snyk-labs/toxicskills-goof

{
  "summary": {
    "groups": {
      "iac": {
        "skipped": 2
      },
      "mcp": {
        "pass": 11
      },
      "rag": {
        "pass": 3
      },
      "tls": {
        "pass": 7,
        "not_applicable": 2
      },
      "network": {
        "pass": 2
      },
      "secrets": {
        "skipped": 13
      },
      "web_forms": {
        "not_applicable": 2
      },
      "containers": {
        "not_applicable": 42
      },
      "filesystem": {
        "pass": 3
      },
      "kubernetes": {
        "not_applicable": 49
      },
      "randomness": {
        "pass": 5,
        "not_applicable": 1
      },
      "acquisition": {
        "pass": 10
      },
      "persistence": {
        "pass": 2,
        "finding": 1
      },
      "web_headers": {
        "not_applicable": 5
      },
      "cryptography": {
        "pass": 4
      },
      "authorization": {
        "not_applicable": 18
      },
      "code_analysis": {
        "finding": 1
      },
      "shell_process": {
        "pass": 4,
        "not_applicable": 1
      },
      "website_trust": {
        "not_applicable": 5
      },
      "authentication": {
        "pass": 2
      },
      "github_actions": {
        "not_applicable": 7
      },
      "remote_loading": {
        "pass": 1,
        "not_applicable": 2
      },
      "deserialization": {
        "pass": 8
      },
      "dynamic_context": {
        "pass": 3
      },
      "dynamic_loading": {
        "pass": 4
      },
      "install_scripts": {
        "pass": 16
      },
      "privacy_logging": {
        "pass": 2,
        "not_applicable": 1
      },
      "download_execute": {
        "pass": 1,
        "finding": 1
      },
      "prompt_injection": {
        "pass": 2,
        "finding": 3
      },
      "session_handling": {
        "not_applicable": 3
      },
      "agent_permissions": {
        "pass": 8,
        "finding": 1
      },
      "command_injection": {
        "pass": 5,
        "not_applicable": 1
      },
      "dynamic_execution": {
        "pass": 2,
        "not_applicable": 2
      },
      "web_configuration": {
        "not_applicable": 1
      },
      "environment_access": {
        "pass": 4
      },
      "known_dependencies": {
        "not_applicable": 1
      },
      "network_boundaries": {
        "not_applicable": 8
      },
      "template_execution": {
        "pass": 1,
        "not_applicable": 2
      },
      "cloud_configuration": {
        "not_applicable": 124
      },
      "hardcoded_endpoints": {
        "not_applicable": 1
      },
      "skills_installation": {
        "pass": 2,
        "finding": 1
      },
      "model_output_execution": {
        "pass": 3
      }
    },
    "finding_count": 19,
    "checks_by_status": {
      "pass": 115,
      "finding": 8,
      "skipped": 15,
      "not_applicable": 278
    },
    "skipped_surfaces": 9,
    "tool_error_count": 0,
    "findings_by_severity": {
      "low": 3,
      "medium": 16
    }
  },
  "coverage": {
    "cancelled": false,
    "fact_count": 408,
    "checks_expected": 416,
    "terminal_results": 416,
    "inventory_complete": true,
    "correlated_findings_omitted": 0,
    "files_with_extraction_errors": 1,
    "finding_review_complete_possible": true,
    "all_declared_checks_accounted_for": true
  },
  "toolchain": {
    "tools": [
      {
        "name": "gitleaks",
        "error": null,
        "status": "completed",
        "version": "8.30.1",
        "output_ref": "6ca34b28f6a8d5b966db4205b2c0713f7618ddeb5f13e5cc9b9f309d96029e20",
        "duration_ms": 2040,
        "ruleset_identity": "d37c74a9b3a03ea2ec975095da3efb4630f2d18bcc6d20632158bcf88162de6f"
      },
      {
        "name": "bandit",
        "error": null,
        "status": "completed",
        "version": "1.8.6",
        "output_ref": "f5636a06312d57ba5188f159799b3daee300c955069607cbc2ad7665d98545df",
        "duration_ms": 2860,
        "ruleset_identity": "7c1568bc97d0e7a166c47ab1f998d02a114a816fc30a1b5da8d724878585289f"
      },
      {
        "name": "osv-offline",
        "error": null,
        "status": "not_applicable",
        "version": "1",
        "output_ref": null,
        "duration_ms": 0,
        "ruleset_identity": "not_applicable"
      }
    ],
    "ruleset": {
      "by_group": {
        "iac": 2,
        "mcp": 11,
        "rag": 3,
        "tls": 9,
        "network": 2,
        "secrets": 12,
        "web_forms": 2,
        "containers": 42,
        "filesystem": 3,
        "kubernetes": 49,
        "randomness": 6,
        "acquisition": 10,
        "persistence": 3,
        "web_headers": 5,
        "cryptography": 4,
        "authorization": 18,
        "shell_process": 5,
        "website_trust": 5,
        "authentication": 2,
        "github_actions": 7,
        "remote_loading": 3,
        "deserialization": 8,
        "dynamic_context": 3,
        "dynamic_loading": 4,
        "install_scripts": 16,
        "privacy_logging": 3,
        "download_execute": 2,
        "prompt_injection": 5,
        "session_handling": 3,
        "agent_permissions": 9,
        "command_injection": 6,
        "dynamic_execution": 4,
        "web_configuration": 1,
        "environment_access": 4,
        "network_boundaries": 8,
        "template_execution": 3,
        "cloud_configuration": 124,
        "hardcoded_endpoints": 1,
        "skills_installation": 3,
        "model_output_execution": 3
      },
      "by_adapter": {
        "fact": 150,
        "document": 246,
        "workflow": 7,
        "inventory": 10
      },
      "enabled_checks": 413,
      "ruleset_sha256": "c467b3065b9578830aba8fbd8a0e7441e92d6e88732da4dfecf8383092e3d519",
      "disabled_checks": 0,
      "ruleset_version": "first-party/3",
      "candidate_checks": 101,
      "production_by_group": {
        "iac": 0,
        "mcp": 5,
        "rag": 0,
        "tls": 7,
        "network": 2,
        "secrets": 12,
        "web_forms": 0,
        "containers": 29,
        "filesystem": 3,
        "kubernetes": 48,
        "randomness": 5,
        "acquisition": 10,
        "persistence": 1,
        "web_headers": 0,
        "cryptography": 4,
        "authorization": 15,
        "shell_process": 4,
        "website_trust": 0,
        "authentication": 1,
        "github_actions": 7,
        "remote_loading": 0,
        "deserialization": 8,
        "dynamic_context": 0,
        "dynamic_loading": 4,
        "install_scripts": 6,
        "privacy_logging": 0,
        "download_execute": 1,
        "prompt_injection": 0,
        "session_handling": 0,
        "agent_permissions": 5,
        "command_injection": 5,
        "dynamic_execution": 2,
        "web_configuration": 0,
        "environment_access": 1,
        "network_boundaries": 8,
        "template_execution": 1,
        "cloud_configuration": 118,
        "hardcoded_endpoints": 0,
        "skills_installation": 0,
        "model_output_execution": 0
      },
      "production_by_adapter": {
        "fact": 61,
        "document": 234,
        "workflow": 7,
        "inventory": 10
      },
      "enabled_production_checks": 312
    },
    "python_version": "3.13.15",
    "inspector_version": "0.2.0",
    "toolchain_version": "sha256:0c8b220065b051d4047fb0a4ca8d7cbbc4d9d9441e0c3796c3f829c1aee3bbbd",
    "installed_identity": {
      "python": "3.13.15",
      "ruleset": {
        "by_group": {
          "iac": 2,
          "mcp": 11,
          "rag": 3,
          "tls": 9,
          "network": 2,
          "secrets": 12,
          "web_forms": 2,
          "containers": 42,
          "filesystem": 3,
          "kubernetes": 49,
          "randomness": 6,
          "acquisition": 10,
          "persistence": 3,
          "web_headers": 5,
          "cryptography": 4,
          "authorization": 18,
          "shell_process": 5,
          "website_trust": 5,
          "authentication": 2,
          "github_actions": 7,
          "remote_loading": 3,
          "deserialization": 8,
          "dynamic_context": 3,
          "dynamic_loading": 4,
          "install_scripts": 16,
          "privacy_logging": 3,
          "download_execute": 2,
          "prompt_injection": 5,
          "session_handling": 3,
          "agent_permissions": 9,
          "command_injection": 6,
          "dynamic_execution": 4,
          "web_configuration": 1,
          "environment_access": 4,
          "network_boundaries": 8,
          "template_execution": 3,
          "cloud_configuration": 124,
          "hardcoded_endpoints": 1,
          "skills_installation": 3,
          "model_output_execution": 3
        },
        "by_adapter": {
          "fact": 150,
          "document": 246,
          "workflow": 7,
          "inventory": 10
        },
        "enabled_checks": 413,
        "ruleset_sha256": "c467b3065b9578830aba8fbd8a0e7441e92d6e88732da4dfecf8383092e3d519",
        "disabled_checks": 0,
        "ruleset_version": "first-party/3",
        "candidate_checks": 101,
        "production_by_group": {
          "iac": 0,
          "mcp": 5,
          "rag": 0,
          "tls": 7,
          "network": 2,
          "secrets": 12,
          "web_forms": 0,
          "containers": 29,
          "filesystem": 3,
          "kubernetes": 48,
          "randomness": 5,
          "acquisition": 10,
          "persistence": 1,
          "web_headers": 0,
          "cryptography": 4,
          "authorization": 15,
          "shell_process": 4,
          "website_trust": 0,
          "authentication": 1,
          "github_actions": 7,
          "remote_loading": 0,
          "deserialization": 8,
          "dynamic_context": 0,
          "dynamic_loading": 4,
          "install_scripts": 6,
          "privacy_logging": 0,
          "download_execute": 1,
          "prompt_injection": 0,
          "session_handling": 0,
          "agent_permissions": 5,
          "command_injection": 5,
          "dynamic_execution": 2,
          "web_configuration": 0,
          "environment_access": 1,
          "network_boundaries": 8,
          "template_execution": 1,
          "cloud_configuration": 118,
          "hardcoded_endpoints": 0,
          "skills_installation": 0,
          "model_output_execution": 0
        },
        "production_by_adapter": {
          "fact": 61,
          "document": 234,
          "workflow": 7,
          "inventory": 10
        },
        "enabled_production_checks": 312
      },
      "contract": "inspector.toolchain/1",
      "platform": "x86_64",
      "executables": {
        "bandit": "60b67b200393962f5c59668119ab4433f7ef85fc78ede33b92bf8b7ce6c23cbe",
        "gitleaks": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509"
      },
      "source_sha256": "498db5f132a7cfa3f70b9fc4c504ea0cb400c1c1a6dfc2ff1daaf2a45cb8a051",
      "toolchain_version": "sha256:0c8b220065b051d4047fb0a4ca8d7cbbc4d9d9441e0c3796c3f829c1aee3bbbd",
      "installed_packages": [
        [
          "PyYAML",
          "6.0.3"
        ],
        [
          "Pygments",
          "2.21.0"
        ],
        [
          "attrs",
          "26.1.0"
        ],
        [
          "bandit",
          "1.8.6"
        ],
        [
          "diggingbeagle-inspector",
          "0.2.0"
        ],
        [
          "iniconfig",
          "2.3.0"
        ],
        [
          "jsonschema",
          "4.26.0"
        ],
        [
          "jsonschema-specifications",
          "2025.9.1"
        ],
        [
          "markdown-it-py",
          "4.2.0"
        ],
        [
          "mdurl",
          "0.1.2"
        ],
        [
          "packaging",
          "25.0"
        ],
        [
          "pip",
          "26.2.1"
        ],
        [
          "pluggy",
          "1.6.0"
        ],
        [
          "psycopg",
          "3.2.6"
        ],
        [
          "psycopg-binary",
          "3.2.6"
        ],
        [
          "pytest",
          "9.0.2"
        ],
        [
          "referencing",
          "0.37.0"
        ],
        [
          "rich",
          "15.0.0"
        ],
        [
          "rpds-py",
          "2026.6.3"
        ],
        [
          "semver",
          "3.0.4"
        ],
        [
          "setuptools",
          "75.8.2"
        ],
        [
          "stevedore",
          "5.9.1"
        ]
      ],
      "tool_configurations": {
        "bandit.ini": "1ac8b7ca6758d27c826f2e2389d315d2449b636596ca15557871d9992e47bb04",
        "bandit.yaml": "0ee03e3824c3b4d993af538b46e200e66cd953af1c4063e25f1d7ad6cbc31f8a",
        "gitleaks.toml": "030234da2fd3a18911bc9d46cb682a4502ec50dee9de82f56a7a6d7ad7586135",
        "empty.gitleaksignore": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      },
      "vulnerability_database_sha256": null
    },
    "vulnerability_db_version": "not_applicable"
  }
}

The match is an example of curl-to-shell syntax inside skill-defender threat-pattern reference documentation. The repository's scanner code explicitly allowlists skill-defender threat-pattern material because it documents the malicious patterns it detects.

README instructs operators to run an unpinned mcp-scan@latest command. This is a real unpinned-install surface but is explicit demo/setup documentation rather than evidence of covert execution.

The machine candidate points to a concealed remote-installer-shaped command in the Snyk skill and appears security-relevant. It is left unresolved because this returned audit package does not carry the exact pinned machine evidence range needed to create a provenance-valid editorial finding without widening or inventing evidence.

The MEMORY.md phrase occurs in skill-defender threat-pattern reference documentation describing persistence indicators, not as an instruction for this scanner skill to persist.

The machine candidate points to curl-to-shell behavior in the Snyk skill and appears security-relevant. It is left unresolved because the audit validator requires any confirmed/likely disposition to bind an editorial finding strictly to the exact pinned machine evidence range, which is not available in this returned package.

The wget-to-bash string is an example in skill-defender threat-pattern reference documentation. The same repository's scanner explicitly treats this skill's threat examples as known false positives.

README gives an explicit OpenCode installation command using curl-to-bash. It is a supply-chain-sensitive setup pattern but is not presented as hidden target behavior.

The prompt-override phrase appears as a malicious-pattern example in skill-defender reference documentation, not as operative instructions for the reference document itself.

The AGENTS.md persistence phrase is documented as an indicator example in skill-defender reference material and is explicitly within the scanner's known false-positive class.

A second README occurrence of mcp-scan@latest repeats the same explicit unpinned demo/setup command. It is relevant hardening context, not covert malicious execution.

The ClawHub skill documents options that skip confirmation. That reduces interactive safeguards but the matched phrase alone does not establish a permission bypass exploit. The same file contains a separate, materially stronger obfuscated remote-execution finding.

The hide-from-user phrase is a threat-pattern example inside skill-defender's reference material, not an operative concealment instruction for the reference file.

The Gemini ClawHub skill documents a skip-confirmation option. This can weaken interactive review but is not sufficient on its own to establish abusive tool authority.

The agents ClawHub skill documents a skip-confirmation option. It is relevant operational context, but the lexical match is not itself proof of malicious permission bypass.

This is another skip-confirmation reference in the Gemini ClawHub documentation. It is not independently a vulnerability, though it can remove an interactive safety step.

The read-secrets phrase is a threat-pattern example in the scanner reference file. Its context is defensive detection documentation.

Bandit B603 flags subprocess execution in the scanner aggregator. The call uses an argument vector without shell=True and intentionally launches a scanner script supplied to the tool. Static review does not establish command injection.

Bandit B404 reports importing subprocess. Importing the module is not itself a vulnerability; the relevant invocation was reviewed separately.

Bandit B607 notes use of the partial executable name python3. PATH resolution is a hardening consideration, but the evidence does not establish attacker-controlled PATH or executable substitution in this snapshot.