Security audit

Superpicky Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent bird-photo CLI wrapper, but it downloads and runs mutable upstream code and exposes a broad Python script runner that needs careful review before installation.

Install only if you trust the upstream SuperPicky repository and the dependency set at install time. Use a sandbox or disposable environment, avoid passing untrusted values to --py, do not use -y for reset/restar/organize unless you explicitly want those file changes, and run it only on photo directories you are prepared for the tool to modify.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:271
Finding: Unpinned Remote Repository and Dependency Code Is Retrieved and Executed
Content: View full analysis
$UP (branch $BRANCH)" git clone --depth 1 --single-branch --branch "$BRANCH" "$REPO_URL" "$UP" else log "Using existing clone: $UP" fi } ``` ```python def load_region_bounds_mod(up: Path) -> Dict[str, Tuple[float, float, float, float]]: sys.path.insert(0, st ...[truncated 2912 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.sh:63
Finding: Generic Python Helper Permits Execution of Arbitrary Local Scripts
Content: View full analysis
&2; exit 1; } script="$1" shift # Always invoke Python with an absolute script path (relative paths = under repo root $UP). if [[ "$script" != /* ]]; then script="${UP}/${script#./}" fi if [[ ! -f "$script" ]]; then echo "error: --py file not found: $script" >&2 exit 1 fi exec "$PY" "$script" "$@" fi ``` ### Technical Analysis The `--py` helper provides a generic Python execution primitive. Relative paths are prefixed with `.upstream`, but absolute paths are accepted unchanged. No canonical-path containment check, script allowlist, ownership check, or integrity validation is performed. Consequently, the wrapper can execute any readable local Python file rather than only scripts necessary for SuperPicky. The documented legitimate use is model downloading through `.upstream/scripts/download_models.py`; accepting arbitrary absolute paths exceeds the minimum capability needed for that function. Shell command injection through metacharacters is not evident because variables are quoted and passed directly to `exec`. The vulnerability instead arises from intentionally broad script selection combined with insufficient path restrictions. ### Attack Path 1. An attacker places a Python payload in a filesystem location readable by the invoking account, or identifies an existing local Python file with useful side effects. 2. The attacker influences an Agent instruction, automation argument, or user command so that it invokes: `scripts/run.sh --py /path/to/payload.py` 3. `run.sh` confirms only that the path is a regular file. 4. The wrapper executes the selected file using the Skill's virtual-environment interpreter. 5. The payload inherits th ...[truncated 840 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: The code's primary behavior is consistent with part of the description: it uses absolute paths, depends on scripts/run.sh and the venv installed via scripts/install.sh, and writes reference/cli-help-captured.txt. However, the declared purpose includes additional specific run.sh capabilities ('--region-query' and '--py') that are not represented in this code chunk. Since the evaluation is description versus supplied code chunk, the description overstates what this chunk actually covers and emphasizes broader run.sh functionality rather than the narrower help-capture behavior shown here.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description focuses on a CLI skill wrapper/automation contract involving scripts/install.sh, scripts/run.sh, specific run entries, and a captured help reference. The actual code chunk does not implement or invoke those shell scripts. Instead, it is a test suite validating functionality of an ebird region query Python module, including parsing labels, fuzzy matching, and optional integration with upstream JSON data. That is a materially different primary purpose from the declared automation description, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill documents destructive reset/restar operations and advises using '-y' when appropriate, but it does not clearly warn that these actions can remove state or overwrite prior processing results. In an agent-driven context, terse destructive guidance can lead to unintended data loss if an automation system executes resets without explicit user confirmation or backup checks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The help output explicitly states that the zh_CN language pack is loaded, and all user-facing help text is presented in Chinese. This suggests a fixed language choice without any visible option for user opt-in or locale selection, which is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section again shows zh_CN being loaded and presents the tool description in Chinese, with no visible indication that users can choose another language. Repeating the fixed-locale behavior across the skill strengthens the evidence of a policy violation rather than an isolated output artifact.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The wrapper exposes a generic --py mode that executes any Python script path, including absolute paths outside the repository. That materially expands the skill from a narrowly described CLI wrapper into a general-purpose code execution entrypoint, which is dangerous in agent contexts because downstream automation may trust the wrapper and pass attacker-influenced arguments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Providing a general script launcher is unjustified by the stated purpose of the skill and creates an unnecessary execution primitive. In a security-sensitive agent environment, this mismatch between declared functionality and actual capability increases the risk of abuse, policy bypass, and execution of unintended local code under the skill's Python environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 64% confidence
Finding: The file mixes Chinese and English sections but does not state any language preference, selection mechanism, or intended audience. Under the policy rule, natural-language content that assumes a locale or language without opt-in can be considered a minor policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The markdown instructs users to run ./scripts/install.sh to fetch upstream and create a venv, which implies network activity and local filesystem changes. The README provides no warning or disclosure about these effects, even though they can affect user system state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The markdown instructs users to run git clone and pip install, which perform network access and change the local environment, but the skill description does not explicitly warn that installation downloads remote code and dependencies. For markdown files, user disclosures about privacy or system-impacting behavior are expected when the skill can affect system integrity.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.