Security audit

Leaderboard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local command-line logger for leaderboard-like entries, with some quality and data-handling issues but no evidence of hidden access, exfiltration, privilege escalation, or destructive behavior.

Install only if you are comfortable with leaderboard entries being kept as local plaintext files under ~/.local/share/leaderboard. Do not record passwords, tokens, private prompts, or sensitive personal data, and be cautious with exported CSV/JSON files because the export formatting is not safely escaped.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:58
Finding: Unescaped User-Controlled Data in JSON and CSV Exports
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` ### Technical Analysis The export implementation directly interpolates log-file values into JSON and CSV without applying format-specific encoding. For JSON output, embedded quotation marks, backslashes, control characters, or newlines are not escaped. A crafted value can therefore terminate the intended JSON string and inject additional properties or objects. The use of `echo "\n]"` is also not portable and can place a literal `\n` sequence outside a JSON string, resulting in invalid JSON. For CSV output, fields containing commas, quotation marks, carriage returns, or newlines are not quoted according to CSV rules. Values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` are written unchanged. When the resulting file is opened in spreadsheet software, such values may be interpreted as formulas rather ...[truncated 1727 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:103
Finding: Option Injection Through the Search Term Passed to grep
Content: View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The search term is passed to `grep` without the `--` end-of-options delimiter: ```bash grep -i "$term" "$f" ``` Shell quoting prevents word splitting and shell metacharacter execution, but it does not prevent a value beginning with `-` from being interpreted as a `grep` option. An attacker controlling the search argument can therefore alter how `grep` operates rather than supplying only a search pattern. For example, a term using `-fFILE` can instruct `grep` to read patterns from another locally readable file. Other supported options can modify matching behavior, produce unexpected output, or increase processing costs. This issue does not directly permit arbitrary shell-command execution because the term remains quoted and is not evaluated by the shell. ### Attack Path 1. An attacker or untrusted caller controls the argument supplied to `leaderboard search`. 2. The caller provides a value beginning with a hyphen, such as: ```bash leaderboard search '-f/path/to/readable/pattern-file' ``` 3. The script passes the value to `grep` before any end-of-options delimiter. 4. `grep` interprets the value as an option and reads patterns from the specified file instead of treating the input as a literal search term. 5. The modified operation is repeated for each `.log` file in the data directory, potentially producing unintended matches or consuming excessive resources. ### Imp ...[truncated 500 chars]
Remediation: View remediation
/dev/null || true) ``` 2. If the command is intended to perform literal substring searches rather than regular-expression searches, use fixed-string mode: ```bash m=$(grep -iF -- "$term" "$f" 2>/dev/null || true) ``` 3. Consider limiting the maximum search-term length to reduce the risk of computationally expensive input. 4. Add tests for terms beginning with `-`, including `--help`, `-fFILE`, and `--`, to ensure they are always treated as data. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior substantially exceeds the declared purpose of a simple leaderboard tool: it exposes generic logging, export, search, and filesystem-status capabilities, while not clearly implementing actual ranking/statistics logic. This kind of scope mismatch is dangerous because users may trust the skill with game data while it actually functions as a broad local data collector and reporter, increasing the chance of unintended data exposure or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The presence of a reset command without a clear warning creates a real safety issue because users may invoke it without understanding that it could delete or irreversibly alter locally stored leaderboard/history data. In a data-tracking skill, destructive operations need explicit disclosure and confirmation because accidental loss of records is a foreseeable consequence.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The tool systematically records arbitrary plaintext input across many commands, then exposes that accumulated content through tail/display, grep-based search, status output, and export features. In the context of an agent-facing skill, this is more dangerous because users may pass operational data, credentials, personal information, or proprietary text into seemingly harmless commands, creating a durable local disclosure surface.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for tracking scores, ranking competitors, and reviewing performance, but the implemented commands mostly just store arbitrary free-form input into separate .log files and print recent entries. There is no code that computes rankings, manages players, validates score structure, or performs meaningful leaderboard analysis; instead the tool exposes many generic buckets like create, join, challenge, reward, and reset.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The help output says 'stats' is for 'Summary statistics', which implies analytical behavior consistent with the skill description. However, the first 'stats)' case at L183-L197 handles that command by writing arbitrary input to stats.log or tailing recent entries, while the actual _stats summary function is shadowed by the earlier case and is never reached.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script stores arbitrary user-supplied input persistently under the user's home directory without clear notice, consent flow, retention policy, or input sensitivity guidance. In an agent skill context, users may supply secrets, tokens, personal data, or internal prompts assuming they are ephemeral, and the tool later reveals them via display, search, recent, status, or export operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The export function aggregates all stored log content into plaintext JSON, CSV, or TXT files in the same data directory without warning or access controls. This increases the exposure of previously captured sensitive content by creating convenient secondary copies that are easier to exfiltrate, share, or inspect accidentally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.