Optional Strict Instructions 可选择的严格指令

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:50 PM UTC
• Version: 0.0.1

Overview

The skill is mostly a safety workflow, but it ships runnable templates for broad sudo command execution, destructive deletion, and sudo password handling that users should review carefully.

Install only if you want an agent to help with privileged system operations and you are prepared to review every command before it runs. Do not provide sudo passwords through chat, command-line arguments, or skill prompts; prefer manual terminal authentication and avoid using the included shell script as-is.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/strict-execution.sh:130
• Finding: Arbitrary Command Injection Through the sudo-cmd Interface## Vulnerability Details **File Location**: `scripts/strict-execution.sh`, lines 130-145 and 279-289 **Vulnerability Type**: Caller-controlled shell command execution through `sh -c` **Risk Level**: High ### Vulnerable Code ```bash execute_with_sudo() { local command="$1" local password="${2:-}" log_info "Executing with sudo: $command" if [ -n "$password" ]; then echo "$password" | sudo -S -- sh -c "$command" else sudo -- sh -c "$command" fi return $? } execute_without_sudo() { local command="$1" log_info "Executing: $command" sh -c "$command" return $? } ``` The affected mode obtains the command directly from a positional argument: ```bash "sudo-cmd") if [ $# -lt 2 ]; then log_error "Missing command or description" return 1 fi local command="$1" local description="$2" local password="${3:-}" example_sudo_operation "$command" "$description" "$password" ;; ``` ### Technical Analysis The `sudo-cmd` interface accepts an entire shell program as a caller-controlled string. Both execution functions pass that string to `sh -c`, causing shell metacharacters, command substitutions, pipelines, redirections, and command separators to be interpreted. Quoting `"$command"` when passing it to `sh -c` only preserves the string as one argument to the child shell; it does not prevent that child shell from parsing the content as executable shell syntax. In the privileged branch, the parser runs under `sudo`, so every command included in the string executes with root privileges after authentication. The interactive confirmation step does not provide a technical security boundary. A deceptive description can conceal the effects of the supplied command, and the implementation neither parses nor allowlists the executable and arguments. ### Attack Path 1. An atta ...[truncated 1086 chars]
• Remediation: ## Remediation Suggestions - Remove support for arbitrary shell command strings. - Represent commands as executable-and-argument arrays and invoke them directly without `sh -c`. - Define a strict allowlist of supported operations and executables. - Validate each argument according to its expected type rather than validating the complete command as text. - Do not attempt to sanitize shell metacharacters as a substitute for removing shell-string evaluation. - For privileged operations, invoke only the specifically approved executable: ```bash execute_with_sudo() { local -a command=("$@") sudo -- "${command[@]}" } execute_without_sudo() { local -a command=("$@") "${command[@]}" } ``` - If arbitrary administrative commands are an intentional requirement, provide them only for manual display and require the user to execute them independently in a trusted terminal. - Add tests demonstrating that separators, substitutions, redirections, and newlines are treated as literal arguments or rejected.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/strict-execution.sh:183
• Finding: Command Injection Through Crafted File Paths During File Deletion## Vulnerability Details **File Location**: `scripts/strict-execution.sh`, lines 183-191 **Vulnerability Type**: Shell injection caused by interpolating a file path into a command string **Risk Level**: High ### Vulnerable Code ```bash if [ "$use_sudo" = "true" ]; then if ! execute_with_sudo "rm -f \"$file\"" "$sudo_password"; then log_error "Failed to delete with sudo" return 1 fi log_success "File deleted with sudo: $file" else if ! execute_without_sudo "rm -f \"$file\""; then log_error "Failed to delete with user permissions" return 1 fi ``` ### Technical Analysis The file path is inserted into a textual shell command and subsequently evaluated by `sh -c`. The embedded double quotes do not safely preserve the path because quote characters and other shell syntax within the path become part of the generated shell program. For example, a file basename containing syntax conceptually similar to `x";id;#` can terminate the intended quoted path, add another command, and comment out the remaining generated quote. Unix file names may legally contain quotes, semicolons, dollar signs, spaces, and many other shell-significant characters. The earlier resource-existence check does not neutralize this issue. It only confirms that the path exists; it does not ensure that the path is safe to reinterpret as shell source code. In the sudo branch, the generated shell program is executed as root. ### Attack Path 1. An attacker creates a file with a shell-significant name in a directory where the attacker can create files. 2. The crafted path is supplied to the script's `file-delete` mode. 3. `verify_resource` confirms that the attacker-created file exists. 4. The path is interpolated into the string `rm -f "$file"`. 5. The resulting string is passed to `sh -c` by `execute_with_sudo` or `execute_without_sudo`. 6. The shell reparses the crafted file name as executable ...[truncated 568 chars]
• Remediation: ## Remediation Suggestions - Never construct a shell command by concatenating or interpolating a file path. - Invoke `rm` directly with the path as a distinct argument. - Include `--` before the path so names beginning with a hyphen cannot be interpreted as options: ```bash if [ "$use_sudo" = "true" ]; then if ! sudo -- rm -f -- "$file"; then log_error "Failed to delete with sudo" return 1 fi else if ! rm -f -- "$file"; then log_error "Failed to delete with user permissions" return 1 fi fi ``` - Preserve file paths as array elements throughout the execution flow. - Consider verifying file identity immediately before deletion using a trusted parent directory or previously captured inode information to reduce path replacement and race risks. - Add regression tests using file names containing quotes, semicolons, dollar signs, spaces, newlines, glob characters, and leading hyphens.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/strict-execution.sh:130
• Finding: Exposure of Sudo Passwords Through Command-Line Arguments and Plaintext Transport## Vulnerability Details **File Location**: `scripts/strict-execution.sh`, lines 130-138, 215-235, and 271-289 **Vulnerability Type**: Insecure privileged-credential handling **Risk Level**: Medium ### Vulnerable Code ```bash execute_with_sudo() { local command="$1" local password="${2:-}" log_info "Executing with sudo: $command" if [ -n "$password" ]; then echo "$password" | sudo -S -- sh -c "$command" else sudo -- sh -c "$command" fi } ``` The interactive operation also stores and pipes the password: ```bash if [ -z "$sudo_password" ]; then echo -n "Enter sudo password: " read -rs sudo_password echo "" fi if execute_with_sudo "$command" "$sudo_password"; then log_success "Command executed successfully with sudo" else log_error "Command failed with sudo" return 1 fi ``` The command-line interface explicitly accepts a password as its third argument: ```bash local password="${3:-}" example_sudo_operation "$command" "$description" "$password" ``` ### Technical Analysis The script supports passing a sudo password through a command-line argument. Command-line secrets can be exposed through shell history, process inspection, debugging output, job metadata, CI logs, Agent execution telemetry, and process-auditing systems. The password is then stored in shell variables and piped in plaintext to `sudo -S`. Although `read -s` suppresses terminal echo during the interactive path, the secret still enters the script's memory and is copied through a pipeline. The design unnecessarily expands the number of components handling the credential. Requesting a password through an Agent or chat-mediated workflow is particularly unsafe because the credential may be retained in conversation history or platform logs. Authentication should remain under the control of the trusted sudo client and terminal rather than applica ...[truncated 953 chars]
• Remediation: ## Remediation Suggestions - Remove all password parameters from the script's public and internal interfaces. - Never ask users to provide operating-system passwords through chat, Agent input, command-line arguments, environment variables, or configuration files. - Invoke `sudo` without `-S` and allow it to authenticate through its controlling terminal: ```bash execute_with_sudo() { local -a command=("$@") sudo -- "${command[@]}" } ``` - If noninteractive execution is required, configure a narrowly scoped sudoers rule for a fixed executable and fixed argument pattern rather than transporting a password. - Use an approved OS-integrated authentication or askpass mechanism only where terminal authentication is unavailable. - Clear obsolete documentation and examples that encourage users to provide passwords. - Add documentation explicitly stating that the Skill must never receive or retain authentication secrets.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (73)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Found: /var/log/app.log (requires root)

Options:
1. sudo rm /var/log/app.log
2. sudo truncate /var/log/app.log (clear contents)
3. Show file contents first
4. Cancel

• Confidence: 85% confidence
• Finding: The explicit parameterized command 'sudo rm /var/log/app.log' is dangerous because it couples privileged execution with irreversible deletion of a sensitive path. If a target path is attacker-influenced, mistaken, or insufficiently validated, this pattern can become a vehicle for destructive tool misuse and removal of operational or forensic data.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## Scenario 1: File Deletion with Explicit Method

### User Request
"Use sudo to delete /home/user/important.pdf"

### Step-by-Step Response

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

找到文件：/home/user/important.pdf (2.3MB, 属于user用户)

用户指定使用sudo删除。执行：
sudo rm -f "/home/user/important.pdf"
```

**Phase 3: Execution**

• Confidence: 94% confidence
• Finding: The command `rm -f` is a destructive primitive that suppresses prompts and can irreversibly remove data. In an agent skill, showing forceful deletion as the recommended execution path is dangerous because it reduces friction around destructive operations and can be abused through path manipulation or operator error.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Phase 3: Execution**
```
执行sudo命令：
$ sudo rm -f "/home/user/important.pdf"
```

**Phase 4: Handling Results**

• Confidence: 95% confidence
• Finding: This is the explicit execution form of the same forced deletion, making the danger immediate and operational. It is especially risky in a reusable skill because examples often become implementation defaults, enabling privileged data destruction with inadequate safety checks.

Chaining Abuse

High

• Category: Tool Misuse

Content

安装docker需要sudo权限。请选择：

1. 标准安装 (推荐)
   sudo apt update && sudo apt install docker.io

2. 仅更新仓库
   sudo apt update

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Credential Access

High

• Category: Privilege Escalation

Content

```
检查用户是否已存在：
$ id deploy 2>/dev/null
$ grep ^deploy: /etc/passwd
```

**Phase 2: Option Presentation**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

log_info "Executing with sudo: $command"
    
    if [ -n "$password" ]; then
        echo "$password" | sudo -S -- sh -c "$command"
    else
        sudo -- sh -c "$command"
    fi

• Confidence: 98% confidence
• Finding: The password is piped into `sudo` and then a shell executes a free-form command string, which is a classic chaining-abuse pattern. This composition lets an attacker combine credential use, privilege escalation, and shell metacharacter expansion in one step, maximizing exploitability and impact.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "  sudo-cmd <command> <description> [password]"
        echo ""
        echo "Examples:"
        echo "  $0 file-delete /tmp/test.txt ask"
        echo "  $0 file-delete /etc/hostname true mypassword"
        echo "  $0 sudo-cmd \"apt update\" \"Update package lists\""
        return 1

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo ""
        echo "Examples:"
        echo "  $0 file-delete /tmp/test.txt ask"
        echo "  $0 file-delete /etc/hostname true mypassword"
        echo "  $0 sudo-cmd \"apt update\" \"Update package lists\""
        return 1
    fi

• Confidence: 94% confidence
• Finding: The help example encourages deletion of `/etc/hostname` with sudo and even includes a plaintext password argument, normalizing dangerous privileged modification of a system file. In an agent skill, such examples can directly steer misuse and demonstrate unsafe invocation patterns that combine destructive action with credential exposure.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

EOF

# Cleanup
rm -f /tmp/test-file-123.txt
echo ""
echo "Test file cleaned up"
echo ""

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

---
name: optional-strict-instructions
description: Handle operations requiring user confirmation, permission verification, and strict adherence to explicit instructions. Activate when: (1) Operations need sudo/elevated permissions, (2) File deletion or modification is requested, (3) System changes are required, (4) User explicitly specifies a method (e.g., "use sudo"), (5) Sensitive operations need explicit consent, (6) Multiple valid approaches exist and user choice is required. Use this skill to ensure proper verification, user interaction, and strict compliance with user instructions.
---

# Optional Strict Instructions Skill

• Confidence: 50% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Correct Response**:
1. Check file.txt exists
2. Execute: `sudo rm file.txt`
3. If sudo needs password: "sudo requires password. Please provide password or choose alternative"
4. Do NOT try `rm file.txt` without sudo

• Confidence: 73% confidence
• Finding: The skill includes a concrete destructive command, 'sudo rm file.txt,' which normalizes direct privileged deletion and could be misused by an agent or copied into unsafe contexts. Although the surrounding text requires prior user instruction and verification, embedding an exact root-level deletion command still increases operational risk if the skill is invoked in error or applied to attacker-influenced paths.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /var/log/app.log (requires root)

Options:
1. sudo rm /var/log/app.log
2. sudo truncate /var/log/app.log (clear contents)
3. Show file contents first
4. Cancel

• Confidence: 81% confidence
• Finding: This section presents 'sudo rm /var/log/app.log' as a first-class option for deleting a root-owned log file. Even with user-choice framing, the skill concretely instructs a privileged destructive action against a sensitive system path, which could lead to log destruction, loss of forensic evidence, or service disruption if misapplied or attacker-influenced.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Options:
1. sudo rm /var/log/app.log
2. sudo truncate /var/log/app.log (clear contents)
3. Show file contents first
4. Cancel
```

• Confidence: 70% confidence
• Finding: The option 'sudo truncate /var/log/app.log' is a privileged operation that can erase log contents and destroy audit history. While less destructive than file removal and presented as an option, it still enables tampering with security-relevant logs if the skill is invoked inappropriately.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```

### Scenario 3: Safety-Required Operations
**User**: "Modify system configuration"

**Correct Response**:
```

• Confidence: 60% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Found: /path/file (size, owner, modified)

Options:
1. sudo rm -f (permanent, needs password)
2. rm (permanent, user permissions)
3. trash/move to recycle (reversible)
4. Cancel

• Confidence: 79% confidence
• Finding: The 'File Deletion Pattern' includes 'sudo rm -f' as a reusable template for privileged permanent deletion. Because it is framed as a general pattern, it broadens the chance that an agent applies an irreversible root-level deletion to attacker-controlled or insufficiently validated targets.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

4. Cancel
```

### Sudo Operation Pattern
```
Operation requires sudo to [action]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Learning from Mistakes

### Mistake: Assuming Alternatives
**Wrong**: When sudo fails, try user permissions without asking
**Correct**: Report failure, wait for instruction

### Mistake: Over-automation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Correct**: Present options, let user choose

### Mistake: Insufficient Verification
**Wrong**: Proceed without checking resource details
**Correct**: Gather complete info first

## Implementation Checklist

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.