it, `data.log` or `history.log` can be symbolic links to other files writable by the process. Commands such as `add` and all commands that invoke `_log` will then append content to those targets. The write capability remains constrained by the operating-system permissions of the user executing the script. The script does not independently bypass filesystem permissions or obtain elevated privileges. ### Attack Path 1. An attacker controls `COMMUNITYHUB_DIR`, `XDG_DATA_HOME`, or a writable directory selected through one of those variables. 2. The attacker creates `data.log` or `history.log` as a symbolic link to another file. 3. A victim executes the script with the manipulated environment or uses the attacker-prepared directory. 4. The victim invokes `add`, causing an append through `data.log`, or in ...[truncated 854 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
## Usage Run any command with your input to get started. Use `help` to see all available commands. ## About

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill hardcodes an 'English only in main channels' rule, which is an exclusionary policy without any user choice, localization support, or documented operational justification. In a community-management skill, this can enable discriminatory moderation practices and unfairly disadvantage non-English speakers, creating policy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text advertises a remove command, implying deletion of an existing entry from the tool's data store. However, the implementation only prints Removed: $1 and writes a history log entry, without changing data.log, so the documented intent contradicts actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script writes to persistent files in the user's data directory, including command history and arguments, but the skill provides no warning comments or help text disclosing that behavior. Because logged arguments may contain sensitive user data and the operation is not clearly described in the user-facing help, this is a missing disclosure for a safety-relevant file write/data retention behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The add command appends arbitrary user input to a local database file, which affects user data persistently, but the help text only says 'Add entry' and does not warn that content will be stored on disk. This lacks user disclosure for a file write operation that may surprise users, especially given the generic 'Multi-purpose utility tool' description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest description includes substantial Chinese text alongside English, and the document repeats this bilingual content without stating whether output language follows user preference. This can violate a language-choice policy when a skill implicitly forces or defaults to a language without explicit opt-in.
Content: No source excerpt is available for this finding.