Optional Strict Instructions 可选择的严格指令

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:50 PM UTC
• Version: 0.0.1

Overview

The skill is mostly a safety workflow, but it ships runnable templates for broad sudo command execution, destructive deletion, and sudo password handling that users should review carefully.

Install only if you want an agent to help with privileged system operations and you are prepared to review every command before it runs. Do not provide sudo passwords through chat, command-line arguments, or skill prompts; prefer manual terminal authentication and avoid using the included shell script as-is.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/strict-execution.sh:130

Finding

Arbitrary Command Injection Through the sudo-cmd Interface

Content

View full analysis

Vulnerability Details

File Location: scripts/strict-execution.sh, lines 130-145 and 279-289
Vulnerability Type: Caller-controlled shell command execution through sh -c
Risk Level: High

Vulnerable Code

bash

execute_with_sudo() {
    local command="$1"
    local password="${2:-}"
    
    log_info "Executing with sudo: $command"
    
    if [ -n "$password" ]; then
        echo "$password" | sudo -S -- sh -c "$command"
    else
        sudo -- sh -c "$command"
    fi
    
    return $?
}

execute_without_sudo() {
    local command="$1"
    
    log_info "Executing: $command"
    sh -c "$command"
    return $?
}

The affected mode obtains the command directly from a positional argument:

bash

"sudo-cmd")
    if [ $# -lt 2 ]; then
        log_error "Missing command or description"
        return 1
    fi
    local command="$1"
    local description="$2"
    local password="${3:-}"
    example_sudo_operation "$command" "$description" "$password"
    ;;

Technical Analysis

The sudo-cmd interface accepts an entire shell program as a caller-controlled string. Both execution functions pass that string to sh -c, causing shell metacharacters, command substitutions, pipelines, redirections, and command separators to be interpreted.

Quoting "$command" when passing it to sh -c only preserves the string as one argument to the child shell; it does not prevent that child shell from parsing the content as executable shell syntax. In the privileged branch, the parser runs under sudo, so every command included in the string executes with root privileges after authentication.

The interactive confirmation step does not provide a technical security boundary. A deceptive description can conceal the effects of the supplied command, and the implementation neither parses nor allowlists the executable and arguments.

Attack Path

1. An atta ...[truncated 1086 chars]

Remediation

View remediation

Remediation Suggestions

• Remove support for arbitrary shell command strings.
• Represent commands as executable-and-argument arrays and invoke them directly without sh -c.
• Define a strict allowlist of supported operations and executables.
• Validate each argument according to its expected type rather than validating the complete command as text.
• Do not attempt to sanitize shell metacharacters as a substitute for removing shell-string evaluation.
• For privileged operations, invoke only the specifically approved executable:

bash

execute_with_sudo() {
    local -a command=("$@")
    sudo -- "${command[@]}"
}

execute_without_sudo() {
    local -a command=("$@")
    "${command[@]}"
}

• If arbitrary administrative commands are an intentional requirement, provide them only for manual display and require the user to execute them independently in a trusted terminal.
• Add tests demonstrating that separators, substitutions, redirections, and newlines are treated as literal arguments or rejected.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/strict-execution.sh:183

Finding

Command Injection Through Crafted File Paths During File Deletion

Content

View full analysis

Vulnerability Details

File Location: scripts/strict-execution.sh, lines 183-191
Vulnerability Type: Shell injection caused by interpolating a file path into a command string
Risk Level: High

Vulnerable Code

bash

if [ "$use_sudo" = "true" ]; then
    if ! execute_with_sudo "rm -f \"$file\"" "$sudo_password"; then
        log_error "Failed to delete with sudo"
        return 1
    fi
    log_success "File deleted with sudo: $file"
else
    if ! execute_without_sudo "rm -f \"$file\""; then
        log_error "Failed to delete with user permissions"
        return 1
    fi

Technical Analysis

The file path is inserted into a textual shell command and subsequently evaluated by sh -c. The embedded double quotes do not safely preserve the path because quote characters and other shell syntax within the path become part of the generated shell program.

For example, a file basename containing syntax conceptually similar to x";id;# can terminate the intended quoted path, add another command, and comment out the remaining generated quote. Unix file names may legally contain quotes, semicolons, dollar signs, spaces, and many other shell-significant characters.

The earlier resource-existence check does not neutralize this issue. It only confirms that the path exists; it does not ensure that the path is safe to reinterpret as shell source code. In the sudo branch, the generated shell program is executed as root.

Attack Path

1. An attacker creates a file with a shell-significant name in a directory where the attacker can create files.
2. The crafted path is supplied to the script's file-delete mode.
3. verify_resource confirms that the attacker-created file exists.
4. The path is interpolated into the string rm -f "$file".
5. The resulting string is passed to sh -c by execute_with_sudo or execute_without_sudo.
6. The shell reparses the crafted file name as executable ...[truncated 568 chars]

Remediation

View remediation

Remediation Suggestions

• Never construct a shell command by concatenating or interpolating a file path.
• Invoke rm directly with the path as a distinct argument.
• Include -- before the path so names beginning with a hyphen cannot be interpreted as options:

bash

if [ "$use_sudo" = "true" ]; then
    if ! sudo -- rm -f -- "$file"; then
        log_error "Failed to delete with sudo"
        return 1
    fi
else
    if ! rm -f -- "$file"; then
        log_error "Failed to delete with user permissions"
        return 1
    fi
fi

• Preserve file paths as array elements throughout the execution flow.
• Consider verifying file identity immediately before deletion using a trusted parent directory or previously captured inode information to reduce path replacement and race risks.
• Add regression tests using file names containing quotes, semicolons, dollar signs, spaces, newlines, glob characters, and leading hyphens.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/strict-execution.sh:130

Finding

Exposure of Sudo Passwords Through Command-Line Arguments and Plaintext Transport

Content

View full analysis

Vulnerability Details

File Location: scripts/strict-execution.sh, lines 130-138, 215-235, and 271-289
Vulnerability Type: Insecure privileged-credential handling
Risk Level: Medium

Vulnerable Code

bash

execute_with_sudo() {
    local command="$1"
    local password="${2:-}"
    
    log_info "Executing with sudo: $command"
    
    if [ -n "$password" ]; then
        echo "$password" | sudo -S -- sh -c "$command"
    else
        sudo -- sh -c "$command"
    fi
}

The interactive operation also stores and pipes the password:

bash

if [ -z "$sudo_password" ]; then
    echo -n "Enter sudo password: "
    read -rs sudo_password
    echo ""
fi

if execute_with_sudo "$command" "$sudo_password"; then
    log_success "Command executed successfully with sudo"
else
    log_error "Command failed with sudo"
    return 1
fi

The command-line interface explicitly accepts a password as its third argument:

bash

local password="${3:-}"
example_sudo_operation "$command" "$description" "$password"

Technical Analysis

The script supports passing a sudo password through a command-line argument. Command-line secrets can be exposed through shell history, process inspection, debugging output, job metadata, CI logs, Agent execution telemetry, and process-auditing systems.

The password is then stored in shell variables and piped in plaintext to sudo -S. Although read -s suppresses terminal echo during the interactive path, the secret still enters the script's memory and is copied through a pipeline. The design unnecessarily expands the number of components handling the credential.

Requesting a password through an Agent or chat-mediated workflow is particularly unsafe because the credential may be retained in conversation history or platform logs. Authentication should remain under the control of the trusted sudo client and terminal rather than applica ...[truncated 953 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all password parameters from the script's public and internal interfaces.
• Never ask users to provide operating-system passwords through chat, Agent input, command-line arguments, environment variables, or configuration files.
• Invoke sudo without -S and allow it to authenticate through its controlling terminal:

bash

execute_with_sudo() {
    local -a command=("$@")
    sudo -- "${command[@]}"
}

• If noninteractive execution is required, configure a narrowly scoped sudoers rule for a fixed executable and fixed argument pattern rather than transporting a password.
• Use an approved OS-integrated authentication or askpass mechanism only where terminal authentication is unavailable.
• Clear obsolete documentation and examples that encourage users to provide passwords.
• Add documentation explicitly stating that the Skill must never receive or retain authentication secrets.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (73)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The explicit parameterized command 'sudo rm /var/log/app.log' is dangerous because it couples privileged execution with irreversible deletion of a sensitive path. If a target path is attacker-influenced, mistaken, or insufficiently validated, this pattern can become a vehicle for destructive tool misuse and removal of operational or forensic data.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

Found: /var/log/app.log (requires root)

Options:
1. sudo rm /var/log/app.log
2. sudo truncate /var/log/app.log (clear contents)
3. Show file contents first
4. Cancel

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/scenarios.md (reported line 8)May include surrounding context.

md

## Scenario 1: File Deletion with Explicit Method

### User Request
"Use sudo to delete /home/user/important.pdf"

### Step-by-Step Response

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The command rm -f is a destructive primitive that suppresses prompts and can irreversibly remove data. In an agent skill, showing forceful deletion as the recommended execution path is dangerous because it reduces friction around destructive operations and can be abused through path manipulation or operator error.

Content

Scanner excerpt · references/scenarios.md (reported line 23)May include surrounding context.

找到文件：/home/user/important.pdf (2.3MB, 属于user用户)

用户指定使用sudo删除。执行： sudo rm -f "/home/user/important.pdf"

text

**Phase 3: Execution**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This is the explicit execution form of the same forced deletion, making the danger immediate and operational. It is especially risky in a reusable skill because examples often become implementation defaults, enabling privileged data destruction with inadequate safety checks.

Content

Scanner excerpt · references/scenarios.md (reported line 29)May include surrounding context.

Phase 3: Execution

text

执行sudo命令：
$ sudo rm -f "/home/user/important.pdf"

Phase 4: Handling Results

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/scenarios.md (reported line 123)May include surrounding context.

md

安装docker需要sudo权限。请选择：

1. 标准安装 (推荐)
   sudo apt update && sudo apt install docker.io

2. 仅更新仓库
   sudo apt update

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/scenarios.md (reported line 146)May include surrounding context.

text

检查用户是否已存在：
$ id deploy 2>/dev/null
$ grep ^deploy: /etc/passwd

Phase 2: Option Presentation

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The password is piped into sudo and then a shell executes a free-form command string, which is a classic chaining-abuse pattern. This composition lets an attacker combine credential use, privilege escalation, and shell metacharacter expansion in one step, maximizing exploitability and impact.

Content

Scanner excerpt · scripts/strict-execution.sh (reported line 132)May include surrounding context.

sh

log_info "Executing with sudo: $command"
    
    if [ -n "$password" ]; then
        echo "$password" | sudo -S -- sh -c "$command"
    else
        sudo -- sh -c "$command"
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/strict-execution.sh (reported line 289)May include surrounding context.

sh

echo "  sudo-cmd <command> <description> [password]"
        echo ""
        echo "Examples:"
        echo "  $0 file-delete /tmp/test.txt ask"
        echo "  $0 file-delete /etc/hostname true mypassword"
        echo "  $0 sudo-cmd \"apt update\" \"Update package lists\""
        return 1

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The help example encourages deletion of /etc/hostname with sudo and even includes a plaintext password argument, normalizing dangerous privileged modification of a system file. In an agent skill, such examples can directly steer misuse and demonstrate unsafe invocation patterns that combine destructive action with credential exposure.

Content

Scanner excerpt · scripts/strict-execution.sh (reported line 290)May include surrounding context.

sh

echo ""
        echo "Examples:"
        echo "  $0 file-delete /tmp/test.txt ask"
        echo "  $0 file-delete /etc/hostname true mypassword"
        echo "  $0 sudo-cmd \"apt update\" \"Update package lists\""
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/test-skill.sh (reported line 51)May include surrounding context.

sh

EOF

# Cleanup
rm -f /tmp/test-file-123.txt
echo ""
echo "Test file cleaned up"
echo ""

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 50% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: optional-strict-instructions
description: Handle operations requiring user confirmation, permission verification, and strict adherence to explicit instructions. Activate when: (1) Operations need sudo/elevated permissions, (2) File deletion or modification is requested, (3) System changes are required, (4) User explicitly specifies a method (e.g., "use sudo"), (5) Sensitive operations need explicit consent, (6) Multiple valid approaches exist and user choice is required. Use this skill to ensure proper verification, user interaction, and strict compliance with user instructions.
---

# Optional Strict Instructions Skill

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/scenarios.md (reported line 81)May include surrounding context.

md

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/scenarios.md (reported line 91)May include surrounding context.

md

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/scenarios.md (reported line 97)May include surrounding context.

md

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/scenarios.md (reported line 198)May include surrounding context.

md

Found: /path/to/resource (details)

Options:
1. [Method A - e.g., sudo with explanation]
2. [Method B - e.g., user permissions]
3. [Safety option - e.g., move to trash]
4. [Cancel operation]

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 73% confidence

Finding

The skill includes a concrete destructive command, 'sudo rm file.txt,' which normalizes direct privileged deletion and could be misused by an agent or copied into unsafe contexts. Although the surrounding text requires prior user instruction and verification, embedding an exact root-level deletion command still increases operational risk if the skill is invoked in error or applied to attacker-influenced paths.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

**Correct Response**:
1. Check file.txt exists
2. Execute: `sudo rm file.txt`
3. If sudo needs password: "sudo requires password. Please provide password or choose alternative"
4. Do NOT try `rm file.txt` without sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

This section presents 'sudo rm /var/log/app.log' as a first-class option for deleting a root-owned log file. Even with user-choice framing, the skill concretely instructs a privileged destructive action against a sensitive system path, which could lead to log destruction, loss of forensic evidence, or service disruption if misapplied or attacker-influenced.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

Found: /var/log/app.log (requires root)

Options:
1. sudo rm /var/log/app.log
2. sudo truncate /var/log/app.log (clear contents)
3. Show file contents first
4. Cancel

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

The option 'sudo truncate /var/log/app.log' is a privileged operation that can erase log contents and destroy audit history. While less destructive than file removal and presented as an option, it still enables tampering with security-relevant logs if the skill is invoked inappropriately.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Options:

1. sudo rm /var/log/app.log
2. sudo truncate /var/log/app.log (clear contents)
3. Show file contents first
4. Cancel

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

text

### Scenario 3: Safety-Required Operations
**User**: "Modify system configuration"

**Correct Response**:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

The 'File Deletion Pattern' includes 'sudo rm -f' as a reusable template for privileged permanent deletion. Because it is framed as a general pattern, it broadens the chance that an agent applies an irreversible root-level deletion to attacker-controlled or insufficiently validated targets.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

Found: /path/file (size, owner, modified)

Options:
1. sudo rm -f (permanent, needs password)
2. rm (permanent, user permissions)
3. trash/move to recycle (reversible)
4. Cancel

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

4. Cancel

text

### Sudo Operation Pattern

Operation requires sudo to [action]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

## Learning from Mistakes

### Mistake: Assuming Alternatives
**Wrong**: When sudo fails, try user permissions without asking
**Correct**: Report failure, wait for instruction

### Mistake: Over-automation

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

**Correct**: Present options, let user choose

### Mistake: Insufficient Verification
**Wrong**: Proceed without checking resource details
**Correct**: Gather complete info first

## Implementation Checklist