huo15-reasonix-bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:21 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed Reasonix desktop bridge, but one included helper script has a real command-execution risk if run with a malicious HOME environment.

Review before installing. The skill is intended to read local Reasonix desktop state and resume previous sessions, so use it only when you are comfortable exposing local project paths, topic metadata, and selected session history to the agent. Do not run the packaged list-projects.sh helper in untrusted wrapper or automation environments until the HOME-derived Python injection issue is fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/list-projects.sh:5

Finding

Python Code Injection Through Unsafely Interpolated HOME-Derived Path

Content

View full analysis

Vulnerability Details

File Location: scripts/list-projects.sh, lines 5–19
Vulnerability Type: Environment-variable-based Python code injection
Risk Level: Medium

bash

PROJECTS_FILE="$HOME/.reasonix/desktop-projects.json"

if [ ! -f "$PROJECTS_FILE" ]; then
  echo "Error: desktop-projects.json was not found. The Reasonix desktop application may not have been run."
  exit 1
fi

python3 -c "
import json
with open('$PROJECTS_FILE') as f:
    d = json.load(f)
projects = d.get('projects', [])
for p in projects:
    root = p['root']
    topic_count = len(p.get('topics', []))
    print(f'{root} ({topic_count} topics)')
"

Technical Analysis

The script constructs PROJECTS_FILE from the process-controlled HOME environment variable and then directly interpolates that value into source code passed to python3 -c.

Shell quoting of "$PROJECTS_FILE" protects the preliminary file test, but it does not make the value safe for insertion into Python source. If HOME contains Python string delimiters and expressions, the resulting python3 -c program can be syntactically altered.

For example, an attacker can construct a HOME value containing a Python expression such as:

text

/tmp/x'+str(__import__('os').system('ATTACKER_COMMAND'))+'y

This causes the command expression to be evaluated while Python constructs the argument to open(). The subsequent file operation may fail because the evaluated path differs from the literal path checked by the shell, but the injected operating-system command has already executed.

Exploitation requires the attacker to control the environment of the script and create the literal path expected by the preliminary -f check. These prerequisites reduce exploitability, but they do not eliminate the code-execution flaw.

Attack Path

1. An attacker gains control over the HOME environment variable supplied to list-projects.sh, such as th ...[truncated 1146 chars]

Remediation

View remediation

Remediation Suggestions

Do not embed filesystem paths or other environment-derived values into dynamically generated Python source. Pass the path as a positional argument and read it through sys.argv:

bash

PROJECTS_FILE="$HOME/.reasonix/desktop-projects.json"

if [ ! -f "$PROJECTS_FILE" ]; then
  echo "Error: desktop-projects.json was not found. The Reasonix desktop application may not have been run." >&2
  exit 1
fi

python3 - "$PROJECTS_FILE" <<'PY'
import json
import sys

projects_file = sys.argv[1]

with open(projects_file, encoding="utf-8") as f:
    data = json.load(f)

for project in data.get("projects", []):
    root = project["root"]
    topic_count = len(project.get("topics", []))
    print(f"{root} ({topic_count} topics)")
PY

This approach keeps the path as data rather than executable Python syntax. The quoted heredoc delimiter also prevents shell expansion inside the Python program.

Additional hardening measures include:

• Validate that HOME is an absolute path and is obtained from a trusted execution context.
• Reject unexpected control characters, especially newlines and null-like input representations.
• Run the script with the least privileges required.
• Avoid eval, dynamic source construction, and interpolation of external values into interpreter command strings throughout the skill.
• Add a regression test using HOME values containing quotes, newlines, spaces, and shell or Python metacharacters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly operates on shared local Reasonix desktop storage under ~/.reasonix and enumerates project/session metadata, but it does not warn users that invoking it may expose local project names, paths, topics, and session artifacts to the agent. In this context, that omission is dangerous because the bridge is specifically designed to traverse desktop state and shared history, so users may unknowingly disclose sensitive local data when asking seemingly routine listing or sync actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to resume prior Reasonix sessions using full session file paths and notes that complete historical context is loaded, but it does not clearly warn that previous conversation contents will be reintroduced into the new run. This is risky because resumed sessions may contain sensitive prompts, files, credentials, business data, or prior model outputs, and the bridge makes cross-context reuse a core feature rather than an incidental behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This shell script includes its descriptive comments, usage text, and runtime messages entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy for this audit flags language or locale constraints when they are forced and not clearly justified as region-specific.

Content

No source excerpt is available for this finding.