Security audit

Zip

Security checks for vulnerabilities and agentic risk

Overview

This ZIP skill is purpose-aligned, but its shell wrapper handles archive arguments and passwords in ways that can expose secrets or let unsafe ZIP options be injected.

Review before installing. Use only in controlled directories and with trusted archives until fixed. Avoid the password command for real secrets because the password can appear in process listings, logs, or transcripts. Be careful with filenames beginning with '-' and do not pass untrusted archive or file names to this wrapper.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:19
Finding: Option Injection Through Unvalidated ZIP Command Arguments
Content: View full analysis
}" shift [ $# -eq 0 ] && die "No files specified" zip -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done ``` ```bash cmd_add() { check_deps local archive="${1:?Usage: zip add }" shift [ $# -eq 0 ] && die "No files specified" [ ! -f "$archive" ] && die "Archive not found: $archive" zip -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done ``` ```bash cmd_password() { check_deps local archive="${1:?Usage: zip password }" local pass="${2:?Missing password}" shift 2 [ $# -eq 0 ] && die "No files specified" zip -e -P "$pass" -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done ``` ### Technical Analysis Quoting shell variables prevents shell word splitting and shell metacharacter expansion, but it does not prevent the invoked `zip` program from interpreting an argument beginning with `-` as an option. The archive name and user-provided file operands are forwarded directly to `zip` without validation or a supported end-of-options delimiter. Consequently, an attacker who controls the archive name or file arguments can supply option-like values that alter the behavior of `zip`. Common Info-ZIP implementations support security-sensitive options, including archive test command configuration such as `-T` and `-TT`. Where options are accepted after the archive operand, malicious file arguments can therefore reach utility-level command execution functionality. Even where the installed `zip` implementation or argum ...[truncated 1490 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:112
Finding: Archive Password Exposed Through Command-Line Arguments
Content: View full analysis
}" local pass="${2:?Missing password}" shift 2 [ $# -eq 0 ] && die "No files specified" zip -e -P "$pass" -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done info "Created encrypted $archive" } ``` The documented interface also instructs users to place the password directly on the command line: ```bash scripts/script.sh password ``` ### Technical Analysis The password is first accepted as a positional command-line argument and is then passed to `zip` using the `-P` option. This exposes the secret in multiple places: - The invoking shell may retain it in command history. - The script's process argument vector contains the password. - The child `zip` process receives the password in its argument vector. - Process monitoring, auditing, telemetry, debugging, or job-control systems may record it. - Wrapper services may log the complete command invocation. Quoting `"$pass"` protects shell parsing but does not conceal the value from process inspection or logging. ### Attack Path 1. A user follows the documented syntax and supplies an archive password as a positional argument. 2. The plaintext password is recorded in shell history or invocation logs. 3. While the command runs, the script passes the same secret to `zip` through `-P`. 4. A local user or monitoring component with permission to inspect process arguments, history, audit data, or service logs obtains the password. 5. The observer uses the recovered password to decrypt the resulting archive or any other archive protected with the reused password. ### Impact Assessment An attacker who obtains the exposed password can d ...[truncated 374 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill exposes an extract operation that writes files to the filesystem, and create/add modify archives, but the documentation gives no warning that these actions have side effects on disk. In an agent setting, this omission can cause unsafe use on untrusted archives or in sensitive directories, increasing the chance of overwriting files, path traversal exposure during extraction, or unintended modification of local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The password command takes the ZIP password directly as a command-line argument, which can expose the secret through shell history, process listings, logs, agent transcripts, or monitoring tools. In an automated agent environment, this is especially risky because command invocations are often recorded, making credential disclosure more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The password-protected ZIP command takes the password as a positional command-line argument and passes it to zip -P, which exposes the secret in shell history, audit logs, and process listings visible to other local users or monitoring tools. In the context of an archiving utility, this is especially risky because users are likely to supply real backup or data-protection passwords, so credential leakage can directly compromise the encrypted archive.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.