Security audit

Pid

Security checks for vulnerabilities and agentic risk

Overview

This package says it is for PID controller tuning, but the code is actually a local record store that creates, exports, searches, configures, and deletes saved data.

Review this carefully before installing. It should not be treated as a PID controller tuning or simulation tool. Install only if you knowingly want a small local datastore that writes to ~/.pid by default, can delete records, and can export files in the working directory; avoid opening exported CSV files from untrusted input in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:10
Finding: Unescaped JSONL Serialization and Spreadsheet Formula Injection in CSV Exports
Content: View full analysis
> "$DATA_DIR/data.jsonl" } ``` ```bash cmd_export() { local fmt="${1:-json}" local out="pid-export.$fmt" if [ ! -f "$DATA_DIR/data.jsonl" ]; then echo "No data."; return 0; fi case "$fmt" in json) cp "$DATA_DIR/data.jsonl" "$out" ;; csv) echo "timestamp,command,value" > "$out" while IFS= read -r line; do ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo "$ts,$c2,$vl" >> "$out" done < "$DATA_DIR/data.jsonl" ;; *) echo "Formats: json, csv"; return 1 ;; esac echo "Exported: $out ($(wc -c < "$out") bytes)" } ``` ### Technical Analysis The `_save_entry` function embeds the user-controlled `val` argument directly into a JSON string. It does not escape quotation marks, backslashes, carriage returns, newlines, or other JSON control characters. An entry containing these characters can therefore terminate the intended string, create additional properties, or inject additional JSONL records. The export implementation does not use a JSON parser. Instead, it extracts fields with `grep` and `cut`, so malformed or specially constructed records can produce truncated, misleading, or incorrectly parsed output. The CSV exporter also writes fields without RFC 4180 quoting or escaping. Commas, quotation marks, and newlines can create additional columns or rows. In addition, a value b ...[truncated 1955 chars]
Remediation: View remediation
> "$DATA_DIR/data.jsonl" ``` 2. Parse stored records with `jq` or another standards-compliant JSON parser instead of `grep` and `cut`. 3. Generate CSV using a library or helper that implements RFC 4180: - Enclose every field in double quotes. - Replace each embedded double quote with two double quotes. - Preserve newlines only inside properly quoted fields. 4. Neutralize spreadsheet formulas where exports may be opened interactively. Prefix fields beginning with `=`, `+`, `-`, or `@` with an apostrophe, or provide a clearly documented safe-export mode that treats every value as text. 5. Add tests covering quotation marks, backslashes, commas, newlines, Unicode text, and formula-leading characters. 6. Consider validating existing JSONL records during reads and rejecting malformed records with a clear error instead of silently parsing partial values. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:136
Finding: Configuration File Manipulation Through Unsanitized Regular Expression and sed Input
Content: View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis Both `key` and `val` are inserted directly into regular expressions and a dynamically constructed `sed` substitution. The configuration key is interpreted as a basic regular expression by `grep` and `sed`. Characters such as `.`, `*`, `[`, `]`, `^`, and `$` can therefore alter which configuration line is selected. A crafted key can read or overwrite a different entry than its literal text suggests. The value is inserted directly into the replacement portion of: ```bash sed -i "s|^${key}=.*|${key}=${val}|" ``` An ampersand in the value expands to the complete matched text in a `sed` replacement. A pipe character can terminate the replacement section and alter the remainder of the `sed` expression. Backslashes and embedded newlines can also change output or cause syntax errors. This enables configuration corruption and denial of service. The input remains an argument to `sed` rather than being evaluated by a shell, so the reviewed code does not establish a reliable shell-command injection path. ### Attack Path 1. An attacker or untrusted automation can cont ...[truncated 1276 chars]
Remediation: View remediation
&2 return 1 fi ``` 2. Avoid constructing `grep` and `sed` regular expressions from untrusted input. 3. Use a literal key comparison when reading the file. For example, use `awk` with the key passed through `-v` and compare the parsed first field as a string. 4. Update configuration through a temporary file using literal field comparisons, then atomically replace the original: ```bash tmp=$(mktemp "$DATA_DIR/config.txt.XXXXXX") ``` Ensure cleanup with a trap, write the updated configuration to the temporary file, set restrictive permissions, and use `mv` to replace the original only after successful completion. 5. Define and enforce a value format. Reject embedded carriage returns and newlines if configuration values are intended to occupy one line. 6. Create the data directory and configuration file with restrictive permissions, such as directory mode `0700` and file mode `0600`, where the stored settings are private. 7. Add regression tests using regex metacharacters, pipes, ampersands, backslashes, and multiline values. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a PID controller tuning and simulation tool, but the documented behavior is a generic local record-management utility with persistent storage, export, deletion, and configuration features. This mismatch is dangerous because it can cause an agent or user to invoke the skill under false assumptions, enabling unintended data handling or file operations outside the expected PID-control scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest claims an industrial PID tuning/simulation purpose, but the documented commands implement an unrelated generic data-management interface. In an agent ecosystem, this kind of semantic deception can bypass user expectations and routing safeguards, causing the wrong tool to be selected for sensitive tasks and granting it opportunities to read, write, export, or delete local data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The header explicitly brands the script as a PID controller tool, while the code performs generic record keeping and configuration storage. In an agent-skill ecosystem, deceptive labeling increases risk because security reviewers, users, or automated planners may authorize execution based on false capabilities, enabling misuse or covert persistence of arbitrary local data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script’s declared purpose is PID controller tuning/simulation, but the implementation is a generic local datastore with add/search/remove/export/config capabilities unrelated to PID control. This mismatch is dangerous because it can mislead users or calling agents into granting trust, invoking the tool in inappropriate contexts, or storing arbitrary data under a benign-looking skill name, which is a classic deceptive-skill pattern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The help text advertises PID-specific operations, but the available commands manipulate a generic JSONL store and config file. This is dangerous because it socially engineers both humans and agents into believing the tool is domain-specific and low-risk, when it actually provides broad local data handling primitives that could be abused to stash, search, export, or delete arbitrary content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation guidance uses broad phrases such as JSON/CSV PID tasks and checking PID status without defining what operations are in scope or what the skill will modify. Vague triggers can cause over-selection by an agent, making it more likely this mismatched tool is invoked in contexts involving sensitive industrial or local data operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation contradicts itself by introducing a PID-focused skill while describing only generic entry and data-management commands. This ambiguity increases the chance of operator or agent misuse, especially where industrial tooling is expected to be tightly scoped and low-risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents write, delete, export, and configuration-changing commands but provides no warning about their side effects, persistence, or target locations. This is dangerous because users or agents may invoke destructive or data-exfiltration-relevant operations without informed consent, especially given the already misleading PID framing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The cmd_remove function permanently deletes a line from the data store with sed -i and immediately reports success. Although it prints after deletion, there is no prior confirmation prompt or explicit warning comment/help text about the destructive nature of the operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.