Infrastructure for agents

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:22 PM UTC
• Version: 1.0.1

Overview

The skill is coherent for AgentOS infrastructure management, but it exposes spending, communications, call recording, wallet-key use, and server deletion without enough explicit safeguards.

Install only if you are comfortable letting an agent manage paid AgentOS resources and communications. Require explicit approval before any purchase, send, deploy, delete, DNS update, wallet action, or call recording; verify target IDs before destructive actions; avoid npx/latest installs where possible; and run the decrypt helper only on a trusted machine with a keypair you intend to expose to that local process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party npm Packages Permit Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:6 and decrypt-email.mjs:23-27
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:6:

markdown

**CLI:** `npm i -g @agntos/agentos` (or `npx @agntos/agentos`)

decrypt-email.mjs:23-27:

javascript

try {
  nacl = (await import("tweetnacl")).default;
} catch {
  console.error("Install tweetnacl: npm i tweetnacl tweetnacl-util");
  process.exit(1);
}

Technical Analysis

The documented installation commands do not pin @agntos/agentos, tweetnacl, or tweetnacl-util to reviewed versions. The project also contains no package manifest, lockfile, package integrity metadata, or signature-verification procedure.

As a result, npm resolves mutable package releases at installation time. The npx @agntos/agentos alternative is particularly sensitive because it can download and immediately execute the currently published package. Package lifecycle scripts, transitive dependencies, and CLI entry points may all execute code with the privileges of the invoking user.

This creates a supply-chain trust boundary in which the code executed by users can differ from the code reviewed during the audit. Exploitation would require compromise or malicious control of a package publisher, package release, registry response, or transitive dependency.

Attack Path

1. An attacker compromises a referenced npm publisher account, package release process, registry delivery path, or transitive dependency.
2. The attacker publishes a malicious release under one of the unpinned package names.
3. A user follows the documented npm i -g, npx, or dependency-installation instruction.
4. npm resolves and downloads the attacker-controlled release because no exact reviewed version or integrity value is required.
5. Malicious lifecycle hooks, dependency initialization code, or CLI entry-po ...[truncated 1064 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency and documented CLI to an exact reviewed version rather than relying on the latest published release.
2. Add a package.json and committed lockfile generated from a trusted dependency-resolution environment.
3. Use reproducible installation commands such as npm ci for the helper's dependencies.
4. Replace unpinned npx @agntos/agentos guidance with an exact version, for example npx @agntos/agentos@<reviewed-version>.
5. Pin tweetnacl as a declared dependency and remove the ad hoc instruction to install both packages at their latest versions.
6. Verify package provenance, publisher identity, repository linkage, and npm integrity metadata before approving version updates.
7. Review transitive dependencies and lifecycle scripts as part of every dependency upgrade.
8. Prefer execution in a restricted environment with minimal filesystem, wallet, SSH-agent, and network access.
9. Avoid installing the CLI with elevated privileges and document the minimum permissions required for each workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The skill exposes a destructive endpoint, DELETE /compute/servers/:id, without documenting any validation, confirmation, scoping, or safeguards around the :id parameter. In agent-driven workflows, this creates a tool-parameter abuse risk where prompt injection, hallucinated identifiers, or malicious instructions could cause deletion of the wrong resource or unauthorized destructive actions within the user's wallet scope.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

| Server status | `GET /compute/servers/:id` | 0.02 |
| Server action | `POST /compute/servers/:id/actions` | 0.10 |
| Resize server | `POST /compute/servers/:id/resize` | 0.10 |
| Delete server | `DELETE /compute/servers/:id` | 0.10 |
| **Domains** | | |
| Check availability | `GET /domains/check?domain=example.com` | Free |
| TLD pricing | `GET /domains/pricing?domain=example` | Free |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill recommends running npx @agntos/agentos without pinning a specific version, which allows whatever package version is current at execution time to be fetched and run. In an agent context, this increases supply-chain risk because a compromised publisher account, malicious update, or typo-squatted dependency could immediately affect users or agents invoking the command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents billable and destructive operations such as buying phone numbers, sending messages, creating infrastructure, and deleting servers, but it does not instruct the agent or user to require explicit confirmation before execution. In autonomous or semi-autonomous use, this can lead to unintended charges, resource creation, or irreversible deletion from prompt confusion or malicious instruction injection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented call recording feature enables capture of live communications but provides no warning about consent, legal restrictions, or privacy handling. In many jurisdictions, recording without proper notice or consent can create legal exposure and privacy harm, especially if an agent can invoke the feature automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script loads a Solana keypair JSON and derives a secret key from it, which is a sensitive credential-handling operation. Although the top-level description mentions using a private key, there is no explicit warning, confirmation, or user-facing disclosure near the read/derivation step about the sensitivity of the file or the risk of exposing key material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.