Communityhub

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:07 AM UTC
• Version: 2.0.0

Overview

This skill appears to be a local community-management helper, but it also stores user-provided data and command history with limited disclosure and weak filesystem safeguards.

Review this skill before installing if you may enter sensitive community, business, or member information. It stores some inputs and command history locally, has a misleading remove command, and includes an always-on promotional footer in one script's output. There is no evidence of credential theft, remote code loading, destructive behavior, or network exfiltration in the inspected files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: scripts/community.sh:29
• Finding: Forced Promotional Content Contaminates Skill Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/community.sh:29` **Vulnerability Type**: Forced output injection **Risk Level**: Low ### Vulnerable Code ```bash print("\nPowered by BytesAgain | bytesagain.com") ``` ### Technical Analysis The script unconditionally appends promotional content and an external domain to standard output after processing every supported command. This behavior is unrelated to the requested community-management result and cannot be disabled by the caller. Because `SKILL.md` identifies standard output as the command's result channel, an AI agent or automation system may treat this footer as part of the requested response and relay it to users. This creates a deterministic output-hijacking condition in which invoking otherwise legitimate functionality causes unrelated third-party promotion to be inserted into the result. The code does not contact the external domain or retrieve remote content. The issue is limited to forced content insertion. ### Attack Path 1. An agent or user invokes any command in `scripts/community.sh`. 2. The script generates the requested template, rules, engagement ideas, metrics, or help output. 3. Line 29 unconditionally appends the BytesAgain promotional message and domain. 4. An agent or downstream system captures standard output as the command result. 5. The unrelated promotional content is relayed or published with the legitimate result. ### Impact Assessment The issue affects the integrity of generated output. An invoking agent may unknowingly distribute advertising or an external-domain reference in user-facing responses. It does not provide filesystem access, code execution, elevated privileges, persistence, or network access. The practical scope is limited to contamination of output produced by this script. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the unconditional promotional footer from normal command output. - If attribution is required, expose it through a dedicated `about` or `version` command. - Alternatively, require an explicit opt-in option such as `--show-attribution`. - Keep standard output limited to content directly requested by the caller. - If diagnostic or attribution information must be emitted, send it to standard error and document the behavior clearly. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:5
• Finding: Environment-Controlled Data Directory Permits Symlink-Following File Writes<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:5-8, 33, 54` **Vulnerability Type**: Unsafe filesystem handling and symbolic-link following **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${COMMUNITYHUB_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/communityhub}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR" ``` ```bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` ```bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } ``` ### Technical Analysis The storage directory can be selected through `COMMUNITYHUB_DIR` or `XDG_DATA_HOME`. The script creates or uses this directory without: - Canonicalizing and validating its path. - Checking directory ownership or permissions. - Rejecting symbolic links. - Applying restrictive directory and file permissions. - Opening files with protections equivalent to `O_NOFOLLOW`. - Verifying that `data.log` and `history.log` are regular files owned by the executing user. Shell append redirection follows symbolic links. Consequently, if an attacker can control the selected directory or pre-create entries inside it, `data.log` or `history.log` can be symbolic links to other files writable by the process. Commands such as `add` and all commands that invoke `_log` will then append content to those targets. The write capability remains constrained by the operating-system permissions of the user executing the script. The script does not independently bypass filesystem permissions or obtain elevated privileges. ### Attack Path 1. An attacker controls `COMMUNITYHUB_DIR`, `XDG_DATA_HOME`, or a writable directory selected through one of those variables. 2. The attacker creates `data.log` or `history.log` as a symbolic link to another file. 3. A victim executes the script with the manipulated environment or uses the attacker-prepared directory. 4. The victim invokes `add`, causing an append through `data.log`, or in ...[truncated 854 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Resolve the configured directory to a canonical path and ensure it is within an approved storage root. - Reject directories and data files that are symbolic links. - Verify that the storage directory is owned by the expected user and is not writable by untrusted users. - Create the directory with restrictive permissions, for example: ```bash umask 077 mkdir -p -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" ``` - Create data files with mode `0600`. - Prefer a helper written in a language that can open files with `O_NOFOLLOW`, `O_CREAT`, and `O_APPEND`, then verify the opened file with `fstat`. - Confirm that each destination is a regular file owned by the executing user before writing. - Avoid preserving attacker-controlled `COMMUNITYHUB_DIR` or `XDG_DATA_HOME` when invoking the script across privilege boundaries. - Quote and validate all path values and reject unexpected empty, relative, or traversal-containing paths. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Usage

Run any command with your input to get started. Use `help` to see all available commands.

## About

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill hardcodes an 'English only in main channels' rule, which is an exclusionary policy without any user choice, localization support, or documented operational justification. In a community-management skill, this can enable discriminatory moderation practices and unfairly disadvantage non-English speakers, creating policy, compliance, and trust risks.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The help text advertises a `remove` command, implying deletion of an existing entry from the tool's data store. However, the implementation only prints `Removed: $1` and writes a history log entry, without changing `data.log`, so the documented intent contradicts actual behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This shell script writes to persistent files in the user's data directory, including command history and arguments, but the skill provides no warning comments or help text disclosing that behavior. Because logged arguments may contain sensitive user data and the operation is not clearly described in the user-facing help, this is a missing disclosure for a safety-relevant file write/data retention behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The add command appends arbitrary user input to a local database file, which affects user data persistently, but the help text only says 'Add entry' and does not warn that content will be stored on disk. This lacks user disclosure for a file write operation that may surprise users, especially given the generic 'Multi-purpose utility tool' description.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The manifest description includes substantial Chinese text alongside English, and the document repeats this bilingual content without stating whether output language follows user preference. This can violate a language-choice policy when a skill implicitly forces or defaults to a language without explicit opt-in.

Static analysis

No suspicious patterns detected.