Security audit
Security checks for vulnerabilities and agentic risk
This is a shell scripting reference skill whose executable script only prints fixed help text and examples; the scanner warnings are explained by documented examples rather than active unsafe behavior.
Install this as a shell scripting reference, not as a safety sandbox. Some examples it displays, such as deleting files with `rm` or detaching processes with `nohup`, can be dangerous if copied into a real terminal without understanding the paths and effects.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
awk — Field Processing:
awk '{print $1}' file # First field (space-delimited)
awk -F: '{print $1}' /etc/passwd # Custom delimiter
awk '$3 > 100' file # Filter by field value
awk '{sum+=$1} END{print sum}' # Sum a column
awk 'NR==5,NR==10' file # Lines 5-10
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
awk — Field Processing:
awk '{print $1}' file # First field (space-delimited)
awk -F: '{print $1}' /etc/passwd # Custom delimiter
awk '$3 > 100' file # Filter by field value
awk '{sum+=$1} END{print sum}' # Sum a column
awk 'NR==5,NR==10' file # Lines 5-10
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
find . -type f -exec chmod 644 {} \; # Execute on each
xargs — Build Commands from Input:
find . -name "*.log" | xargs rm # Delete found files
find . -name "*.log" -print0 | xargs -0 rm # Handle spaces
cat urls.txt | xargs -P 4 -I {} curl {} # Parallel downloads
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
xargs — Build Commands from Input:
find . -name "*.log" | xargs rm # Delete found files
find . -name "*.log" -print0 | xargs -0 rm # Handle spaces
cat urls.txt | xargs -P 4 -I {} curl {} # Parallel downloads
jq — JSON Processing:
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
xargs — Build Commands from Input:
find . -name "*.log" | xargs rm # Delete found files
find . -name "*.log" -print0 | xargs -0 rm # Handle spaces
cat urls.txt | xargs -P 4 -I {} curl {} # Parallel downloads
jq — JSON Processing:
echo '{"name":"Ada"}' | jq '.name' # "Ada"
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
trap — Catch Signals:
# Cleanup on exit (any exit — normal or error)
trap 'echo "Cleaning up..."; rm -f "$tmpfile"' EXIT
# Catch Ctrl+C
trap 'echo "Interrupted!"; exit 130' INT
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
[ ] Network operations have timeouts
Code Quality:
[ ] ShellCheck passes with no warnings
[ ] Functions are small and focused
[ ] Local variables used in functions
[ ] No useless cat (use < file instead of cat file |)
The skill exposes shell command execution patterns via scripts/script.sh ... but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls because an agent or host system may permit broader shell access than intended, which is especially relevant for a shell-focused skill whose natural use case involves command execution.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
find . -type f -mtime -7 # Modified in last 7 days
find . -size +100M # Larger than 100MB
find . -name "*.tmp" -delete # Find and delete
find . -type f -exec chmod 644 {} \; # Execute on each
xargs — Build Commands from Input:
find . -name "*.log" | xargs rm # Delete found files
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
fg %1 # Bring job 1 to foreground
bg %1 # Resume stopped job in background
kill %1 # Kill job 1
disown %1 # Detach job from shell
Parallel Execution:
# Run commands in parallel, wait for all
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
fg %1 # Bring job 1 to foreground
bg %1 # Resume stopped job in background
kill %1 # Kill job 1
disown %1 # Detach job from shell
Parallel Execution:
# Run commands in parallel, wait for all
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# GNU Parallel (more sophisticated)
parallel -j4 process_file ::: *.csv
Nohup / Disown:
nohup cmd & # Survives terminal close (output → nohup.out)
cmd & disown # Detach from shell (no nohup.out)
setsid cmd # New session (fully detached)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
parallel -j4 process_file ::: *.csv
Nohup / Disown:
nohup cmd & # Survives terminal close (output → nohup.out)
cmd & disown # Detach from shell (no nohup.out)
setsid cmd # New session (fully detached)
EOF
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Nohup / Disown:
nohup cmd & # Survives terminal close (output → nohup.out)
cmd & disown # Detach from shell (no nohup.out)
setsid cmd # New session (fully detached)
EOF
}
No suspicious patterns detected.