Kaizen

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:32 PM UTC
• Version: 1.0.0

Overview

The skill presents itself as a Kaizen reference, but its script is an under-disclosed local tracker that persists, deletes, exports, and edits data.

Review before installing. This does not show remote exfiltration or a backdoor, but it is not just a Kaizen reference: it creates persistent local files, can delete and export stored entries, and has unsafe shell handling around configuration. Install only if you want a local tracker and are comfortable with its file writes under ~/.kaizen or KAIZEN_DIR.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

other

Note

• Location: SKILL.md:20

Finding

Documented Skill Behavior Does Not Match the Implemented State-Changing Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-95; scripts/script.sh:21-35,154-167
Vulnerability Type: Undisclosed state-changing functionality
Risk Level: Low

Technical Analysis

The Skill documentation advertises a read-only Kaizen reference utility with commands such as:

bash

scripts/script.sh intro
scripts/script.sh event
scripts/script.sh pdca
scripts/script.sh gemba
scripts/script.sh a3
scripts/script.sh daily
scripts/script.sh examples
scripts/script.sh checklist

The script does not implement those commands. Its help text and command dispatcher instead expose a persistent local tracker:

bash

Commands:
  status          Show current status
  add             Add new entry
  list            List all entries
  search          Search entries
  remove          Remove entry by number
  export          Export data to file
  stats           Show statistics
  config          View or set config
  help              Show this help
  version           Show version

bash

case "$CMD" in
    status) cmd_status "$@" ;;
    add) cmd_add "$@" ;;
    list) cmd_list "$@" ;;
    search) cmd_search "$@" ;;
    remove) cmd_remove "$@" ;;
    export) cmd_export "$@" ;;
    stats) cmd_stats "$@" ;;
    config) cmd_config "$@" ;;
    help|--help|-h) show_help ;;
    version|--version|-v) echo "kaizen v$VERSION -- Powered by BytesAgain" ;;
    *) echo "Unknown: $CMD"; echo "Run: kaizen help"; exit 1 ;;
esac

The script creates a persistent data directory before dispatching every command, including help and version:

bash

CMD="${1:-help}"
shift 2>/dev/null || true
_ensure_dirs

This mismatch conceals local storage, modification, deletion, and export behavior from users reviewing only SKILL.md.

Attack Path

1. A user or Agent loads the Skill based on its description as a Kaizen reference.
2. The script is exposed or ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

• Make the documentation and implementation consistent.
• Either implement the documented reference commands or replace the command documentation with the tracker commands actually supported.
• Clearly disclose creation of ~/.kaizen, the JSONL and configuration files, and all modification, deletion, and export operations.
• Avoid creating the data directory for read-only commands such as help and version.
• Add automated tests that compare documented commands against the command dispatcher.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/script.sh:134

Finding

Configuration Arguments Are Injected into a Sed Program Without Escaping

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:134-148
Vulnerability Type: Sed expression injection and potential command execution
Risk Level: High

Technical Analysis

Both the configuration key and value are controlled through command-line arguments and are inserted directly into regular expressions and a sed replacement program:

bash

cmd_config() {
    local key="${1:-}" val="${2:-}"
    local cfg="$DATA_DIR/config.txt"
    if [ -z "$key" ]; then
        echo "=== Config ==="
        if [ -f "$cfg" ]; then
            while IFS="=" read -r k v; do echo "  $k=$v"; done < "$cfg"
        else echo "  (empty — use config <key> <value>)"; fi
    elif [ -z "$val" ]; then
        grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)"
    else
        if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then
            sed -i "s|^${key}=.*|${key}=${val}|" "$cfg"
        else
            echo "${key}=${val}" >> "$cfg"
        fi
        echo "Set: $key=$val"
    fi
}

The code does not escape:

• Regular-expression metacharacters in key.
• The | expression delimiter.
• Backslashes and replacement metacharacters in val.
• Embedded newline characters.
• Implementation-specific sed flags.

An attacker can therefore terminate the intended replacement and inject additional sed syntax. On GNU sed, the e substitution flag executes the resulting pattern-space content as a shell command. A crafted multiline value can close the substitution, add the e flag, and comment out the delimiter appended by the script. Exploitability as command execution is implementation-dependent, but configuration corruption and unintended substitutions are portable consequences.

Attack Path

1. The attacker obtains control of arguments passed to scripts/script.sh config, such as through an Agent-generated command ...[truncated 1066 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct sed programs from untrusted input.
• Restrict configuration keys to a strict allowlist, such as ^[A-Za-z0-9_.-]+$.
• Reject newline, carriage-return, NUL, and other control characters in keys and values.
• Replace the update logic with a parser that performs literal key comparisons.
• Write changes to a securely created temporary file and atomically rename it into place.
• If awk is used, pass values through -v and compare fields literally rather than embedding input into source code.
• Set restrictive file permissions and add tests covering delimiters, backslashes, newlines, and regex metacharacters.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:10

Finding

User-Controlled Entry Data Is Written as JSON Without JSON Escaping

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:10-15
Vulnerability Type: Structured-data injection and JSONL corruption
Risk Level: Medium

Technical Analysis

_save_entry inserts the supplied value directly into a JSON string:

bash

_save_entry() {
    _ensure_dirs
    local cmd="$1" val="$2"
    local ts=$(date '+%Y-%m-%d %H:%M:%S')
    printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"
}

The caller passes user-controlled command-line content into this function:

bash

cmd_add() {
    local value="${1:?Usage: kaizen add <entry>}"
    shift || true
    _save_entry "add" "$value $*"
    local count=$(wc -l < "$DATA_DIR/data.jsonl" 2>/dev/null || echo 0)
    echo "Added: $value (entry #$count)"
}

JSON requires quotation marks, backslashes, and control characters to be escaped. Because the script performs no JSON serialization, an entry containing a quotation mark can terminate the val string, while a newline can create additional JSONL records. The generated file can therefore become syntactically invalid or contain attacker-forged fields and records.

The listing and export logic subsequently treats the corrupted content as trusted records, using regular-expression extraction rather than a JSON parser.

Attack Path

1. An attacker controls or influences the value passed to the add command.
2. The attacker supplies quotes, backslashes, or embedded newlines that terminate the expected JSON string or record.
3. _save_entry appends the content verbatim to data.jsonl.
4. The data file contains malformed or attacker-forged JSONL records.
5. list, search, or export processes the injected records and may present them as legitimate entries.
6. Any downstream application consuming the exported data may receive attacker-controlled structure rather than a single inert string value.

Im

...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

• Use a JSON-aware serializer instead of string interpolation. For example, generate each record with jq -cn --arg ts "$ts" --arg cmd "$cmd" --arg val "$val".
• Reject NUL bytes and any unsupported control characters before storage.
• Parse stored records with a real JSON parser instead of grep and cut.
• Validate each existing JSONL line before listing, searching, or exporting it.
• Generate CSV exports with standards-compliant quoting for commas, quotation marks, and line breaks.
• Add tests for quotes, backslashes, Unicode, tabs, carriage returns, and embedded newlines.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/script.sh:7

Finding

Unvalidated KAIZEN_DIR and Symlink Following Permit Operations on Unintended Files

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:7-15
Vulnerability Type: Unrestricted filesystem target and symlink following
Risk Level: Medium

Technical Analysis

The storage path is taken directly from the environment:

bash

VERSION="1.0.0"
DATA_DIR="${KAIZEN_DIR:-$HOME/.kaizen}"

_ensure_dirs() { mkdir -p "$DATA_DIR"; }

_save_entry() {
    _ensure_dirs
    local cmd="$1" val="$2"
    local ts=$(date '+%Y-%m-%d %H:%M:%S')
    printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"
}

Multiple commands then read or modify fixed filenames beneath that unvalidated path:

bash

sed -i "${num}d" "$DATA_DIR/data.jsonl"

bash

json) cp "$DATA_DIR/data.jsonl" "$out" ;;

bash

local cfg="$DATA_DIR/config.txt"

bash

echo "${key}=${val}" >> "$cfg"

The script neither canonicalizes KAIZEN_DIR nor verifies that the directory and managed files are owned by the current user and are not symbolic links. If an attacker can control the environment or pre-create content in the selected directory, the script can follow attacker-selected paths when reading, appending, exporting, or editing files.

This does not itself bypass operating-system permissions: all access remains limited to what the invoking user can already access. However, it permits the script to be used as a confused deputy against unintended files within that privilege scope.

Attack Path

1. An attacker controls KAIZEN_DIR, or can prepare a directory selected by that variable.
2. The attacker points data.jsonl or config.txt at another file through a symbolic link, or chooses a directory containing unrelated files with those names.
3. A user or Agent runs add, remove, config, status, list, or export.
4. The script follows the selected path without ownership or symlink checks.
5. Depending on the command, content ...[truncated 658 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the data directory to a canonical path and constrain it to an approved application-specific location.
• Reject symbolic links for the data directory and managed files using lstat-equivalent checks.
• Verify ownership and permissions before reading or modifying existing files.
• Create the directory with restrictive permissions, such as mode 0700, and data files with mode 0600.
• Open files using no-follow semantics where the platform supports them.
• Use atomic temporary-file replacement and revalidate the target immediately before replacement.
• Treat environment-provided path overrides as privileged configuration and document their security implications.
• Do not run the script as root or another elevated account.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill metadata and documentation present this as a read-only Kaizen reference, but the referenced behavior indicates broader stateful CLI functionality that creates, modifies, deletes, and exports local data. This mismatch is dangerous because users or higher-level agents may invoke the skill under false assumptions, leading to unintended file changes, data loss, or data exposure from a skill that appears informational only.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The implementation materially diverges from the declared skill purpose: instead of a passive Kaizen reference/coaching aid, it provides a stateful local CLI that writes, deletes, searches, exports, and configures data on disk. This mismatch is dangerous because users or platforms may grant trust based on the manifest description while the code performs broader filesystem-affecting actions and persists potentially sensitive user input without clear disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The export and configuration features extend beyond what is justified by a Kaizen reference skill and create additional avenues for data exposure and unintended file modification. Export writes collected data to local files, and config editing modifies on-disk state; in a mismatched skill context, these capabilities increase the chance of unauthorized persistence or exfiltration of user-provided content under misleading expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.