Zip

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:26 AM UTC
• Version: 3.0.1

Overview

This ZIP skill is purpose-aligned, but its shell wrapper handles archive arguments and passwords in ways that can expose secrets or let unsafe ZIP options be injected.

Review before installing. Use only in controlled directories and with trusted archives until fixed. Avoid the password command for real secrets because the password can appear in process listings, logs, or transcripts. Be careful with filenames beginning with '-' and do not pass untrusted archive or file names to this wrapper.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/script.sh:19
• Finding: Option Injection Through Unvalidated ZIP Command Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:19-27`, `scripts/script.sh:62-71`, and `scripts/script.sh:112-121` **Vulnerability Type**: OS command option injection **Risk Level**: High ### Vulnerable Code ```bash cmd_create() { check_deps local archive="${1:?Usage: zip create <archive.zip> <files...>}" shift [ $# -eq 0 ] && die "No files specified" zip -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done ``` ```bash cmd_add() { check_deps local archive="${1:?Usage: zip add <archive.zip> <files...>}" shift [ $# -eq 0 ] && die "No files specified" [ ! -f "$archive" ] && die "Archive not found: $archive" zip -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done ``` ```bash cmd_password() { check_deps local archive="${1:?Usage: zip password <archive.zip> <password> <files...>}" local pass="${2:?Missing password}" shift 2 [ $# -eq 0 ] && die "No files specified" zip -e -P "$pass" -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done ``` ### Technical Analysis Quoting shell variables prevents shell word splitting and shell metacharacter expansion, but it does not prevent the invoked `zip` program from interpreting an argument beginning with `-` as an option. The archive name and user-provided file operands are forwarded directly to `zip` without validation or a supported end-of-options delimiter. Consequently, an attacker who controls the archive name or file arguments can supply option-like values that alter the behavior of `zip`. Common Info-ZIP implementations support security-sensitive options, including archive test command configuration such as `-T` and `-TT`. Where options are accepted after the archive operand, malicious file arguments can therefore reach utility-level command execution functionality. Even where the installed `zip` implementation or argum ...[truncated 1490 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject archive and file operands that can be interpreted as options, particularly values beginning with `-`. 2. Use the installed ZIP implementation's documented end-of-options mechanism before untrusted path operands. 3. If an end-of-options mechanism is unavailable or inconsistent across supported implementations, normalize user paths to explicit path forms such as absolute paths or `./relative-path` after validating them. 4. Canonicalize paths and enforce an allowlisted working directory when callers should only archive files from a designated location. 5. Avoid forwarding arbitrary caller-controlled arguments as utility options. 6. Add security regression tests covering operands such as `-T`, `-TT`, `--help`, and filenames beginning with a hyphen. 7. Verify behavior against every supported `zip` implementation because option parsing and command-related features can differ between versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:112
• Finding: Archive Password Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:112-121` **Vulnerability Type**: Plaintext sensitive data exposure **Risk Level**: Medium ### Vulnerable Code ```bash cmd_password() { check_deps local archive="${1:?Usage: zip password <archive.zip> <password> <files...>}" local pass="${2:?Missing password}" shift 2 [ $# -eq 0 ] && die "No files specified" zip -e -P "$pass" -rv "$archive" "$@" 2>&1 | while IFS= read -r line; do echo " $line" done info "Created encrypted $archive" } ``` The documented interface also instructs users to place the password directly on the command line: ```bash scripts/script.sh password <archive> <pass> <files...> ``` ### Technical Analysis The password is first accepted as a positional command-line argument and is then passed to `zip` using the `-P` option. This exposes the secret in multiple places: - The invoking shell may retain it in command history. - The script's process argument vector contains the password. - The child `zip` process receives the password in its argument vector. - Process monitoring, auditing, telemetry, debugging, or job-control systems may record it. - Wrapper services may log the complete command invocation. Quoting `"$pass"` protects shell parsing but does not conceal the value from process inspection or logging. ### Attack Path 1. A user follows the documented syntax and supplies an archive password as a positional argument. 2. The plaintext password is recorded in shell history or invocation logs. 3. While the command runs, the script passes the same secret to `zip` through `-P`. 4. A local user or monitoring component with permission to inspect process arguments, history, audit data, or service logs obtains the password. 5. The observer uses the recovered password to decrypt the resulting archive or any other archive protected with the reused password. ### Impact Assessment An attacker who obtains the exposed password can d ...[truncated 374 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the password positional argument from the public interface. 2. Do not use `zip -P`, because it places the password in the child process's argument vector. 3. Prompt for the password interactively from a terminal with input echo disabled, allowing `zip` to perform its own secure prompt where appropriate. 4. For non-interactive use, use a protected file descriptor or another secret-delivery mechanism that does not expose the value in command arguments. Confirm that the selected ZIP implementation supports the mechanism safely. 5. Ensure secrets are never printed, traced, or included in diagnostic output. 6. Clear temporary shell variables containing secrets as soon as practical, while recognizing that this does not remediate prior argument-vector exposure. 7. Update `SKILL.md` so it no longer instructs users to provide plaintext passwords on the command line. 8. Add tests verifying that archive passwords do not appear in process listings, shell history generated by examples, or application logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exposes an `extract` operation that writes files to the filesystem, and `create`/`add` modify archives, but the documentation gives no warning that these actions have side effects on disk. In an agent setting, this omission can cause unsafe use on untrusted archives or in sensitive directories, increasing the chance of overwriting files, path traversal exposure during extraction, or unintended modification of local data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `password` command takes the ZIP password directly as a command-line argument, which can expose the secret through shell history, process listings, logs, agent transcripts, or monitoring tools. In an automated agent environment, this is especially risky because command invocations are often recorded, making credential disclosure more likely.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The password-protected ZIP command takes the password as a positional command-line argument and passes it to `zip -P`, which exposes the secret in shell history, audit logs, and process listings visible to other local users or monitoring tools. In the context of an archiving utility, this is especially risky because users are likely to supply real backup or data-protection passwords, so credential leakage can directly compromise the encrypted archive.

Static analysis

No suspicious patterns detected.