Security audit

Lockout

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local record manager branded as a lockout/tagout safety procedure manager, which could mislead users in a safety-sensitive context.

Review this carefully before installing. It appears suitable only as an informal local note/log utility, not as a lockout/tagout safety control, compliance system, or source of truth for whether equipment is safely isolated. Avoid storing authoritative safety records in it unless the documentation and implementation are improved with clear scope limits, backups, confirmation for deletion/overwrite, and proper data encoding.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:8
Finding: Unescaped User Input Corrupts JSONL Records
Content: View full analysis
> "$DATA_DIR/data.jsonl" } ``` ### Technical Analysis The `_save_entry` function directly interpolates `cmd` and `val` into a JSON object without applying JSON escaping. Shell quoting prevents ordinary shell word splitting, but it does not make the resulting content valid or safe JSON. An entry containing double quotes, backslashes, carriage returns, or newline characters can terminate or alter the intended JSON string. In particular, embedded newlines can create additional physical records in the JSONL file. Subsequent commands parse the file using line-oriented `grep` and `cut` operations rather than a JSON parser, so injected or malformed content can be displayed, searched, counted, or exported as if it were legitimate data. ### Attack Path 1. An attacker or untrusted caller supplies an entry containing JSON delimiters or newline characters to `scripts/script.sh add`. 2. `cmd_add` passes the supplied text to `_save_entry`. 3. `_save_entry` writes the text directly into `$DATA_DIR/data.jsonl` without JSON escaping. 4. The input produces malformed JSON or additional apparent JSONL records. 5. The `list`, `search`, `status`, `stats`, or `export` commands subsequently process the corrupted records as trusted lockout data. ### Impact Assessment Exploitation does not grant additional operating-system privileges or directly execute commands. Its scope is the configured lockout data file and all outputs derived from that file. An attacker able to invoke the tool can corrupt, falsify, or structurally alter stored records. Because the project presents itself as a lockout/tagout safe ...[truncated 115 chars]
Remediation: View remediation
> "$DATA_DIR/data.jsonl" ``` - Validate records when reading them and reject malformed JSON rather than parsing it with `grep` and `cut`. - Consider rejecting newline and other control characters if multiline entries are not an intended feature. - Write updates atomically and apply restrictive file permissions appropriate for safety-related records. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:133
Finding: Configuration Keys and Values Are Embedded Unsafely in Regular Expressions and sed Replacements
Content: View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The caller-controlled `key` is interpreted as a regular expression by both `grep` and `sed`. Consequently, metacharacters such as `.`, `*`, `[`, `]`, `^`, `$`, and backslashes can change which configuration entries are matched. The caller-controlled `val` is inserted directly into a `sed` replacement string. Characters such as `&`, backslashes, and the `|` delimiter have special meanings in that context. They can duplicate matched content, alter the replacement, produce an invalid expression, or corrupt configuration data. Shell quoting alone does not neutralize regular-expression or `sed` replacement syntax. No shell-command execution was established from the reviewed implementation, but unintended matching and rewriting of configuration lines is directly supported by the code. ### Attack Path 1. The configuration file is populated with one or more entries. 2. A caller invokes `config` using a key containing regular-expression metacharacters, such as a pattern capable of matching multiple keys. 3. The `grep -q` check treats the supplied key as a regular expression and ...[truncated 844 chars]
Remediation: View remediation
&2 return 1 fi ``` - Avoid constructing dynamic `sed` programs from untrusted input. - Parse the configuration file field-by-field and write a new temporary file containing either the unchanged line or a safely formatted replacement. - If regular-expression tools must be retained, escape the key for the relevant regular-expression dialect and separately escape replacement characters such as `\`, `&`, and the selected delimiter. - Validate values and reject control characters where multiline values are not supported. - Replace the original file atomically after successful processing. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:96
Finding: CSV Export Allows Formula Injection and Structural Record Corruption
Content: View full analysis
"$out" while IFS= read -r line; do ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo "$ts,$c2,$vl" >> "$out" done < "$DATA_DIR/data.jsonl" ;; *) echo "Formats: json, csv"; return 1 ;; esac echo "Exported: $out ($(wc -c < "$out") bytes)" } ``` ### Technical Analysis The CSV exporter concatenates fields with commas without applying CSV quoting or escaping. Values containing commas, double quotes, carriage returns, or newlines can therefore change column boundaries or create additional rows. In addition, spreadsheet applications commonly interpret cells beginning with `=`, `+`, `-`, or `@` as formulas. Because attacker-controlled entry values are emitted without neutralization, an exported file can contain formulas that execute when a user opens the file in vulnerable or permissively configured spreadsheet software. The script also extracts values using `grep` and `cut` instead of parsing JSON, compounding the problem when the underlying JSONL record is malformed. ### Attack Path 1. An attacker or untrusted user adds a value beginning with a spreadsheet formula prefix, or a value containing CSV delimiters. 2. The value is stored in `$DATA_DIR/data.jsonl`. 3. A user runs `scripts/script.sh export csv`. 4. The exporter writes the value d ...[truncated 885 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill advertises itself as a lockout/tagout safety procedure manager, but the documented commands reveal broader local data storage, deletion, export, search, statistics, and configuration capabilities that are not clearly disclosed. In a safety-related context, this mismatch is dangerous because users may rely on the skill for operational safety status while it appears to manage generic local records and filesystem state instead of verified lockout procedure state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation description is broad and underspecified, which can cause the agent to invoke the skill in loosely related situations involving JSON, CSV, or safety tasks without clear boundaries. Because this skill includes data-modifying commands and operates in a safety domain, vague trigger conditions increase the chance of unintended use, incorrect reliance, or accidental modification of local lockout records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation lists commands like add, remove, export, and config without warning that they modify or delete persisted local data. Omitting these warnings can lead to accidental record tampering or deletion, which is especially risky for safety-related logs where integrity and operator understanding are important.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level description claims the script is a lockout tagout safety procedure manager, but the code only stores arbitrary entries and config values. Misrepresenting functionality in a safety domain is dangerous because users may assume compliance, traceability, or procedural enforcement that does not exist.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises lockout/tagout safety procedure management, but the implementation is only a generic local log utility. In a safety-critical context, this mismatch can cause operators or downstream agents to rely on the tool for hazardous-energy control tracking when it provides no workflow validation, procedure enforcement, or safety safeguards, creating a real risk of unsafe operational decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The remove command deletes a line from the persistent data file using sed -i, which is an irreversible file modification. While the script prints a message after deletion, there is no confirmation prompt, pre-action warning, or explanatory comment/docstring disclosing that user data will be permanently removed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The help text presents lockout-oriented status and task management, but the commands only expose generic file statistics and CRUD-like manipulation of free-form entries. This can mislead users about the reliability and semantics of 'status' in a safety workflow, though the issue is primarily deceptive interface behavior rather than direct code execution or privilege abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The export command copies or transforms stored entries into a new output file, which is a file-write operation affecting user data. Although the script reports success afterward, the help text does not warn that export will create or overwrite a file in the current working directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.