Security audit

regex-sandbox

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a small regex helper, but its installation instructions rely on mutable remote/global installs that may not match the reviewed artifact.

Review the install path before using this skill. Prefer installing the exact reviewed artifact or a pinned commit/version instead of running the documented unpinned npx or default-branch Git clone commands. Treat file input as potentially sensitive because matches and replacement previews can be printed, and use bounded inputs because the regex engine is not resource-isolated.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:78
Finding: Unpinned Remote Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 78-84 **Vulnerability Type**: Unpinned remote dependencies and mutable installation sources **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/regex-sandbox ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process invokes `npx skills` without specifying an exact package version. Depending on the local npm configuration and cache, `npx` may retrieve and execute the latest available release of the named CLI. The code that executes at installation time can therefore differ from the code that was reviewed. The alternative installation procedure clones the default branch of a mutable personal GitHub repository without pinning a commit hash, release tag, checksum, or cryptographic signature. It then copies repository content directly into an Agent skill directory. Consequently, future modifications or compromise of that upstream repository could cause users to install content that is materially different from the audited artifact. The `-g` option also requests global skill installation, increasing the scope over which compromised skill content may become available. This finding concerns the documented supply-chain workflow; no malicious remote retrieval was found in the local Python script itself. ### Attack Path 1. An attacker compromises the npm package used by `npx`, the associated package namespace, the GitHub account, or the upstream repository. 2. The attacker publishes a modified CLI release or adds malicious instructions or scripts to the repository's default branch. 3. A user follows the documented installation command without pinning or verifying the retrieved content. 4. `npx` executes ...[truncated 687 chars]
Remediation: ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, for example by using `npx --package skills@<exact-version> skills ...`, and record the expected package integrity hash. 2. Pin the Git repository to an immutable commit hash or a cryptographically signed release rather than cloning and using the default branch directly. 3. Publish and verify SHA-256 checksums or signatures for distributed artifacts. 4. Avoid global installation by default. Prefer a project-local or otherwise isolated skill directory with least-privilege permissions. 5. Require users to inspect the downloaded manifest, instructions, and scripts before activation. 6. Use a trusted package lockfile or reproducible release archive so that installation resolves to the exact audited content. 7. Document how users can verify the package publisher, repository commit, release signature, and artifact checksum.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/regex_sandbox.py:5
Finding: Unrestricted Regular Expressions Permit CPU and Memory Denial of Service## Vulnerability Details **File Location**: `scripts/regex_sandbox.py`, lines 5 and 14-20; additional replacement sinks at lines 27 and 35 **Vulnerability Type**: Regular-expression denial of service and unbounded result materialization **Risk Level**: Medium ### Vulnerable Code ```python ap.add_argument("--pattern", required=True) ``` ```python try: pat = re.compile(a.pattern, f) except re.error as e: print("正则编译失败: %s" % e); sys.exit(2) text = open(a.file, encoding="utf-8").read() if a.file else (a.text if a.text is not None else sys.stdin.read()) ms = list(pat.finditer(text)) ``` The same unrestricted expression is evaluated again during replacement: ```python "replaced": pat.sub(a.replace, text) if a.replace is not None else None ``` ```python print(pat.sub(a.replace, text)) ``` ### Technical Analysis The program accepts an arbitrary caller-controlled pattern and processes caller-selected text using Python's backtracking `re` engine. Matching occurs in the main process without an execution timeout, CPU quota, memory limit, input-size limit, or pattern-complexity restriction. Expressions containing nested or ambiguous quantifiers can exhibit catastrophic backtracking on carefully selected near-matching input. For example, a pattern structurally similar to `^(a+)+$` can require rapidly increasing processing time when evaluated against a long sequence of `a` characters followed by a nonmatching character. In addition, `list(pat.finditer(text))` materializes every match object in memory before producing output. Large input or patterns that produce many matches can therefore consume substantial memory. If replacement is requested, `pat.sub` executes another complete regex operation and creates a replacement string, further increasing CPU and memory consumption. Despite the project's “sandbox” name, the implementation provides no process or resource isolation. ### Attack Path 1. An atta ...[truncated 1159 chars]
Remediation: ## Remediation Suggestions 1. Execute regex evaluation in a separate worker process and enforce a strict wall-clock timeout. Terminate the worker if the limit is exceeded. 2. Apply operating-system resource limits to the worker, including CPU time, address-space usage, and maximum readable file size. 3. Enforce explicit maximum sizes for command-line text, standard input, and files before loading them into memory. 4. Limit the number of collected and emitted matches. Iterate lazily and stop after a configurable maximum instead of calling `list()` over all matches. 5. Limit replacement-output size and avoid running a second unrestricted match pass when it is unnecessary. 6. Reject or warn about known high-risk constructs such as nested ambiguous quantifiers. Pattern validation should supplement, not replace, execution timeouts. 7. Where compatibility permits, use a regex engine designed to guarantee linear-time matching for supported syntax. 8. Handle timeout and resource-limit failures with a controlled nonzero exit code and a concise error message. 9. Update the documentation to state explicitly that the utility is not a security isolation boundary unless process-level limits are implemented.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest says this skill is a regex sandbox for writing and testing patterns, capture groups, replacement previews, and flags. However, the README's English description broadens the purpose to 'daily file/text chores,' which implies a more general text/file manipulation utility rather than a focused regex testing sandbox.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The phrase "One command for daily file/text chores" is a broad natural-language description without clear trigger boundaries or exclusion conditions. In a README for a skill, this can create ambiguity about when the skill should be invoked versus other file or text utilities.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown file contains the skill's display name, title, description, summary, and most operating instructions exclusively in Chinese. That can violate a language/locale policy when the skill effectively forces one language for understanding and use without explicitly offering the user an alternative or opt-in.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a regex sandbox, but the documentation also advertises write-capable operations such as text replacement and duplicate-file handling with `--apply`. This expands the effective capability from read/test behavior into file-modifying behavior, increasing the chance that an agent or user grants it broader trust than warranted and causing unintended filesystem changes.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The argument parser description and help strings are written entirely in Chinese, which imposes a specific language on all users with no visible opt-in or locale selection. This matches the language/locale policy concern for natural-language content that forces a language without offering user choice.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: This file contains user-facing natural language primarily in Chinese, with only the title bilingualized, and does not indicate that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The file is bilingual, but the prominent Chinese-first presentation could be interpreted as imposing a default language experience without explicitly offering language preference selection. This may conflict with language/locale policy expectations when a skill should not force or assume a language without opt-in.

Intent-Code Divergence

Low

Confidence: 71% confidence
Finding: The documentation presents the tool as dry-run by default but able to 'execute' with '--apply', which creates tension with the manifest's 'sandbox' framing centered on instant regex testing and preview. This is not merely omitted detail: the README actively frames the tool as capable of making real changes, which can mislead users about the intended safe, sandboxed scope.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The script can read content from a user-specified file via `--file`, but there is no confirmation prompt, warning text, or comment calling out that local file contents will be loaded and then potentially echoed back in output. Because the tool may print matched or replaced content, this file access can expose sensitive data without any explicit disclosure in the code.

Static analysis

No suspicious patterns detected.