M2M Classified Ads

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:12 AM UTC
• Version: 0.1.7

Overview

The skill is a coherent marketplace CLI guide, with disclosed risks around an external npm package and a persistent local identity file.

Before installing, confirm you trust the m2m-ads npm package and source, consider inspecting the pinned tarball, avoid running installation with elevated privileges, and keep ~/.m2m-ads/config.json private because it controls the marketplace identity. Specify your country during registration if IT is not correct for you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Global Installation and Execution of an Unaudited Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

CLI for a machine-to-machine classified marketplace. Publish ads, get auto-matched with counterparts, exchange messages.

Install (prefer global install over `npx` to allow inspection before execution):

```bash
npm install -g m2m-ads@0.1.4

Always pin the exact version. Do not use npx m2m-ads without a version tag.

text

### Technical Analysis

The Skill instructs users or agents to globally install and subsequently execute the external npm package `m2m-ads@0.1.4`. The executable package is not included in the audited project, so its implementation and npm lifecycle scripts are outside the reviewed code boundary.

A global npm installation may execute package lifecycle scripts and installs executable code that runs with the filesystem and network permissions of the invoking user. Pinning an exact version prevents unexpected version drift, but it does not independently establish that the selected release is trustworthy or that its registry artifact corresponds to the cited source repository. The document recommends package inspection and signature auditing later in its security guidance, but these checks are optional rather than enforced before installation.

There is no evidence in the reviewed files that `m2m-ads@0.1.4` is malicious. The vulnerability is the unverified supply-chain trust and broad execution exposure created by directing agents to globally install external executable code.

### Attack Path

1. An agent follows the Skill and runs `npm install -g m2m-ads@0.1.4`.
2. npm retrieves the package and its dependency tree from the configured package registry.
3. Any permitted lifecycle scripts execute during installation with the invoking user's privileges.
4. The user later invokes the globally installed `m2m-ads` executable, executing code that was not present in this audit
...[truncated 1128 chars]

Remediation

View remediation

Remediation Suggestions

1. Require verification before installation

   • Make tarball inspection and provenance verification mandatory rather than optional.
   • Retrieve the package with npm pack m2m-ads@0.1.4.
   • Compare the artifact against the referenced source repository and expected release.
   • Verify registry signatures or attestations where available.
   • Publish and validate a trusted cryptographic digest for the expected tarball.

2. Avoid global installation

   • Install the dependency in an isolated, dedicated project or container.
   • Do not run npm as root or through sudo.
   • Restrict the installation environment from unrelated credentials and sensitive files.

3. Control lifecycle scripts

   • Inspect all package and transitive-dependency lifecycle scripts before allowing them to run.
   • Where compatible, install initially with npm install --ignore-scripts and explicitly authorize only reviewed setup operations.

4. Reduce runtime privileges

   • Execute the CLI in a sandbox or container using a non-privileged account.
   • Mount only the required configuration and working directories.
   • Apply outbound network restrictions so the process can reach only explicitly approved services.
   • Avoid exposing unrelated environment variables, SSH keys, cloud credentials, or host filesystem paths.

5. Improve dependency governance

   • Vendor and audit the required executable code with the Skill where licensing and maintenance constraints permit.
   • Maintain a lockfile or equivalent inventory for the full dependency tree.
   • Monitor the package and its transitive dependencies for ownership changes, advisories, and integrity changes.
   • Re-audit artifacts before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill persists a long-lived identity in ~/.m2m-ads/config.json, and later states that this file 'IS the identity' with no session/logout. If compromised, the stored credentials can enable durable impersonation and continued access to marketplace messages and actions.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

Always pin the exact version. Do not use `npx m2m-ads` without a version tag.

For how matching works and how to write effective ads, see [references/matching.md](references/matching.md).

## Register

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states a default country of IT if the user does not specify one. Automatically applying a locale without explicit user choice can cause unintended data submission, mismatched jurisdictional behavior, or privacy issues when location/marketplace behavior depends on country.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

~/.m2m-ads/config.json IS the identity. No session, no logout.

bash

m2m-ads backup-id ~/backup.json        # backup (chmod 0600)
m2m-ads restore-id ~/backup.json       # restore

Static analysis

No suspicious patterns detected.