Security audit

code-risk-agent

Security checks across malware telemetry and agentic risk

Overview

This code-scanning skill is purpose-aligned, but it needs Review because its cloud-AI/code-upload behavior is inconsistently documented and uses broad code access.

Install only if you are comfortable granting it access to scan local source trees and, when AI analysis is enabled, sending source code to the configured LLM provider. Prefer leaving enable_ai=false or setting CODERISK_LLM_BACKEND=local for private code, and avoid SSE mode until the advertised auth middleware is fixed.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises substantial capabilities including environment access, file read/write, network use, and shell execution, but does not declare permissions. This weakens review and consent boundaries, making it easier for a user or orchestrator to invoke a skill with broader operational power than the metadata suggests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is narrower than the behavior described in the skill, which also exposes MCP server/SSE service functionality, standalone CVE lookup, taint analysis, and additional report formats. Description-behavior mismatch is dangerous because reviewers and users may grant trust based on an incomplete understanding of what the skill can actually do, especially where network-facing or service-hosting behavior exists.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation gives conflicting statements about whether cloud LLM analysis is default versus local/static analysis, which can mislead users about data handling. In a code-audit skill, ambiguity around whether source code is sent to a remote provider creates real privacy and compliance risk.

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: The module docstring states 'No cloud API calls,' but the client will POST full prompts to whatever `api_url` is configured for the HTTP backend. That mismatch can cause operators to trust the component with sensitive code or secrets under the false assumption that data never leaves the host, increasing the chance of unintentional data disclosure.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The SSE server claims to enforce API-key authentication, but this file references `APIKeyAuthMiddleware` without defining or importing it. In practice this causes SSE startup to fail with a runtime error, creating a security/control mismatch: operators may believe authenticated SSE is available when it is not, and future ad-hoc fixes may remove auth entirely to restore functionality.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The privacy statement claims cloud AI semantic analysis is disabled by default unless the user enables it, but the MCP server environment is preconfigured with CODERISK_LLM_BACKEND=openai. That mismatch can cause users or integrators to trust that code stays local when the runtime defaults are already pointed at a cloud provider, increasing the risk of unintended source-code exfiltration during security scans.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrase '安全 + 报告' is broad enough to match many unrelated requests, increasing the chance this skill activates outside its intended scope. Over-broad triggering can cause unintended code access, dependency scanning, or cloud analysis workflows to run when the user did not specifically request them.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The analyzer sends full source code to an external LLM via self.llm.chat_json, and this file contains no user-facing notice, consent, or gating before transmission. In a code-auditing tool, source files may contain proprietary code, secrets, or regulated data, so silent exfiltration to a remote model endpoint creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The fallback path also transmits the full file content to the LLM when no static findings exist, so the privacy risk persists even when the main validation flow is not used. Because this path may be triggered automatically, users can unknowingly send sensitive code externally under conditions they may not expect.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This path transmits the full `messages` payload over HTTP to the configured server with no explicit consent, warning, or trust boundary check. In a code-security agent, those messages may contain proprietary source, secrets, or vulnerability details, so misconfiguration to a remote or intercepted endpoint could leak sensitive material.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The streaming path has the same exposure as the non-streaming HTTP path: it sends full prompt content to the configured server without an explicit warning or locality restriction. Because this skill analyzes code security, the transmitted content is especially likely to include confidential code and findings, making leakage more consequential.

Ssd 1

High

Confidence: 96% confidence
Finding: Raw file contents are embedded directly into the user prompt, so any natural-language instructions inside the analyzed code are exposed to the model as prompt text rather than inert data. This creates a classic prompt-injection channel that can cause the model to ignore intended analysis behavior, misclassify findings, fabricate results, or follow attacker-written instructions hidden in the scanned file.

Ssd 1

Medium

Confidence: 90% confidence
Finding: Static-analysis descriptions are inserted verbatim into the LLM prompt, so maliciously crafted scanner output or tainted metadata can indirectly instruct the model and bias its reasoning. Because this component is specifically responsible for validating and downgrading risks, prompt injection here can suppress true positives or generate misleading security reports.

Context Leakage

High

Category: Data Exfiltration
Content: max_tokens: Optional[int] = None, schema: Optional[type] = None, ) -> dict: """Send chat request, parse JSON with auto-retry and optional schema validation. Args: schema: Pydantic model class for output validation.
Confidence: 75% confidence
Finding: `chat_json` resubmits prior messages plus an error string and optional full schema details back to the model on parse failure. In this security-analysis context, that can amplify context leakage by repeatedly sending sensitive prompt content and internal validation structure to the backend, especially if the HTTP backend is remote or untrusted.

Unpinned Dependencies

Low

Category: Supply Chain
Content: mcp>=1.0.0 httpx>=0.25 pydantic>=2.0 rich>=13.0
Confidence: 92% confidence
Finding: Using a lower-bound specifier like `mcp>=1.0.0` makes builds non-reproducible and can silently introduce insecure or incompatible versions over time. In a security-sensitive code scanning agent, dependency drift increases supply-chain risk and can pull in versions with newly introduced vulnerabilities or breaking changes.

Unpinned Dependencies

Low

Category: Supply Chain
Content: mcp>=1.0.0 httpx>=0.25 pydantic>=2.0 rich>=13.0 semgrep>=1.0
Confidence: 90% confidence
Finding: `httpx>=0.25` allows future unreviewed versions to be installed, reducing reproducibility and increasing supply-chain exposure. Because this package likely handles network communication in the MCP server, unexpected version changes could affect request handling and security behavior.

Unpinned Dependencies

Low

Category: Supply Chain
Content: mcp>=1.0.0 httpx>=0.25 pydantic>=2.0 rich>=13.0 semgrep>=1.0 pyyaml>=6.0
Confidence: 94% confidence
Finding: `pydantic>=2.0` permits installation of a broad version range, including versions with known flaws or future regressions. Since Pydantic is commonly used for parsing and validation, dependency drift here can directly affect input validation safety in the server.

Unpinned Dependencies

Low

Category: Supply Chain
Content: mcp>=1.0.0 httpx>=0.25 pydantic>=2.0 rich>=13.0 semgrep>=1.0 pyyaml>=6.0 starlette>=0.27
Confidence: 88% confidence
Finding: `rich>=13.0` is unpinned, which weakens reproducibility and slightly increases supply-chain risk through unreviewed upgrades. While `rich` is typically lower risk than network-facing libraries, any unpinned dependency can still introduce malicious or vulnerable code.

Unpinned Dependencies

Low

Category: Supply Chain
Content: httpx>=0.25 pydantic>=2.0 rich>=13.0 semgrep>=1.0 pyyaml>=6.0 starlette>=0.27 uvicorn>=0.24
Confidence: 90% confidence
Finding: `semgrep>=1.0` allows uncontrolled upgrades of a security analysis tool that may change behavior or introduce vulnerabilities in the execution environment. In a code-risk agent, tool integrity matters because findings and trust decisions may depend on this package.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydantic>=2.0 rich>=13.0 semgrep>=1.0 pyyaml>=6.0 starlette>=0.27 uvicorn>=0.24
Confidence: 90% confidence
Finding: `pyyaml>=6.0` is unpinned, so deployments may resolve to different versions with different security characteristics. YAML libraries have historically been security-sensitive, making uncontrolled upgrades an avoidable supply-chain and parsing risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rich>=13.0 semgrep>=1.0 pyyaml>=6.0 starlette>=0.27 uvicorn>=0.24 # 本地 GPU 回退（可选，需要 ROCm + llama.cpp）
Confidence: 95% confidence
Finding: `starlette>=0.27` is especially risky to leave unpinned because it is a network-facing web framework and version drift can directly affect request parsing, routing, and security controls. Combined with known advisories for the lower bound version, loose versioning makes it harder to guarantee patched deployments.

Unpinned Dependencies

Low

Category: Supply Chain
Content: semgrep>=1.0 pyyaml>=6.0 starlette>=0.27 uvicorn>=0.24 # 本地 GPU 回退（可选，需要 ROCm + llama.cpp） # llama-cpp-python>=0.3.0
Confidence: 90% confidence
Finding: `uvicorn>=0.24` permits unreviewed future versions and undermines deterministic builds for an Internet-facing ASGI server component. For a server process, dependency drift can alter TLS, header parsing, logging, or request-handling behavior in security-relevant ways.

Known Vulnerable Dependency: mcp==1.0.0 — 10 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2025-53365 (MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to ) +7 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The finding indicates that `mcp` version 1.0.0 has multiple known advisories, including validation and DNS rebinding related issues. In an MCP server used for code and security analysis, vulnerabilities in the protocol SDK are particularly dangerous because they may expose the server to remote attacks or malformed request handling.

Known Vulnerable Dependency: pydantic==2.0 — 2 advisory(ies): CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2024-3772 (Pydantic regular expression denial of service)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: `pydantic` 2.0 is flagged for a regular-expression denial-of-service issue, which can allow crafted input to consume excessive CPU during validation. In a service that processes user-supplied data, this can degrade availability or facilitate resource exhaustion.

Known Vulnerable Dependency: starlette==0.27 — 10 advisory(ies): CVE-2025-54121 (Starlette has possible denial-of-service vector when parsing large files in mult); CVE-2026-54283 (Starlette: request.form() limits silently ignored for application/x-www-form-url); CVE-2026-48710 (Starlette has missing Host header validation that poisons request.url.path, bypa) +7 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: `starlette` 0.27 is reported with multiple advisories affecting request parsing, limits handling, and host/header validation. Because Starlette is directly involved in HTTP request processing, these flaws can materially affect confidentiality, integrity, and availability of the MCP server.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: agents/static_analyzer.py:117

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: core/taint_analyzer.py:13

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README_CN.md:66