Security checks for vulnerabilities and agentic risk
Overview
This daily-report skill is coherent, but it needs review because its save flow can write or overwrite local files and documents an unsafe way to pass report content to a shell command.
Install only if you are comfortable with a skill that saves work summaries to disk. Set `REPORTS_DIR` deliberately, review the destination path before use, avoid placing sensitive content in reports unless intended, and prefer revising the save command to pass content through stdin or a shell-free argument API with overwrite confirmation.
The skill instructs the agent to place report content directly into a shell command as a command-line argument. Report content originates from user-provided work items and may therefore contain shell metacharacters such as command substitutions, semicolons, pipes, or redirection operators.
If the agent constructs and executes this example through a shell without robust argument escaping, the shell interprets those metacharacters rather than passing the entire report as inert text to save-report.mjs. The Node.js script itself does not invoke a shell; the vulnerability exists at the skill-instruction boundary, where untrusted content may be interpolated into the documented command.
Attack Path
An attacker supplies malicious text as part of a daily-report item, such as content containing a shell command substitution.
The agent generates the report while preserving the attacker-controlled text.
Following SKILL.md, the agent substitutes the report for <content> in the shell command.
The agent executes the constructed command through a shell without correctly escaping the report.
The shell evaluates the injected syntax and executes the attacker's command with the privileges of the agent process.
Exploitation depends on the documented command being implemented through shell interpolation rather than a shell-free argument API.
Impact Assessment
Successful exploitation permits arbitrary command execution under the operating-system account running the agent. The attacker could read or modify files accessible to that account, overwrite project or report data, access available environment variables and credentials, launch network requests, o
...[truncated 198 chars]
Remediation
View remediation
Remediation Suggestions
Do not interpolate report content into a shell command.
Prefer sending the report through standard input. Update the script to read from process.stdin, then invoke it without embedding content in the command:
bash
The agent should still use a structured execution API rather than assemble this example as a shell string.
Alternatively, invoke Node.js with a shell-free process API such as spawn() or execFile(), passing the script path and report content as separate argument-array elements with shell: false.
Revise SKILL.md to explicitly prohibit shell interpolation and require structured argument passing.
For potentially large or sensitive reports, pass content through standard input rather than command-line arguments, because command-line arguments may be exposed through process inspection and can exceed platform length limits.
Validate the destination configuration separately and run the skill with least-privilege filesystem permissions.
The skill references environment-variable-driven behavior (REPORTS_DIR) and invokes a script, but it does not declare any explicit tool scope or permissions. This creates ambiguity about what runtime capabilities the skill expects and can lead to overbroad execution environments granting filesystem or environment access beyond what reviewers and users would anticipate.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill name and instructions are entirely in Chinese and describe generating a Chinese daily report, but there is no indication that the user may choose another language or that the skill is intentionally restricted to a Chinese-only context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The skill workflow says it will '保存文件' and the script section describes automatic saving to a path under ~/reports or $REPORTS_DIR, but there is no requirement for explicit user confirmation before writing to disk. Automatic file writes can cause unintended persistence of sensitive work summaries, overwrite existing notes, or write into attacker-influenced locations if the environment variable is manipulated.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The natural-language comments and console output are in Chinese, including the primary saved-message string, with no indication that language is configurable or intentionally restricted to a Chinese-only context. This can violate language/locale policy when a skill forces a specific language without user opt-in.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
87% confidence
Finding
This code performs a file write using command-line supplied content, which can affect user data on disk. Although it logs after saving, there is no pre-write warning, confirmation prompt, or explanatory comment about overwrite/data impact beyond a generic script description.
