ClawHub
Back to skill

Security audit

file-batcher-tool

Security checks for vulnerabilities and agentic risk

Overview

This file-management skill is not deceptive, but it can rename, move, overwrite, and delete many local files without clear safety controls.

Install only if you are comfortable with an agent running bulk file operations. Use it on test folders first, avoid broad paths like your home directory, keep backups, and do not use conversion on important originals unless the skill is updated to avoid overwrites, deletion, and unsafe large-file size parsing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/batcher.sh:166
Finding

Argument Injection in Large-File Search Can Trigger Destructive find Actions

Content
View full analysis

Vulnerability Details

File Location: scripts/batcher.sh, lines 166-177
Vulnerability Type: Shell argument injection
Risk Level: High

Vulnerable Code

bash
find_large() {
    local folder="$1"
    local size="${2:-100M}"
    
    if [ ! -d "$folder" ]; then
        echo "❌ Folder not found: $folder"
        return 1
    fi
    
    echo "🔍 Files larger than $size in $folder:"
    echo ""
    
    find "$folder" -type f -size +$size -exec ls -lh {} \; 2>/dev/null | awk '{print $5, $9}' | sort -hr | head -20
}

Technical Analysis

The attacker-controlled size variable is expanded without quotation in -size +$size. Bash consequently performs word splitting on its value. Although shell metacharacters introduced through variable expansion are not reparsed as shell syntax, whitespace can inject additional arguments directly into find.

This allows a supplied size value to add arbitrary find predicates and actions. For example, a single argument containing 1c -delete is expanded into:

bash
find "$folder" -type f -size +1c -delete -exec ls -lh {} \;

The injected -delete action removes every regular file under the selected folder that is larger than one byte. Other find actions may also be injectable, subject to the implementation and argument ordering.

The documented interface compounds the issue: documentation uses --size 500M, but the script passes only $3 to find_large and ignores $4. Thus, normal documented usage provides --size as the size expression rather than 500M.

Attack Path

  1. An attacker influences a request that invokes the large-file operation and controls its size argument.
  2. The attacker supplies one argument containing whitespace and an additional find action, such as 1c -delete.
  3. local size="$2" preserves the complete string.
  4. The unquoted +$size expansion splits that string into +1c and `-delete ...[truncated 585 chars]
Remediation
View remediation

Remediation Suggestions

  • Validate the size value against a strict allowlist before invoking find. For example:

    bash
    if [[ ! "$size" =~ ^[0-9]+[bcwkMG]$ ]]; then
    printf 'Invalid size: %s\n' "$size" >&2
    return 2
fi

  • Pass the complete size expression as one quoted argument:

    bash
    find "$folder" -type f -size "+$size" -exec ls -lh -- {} \;

  • Parse the documented --size option explicitly and reject unknown or extra options.

  • Use -- where supported when passing file names to utilities.

  • Add regression tests with whitespace, option-like strings, -delete, -exec, and malformed units to verify rejection.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/batcher.sh:20
Finding

Batch Rename Overwrites Existing Files and Can Discard File Extensions

Content
View full analysis

Vulnerability Details

File Location: scripts/batcher.sh, lines 20-51
Vulnerability Type: Unsafe file replacement and destructive rename
Risk Level: Medium

Vulnerable Code

bash
case "$pattern" in
    prefix_*)
        local prefix="${pattern%_*}"
        for file in *; do
            [ -f "$file" ] && mv "$file" "${prefix}_$file" && ((count++))
        done
        ;;
    *_suffix)
        local suffix="${pattern#*_}"
        for file in *; do
            if [ -f "$file" ]; then
                local name="${file%.*}"
                local ext="${file##*.}"
                [ "$name" != "$ext" ] && mv "$file" "${name}_${suffix}.${ext}" || mv "$file" "${file}_${suffix}"
                ((count++))
            fi
        done
        ;;
    *###*)
        local prefix="${pattern%###}"
        local num=1
        for file in *; do
            [ -f "$file" ] && mv "$file" "${prefix}$(printf '%03d' $num)" && ((num++)) && ((count++))
        done
        ;;
    lowercase)
        for file in *; do
            [ -f "$file" ] && mv "$file" "$(echo "$file" | tr '[:upper:]' '[:lower:]')" && ((count++))
        done
        ;;
    uppercase)
        for file in *; do
            [ -f "$file" ] && mv "$file" "$(echo "$file" | tr '[:lower:]' '[:upper:]')" && ((count++))
        done
        ;;
esac

Technical Analysis

Every rename operation calls mv without checking whether the generated destination already exists. On common implementations, mv replaces an existing destination file by default. Collisions can occur through user-selected prefixes or suffixes, case normalization, or sequential names.

The sequential-numbering branch also generates names such as prefix001 without retaining the source extension. This can overwrite an existing extensionless file and makes the ...[truncated 1165 chars]

Remediation
View remediation

Remediation Suggestions

  • Generate and validate the complete rename plan before changing any files.
  • Abort if two sources map to the same destination or if any destination already exists.
  • Use mv -n -- "$source" "$destination" where supported, while still reporting collisions clearly.
  • Preserve file extensions during sequential renaming unless extension removal is explicitly requested.
  • Use temporary unique names for multi-file and case-only renames to prevent ordering-related collisions.
  • Do not increment the success count unless mv succeeds.
  • Offer a dry-run mode that displays all source-to-destination mappings before committing changes.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/batcher.sh:78
Finding

Image Conversion Can Overwrite Existing Outputs and Delete Source Files

Content
View full analysis

Vulnerability Details

File Location: scripts/batcher.sh, lines 78-84
Vulnerability Type: Unsafe output replacement followed by source deletion
Risk Level: Medium

Vulnerable Code

bash
cd "$folder" || return 1

for file in *.jpg *.jpeg *.png *.gif *.webp 2>/dev/null; do
    [ -f "$file" ] && convert "$file" "${file%.*}.$format" && rm "$file" && ((count++))
done

echo "✅ Converted $count images to .$format"

Technical Analysis

The output path is derived only from the source base name and requested format. The script does not validate the format or check whether the destination exists. ImageMagick may consequently replace an existing output file.

After convert reports success, the original source is immediately removed. This is unsafe when the destination collides with another file and especially dangerous when the requested format matches the source extension, because the input and output paths may be identical. In that case, a successful in-place conversion is followed by rm "$file", deleting the resulting image.

Different source extensions can also map to the same destination. For example, photo.jpg and photo.png both map to photo.webp during WebP conversion, allowing a later conversion to overwrite an earlier result.

Attack Path

  1. An attacker or existing folder content creates source images with colliding base names, or conversion is requested to the source's current format.
  2. The Skill invokes convert using the predictable destination name.
  3. An existing destination is replaced, or the source and destination resolve to the same path.
  4. The script executes rm "$file" after conversion succeeds.
  5. The original image, an earlier conversion result, or the newly converted same-path image is irreversibly lost.

Impact Assessment

The issue can cause targeted or bulk loss of images in any writable selected directory. It does not ...[truncated 163 chars]

Remediation
View remediation

Remediation Suggestions

  • Restrict the output format to the documented allowlist: jpg, png, webp, and gif.
  • Reject conversions where the canonical source and destination paths are identical, or treat them as explicit in-place operations without deleting the result.
  • Refuse to overwrite an existing destination unless the user gives explicit confirmation.
  • Convert into a securely created temporary file in the destination directory.
  • Verify that conversion succeeded and that the temporary output is a valid, nonempty image before atomically moving it into place.
  • Delete the source only after confirming that the final destination is distinct and safely committed.
  • Precompute destinations and reject collisions between multiple source images.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/batcher.sh:96
Finding

File Organization Silently Overwrites Existing Categorized Files

Content
View full analysis

Vulnerability Details

File Location: scripts/batcher.sh, lines 96-124
Vulnerability Type: Unsafe file overwrite
Risk Level: Medium

Vulnerable Code

bash
cd "$folder" || return 1

mkdir -p images documents videos audio archives

# Images
for ext in jpg jpeg png gif webp bmp svg; do
    mv *.$ext images/ 2>/dev/null
done

# Documents
for ext in pdf doc docx xls xlsx ppt pptx txt md rtf; do
    mv *.$ext documents/ 2>/dev/null
done

# Videos
for ext in mp4 avi mkv mov wmv flv; do
    mv *.$ext videos/ 2>/dev/null
done

# Audio
for ext in mp3 wav flac aac ogg; do
    mv *.$ext audio/ 2>/dev/null
done

# Archives
for ext in zip rar tar gz 7z; do
    mv *.$ext archives/ 2>/dev/null
done

Technical Analysis

The organization operation creates or reuses fixed category directories and moves files into them without checking destination collisions. If images/photo.jpg already exists, moving photo.jpg into images/ normally replaces the existing file.

Errors are redirected to /dev/null, making failures and overwrite-related behavior less visible to the user. The operation therefore lacks both collision prevention and reliable reporting.

Attack Path

  1. A category directory already contains a file whose name matches a file in the parent folder, or an attacker prepositions such a file.
  2. The user invokes the organization operation.
  3. The script moves the parent file into the fixed category directory.
  4. mv replaces the existing destination file without confirmation.
  5. The overwritten destination content is lost, while diagnostics are suppressed.

Impact Assessment

Exploitation or accidental triggering can destroy files in the generated category directories. The scope is limited to locations writable by the process under the selected folder, but repeated use can cause broad integrity and availability damage to organize ...[truncated 14 chars]

Remediation
View remediation

Remediation Suggestions

  • Check every destination before moving a file and abort or select a conflict policy when it exists.
  • Use mv -n -- to prevent replacement where supported.
  • Report each collision instead of suppressing all diagnostics.
  • Provide explicit conflict options such as skip, rename with a unique suffix, or overwrite after confirmation.
  • Build a dry-run plan and summarize all conflicts before modifying the directory.
  • Track successful moves directly rather than relying only on post-operation directory counts.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description accurately covers part of the script’s behavior: batch rename, convert, and organize operations. However, the code also exposes materially distinct file-analysis and discovery features via the duplicates, count, and large commands. These are not merely implementation details; they are user-invokable capabilities with separate CLI actions. Because the declared purpose omits these extra capabilities, the description does not fully and accurately represent what the code chunk actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes batch rename, conversion, and organization commands that can modify, move, or overwrite large numbers of user files, but it does not warn about destructive side effects, preview/dry-run behavior, backups, or scope limitations. In an agent skill context, this omission is dangerous because an automated system may invoke these commands on real user directories such as ~/Downloads or ~, increasing the risk of unintended data loss or disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes bulk rename and organize operations that can modify large numbers of files without any documented safety checks, preview mode, confirmation step, or rollback guidance. In an agent setting, a mistaken folder path or rename pattern could cause widespread unintended file changes, data disruption, or difficult-to-reverse reorganization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The image conversion routine deletes the original file immediately after conversion with rm "$file", without any confirmation, backup, or dry-run mode. If conversion is incorrect, lossy, partial, or applied to the wrong directory/format, users can suffer irreversible data loss across many files at once.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest scopes the skill to batch file operations such as rename, convert, and organize. Functions exposed at lines L131-L184 add separate discovery/inspection capabilities that go beyond those described operations, expanding the skill into filesystem analysis rather than just batch processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The batch rename function performs in-place renames across all files in the target folder without preview or confirmation. A mistaken pattern or unexpected filename set can cause widespread naming changes, collisions, or workflow disruption that may be difficult to undo.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The organization routine moves many files into subdirectories in place without warning, confirmation, or rollback support. Running it on the wrong folder or with unexpected glob matches can disrupt user workflows and make files appear missing, especially in bulk-processing contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.