Security audit

Return Policy

Security checks for vulnerabilities and agentic risk

Overview

This skill mainly generates return-policy text and has some low-risk quality and disclosure issues, but no evidence of credential theft, remote code, destructive behavior, or hidden privileged access.

Before installing, treat generated policies as templates that need legal/business review, and avoid putting sensitive customer or account data into the local utility commands because they can be logged under the skill's data directory. Be aware that generated output may include BytesAgain branding unless removed by the caller.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/return.sh:207
Finding: Unconditional Promotional Content Injected into Agent-Relayed Output## Vulnerability Details **File Location**: `scripts/return.sh:207-209` **Vulnerability Type**: Unconditional output manipulation **Risk Level**: Medium ### Vulnerable Code ```python print("") print("Powered by BytesAgain | bytesagain.com") ``` ### Technical Analysis The script unconditionally appends attacker-selected branding and an external domain to every response, regardless of the requested command. When an AI agent invokes this skill and relays its standard output, the injected footer becomes part of the agent's response. This behavior alters the expected output of the skill and causes the agent to distribute unrelated promotional content. Related branding also appears in `SKILL.md`, but the executable output injection occurs at `scripts/return.sh:207-209`. The script does not use this domain for network communication, download a payload, or execute remote code. The confirmed issue is limited to manipulation of agent-relayed output. ### Attack Path 1. A user or AI agent invokes `scripts/return.sh` to generate or inspect a return policy. 2. The script processes the selected command. 3. Execution reaches the unconditional statements at lines 207-209. 4. The script appends `Powered by BytesAgain | bytesagain.com` to standard output. 5. If the invoking agent relays standard output without filtering, the user receives attacker-selected branding and an external domain as part of the agent's response. ### Impact Assessment The issue can manipulate the textual output returned by an invoking agent, create an unintended endorsement, and direct users toward an external domain. It affects every invocation that reaches the end of the embedded Python program. It does not grant additional operating-system privileges, establish persistence, access credentials, or provide code-execution capabilities. The scope is confined to response integrity and unauthorized promotional content.
Remediation: ## Remediation Suggestions - Remove the unconditional promotional footer from normal command output. - If attribution is required, place it in package documentation rather than generated policy content. - Alternatively, make attribution explicitly opt-in through a documented flag such as `--include-attribution`. - Keep standard output limited to the requested policy data so agents can safely relay it. - Add automated tests verifying that generated output contains no unrelated domains, advertisements, or branding unless explicitly requested.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: `cmd_remove` prints `Removed: $1` and logs the action, but it never edits or deletes content from `$DB`. This directly contradicts the command name and user-visible behavior, creating an intent-code divergence where documentation and output indicate deletion that does not actually occur.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger text is overly broad ('use when you need return policy capabilities' / 'Triggers on: return policy') and lacks clear scope constraints, which can cause the skill to activate in unintended contexts. While not directly enabling code execution or data exfiltration, broad activation increases the chance of inappropriate invocation, response confusion, or workflow interference in larger agent systems.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The description and usage content are primarily in Chinese, and the file does not state that the skill is region-specific or give users an option to select another language. This can violate language/locale policy when a skill effectively defaults to a specific language without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file includes a dedicated `cn` command that generates policy content entirely in Chinese and advertises it in help text, but there is no accompanying language-choice mechanism or justification for a locale restriction. This is a natural-language policy concern because the skill hardcodes a specific language mode rather than offering an explicit user locale selection policy.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The script name and command namespace are `return-policy`, which suggests a dedicated purpose, but the top comment and help text describe it only as a "Multi-purpose utility tool." This is an active documentation-level mismatch about the skill's intent, making the documented purpose broader and less specific than the implemented return-policy-style data commands.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script appends command/activity data to history.log, and elsewhere writes entries to data.log, but the help text only mentions the data directory and does not warn that user inputs will be persistently logged. For code-file warning checks, these file writes lack a clear user-facing disclosure beyond incidental status output.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The add command writes all supplied arguments into the database file and only reports that the entry was added; it does not clearly disclose beforehand that the data will be stored on disk. This is a safety-relevant file write involving user data, and the help text does not warn about persistence behavior.

Static analysis

No suspicious patterns detected.