Security audit

Beepack API Registry

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Beepack registry helper, but it automatically steers broad coding work toward a third-party service and can copy remote code or submit project details without clear user approval.

Review before installing. Use it only if you are comfortable with Beepack influencing routine coding tasks, and require explicit review before any external request, copied package code, feedback submission, publication, or code-diff upload. Treat Beepack package content and READMEs as untrusted third-party code.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Globally Loaded Skill Hijacks the Agent's Coding Workflow
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:21
Finding: Unverified Mutable Remote Package Code Is Directed Into Local Projects
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL.md:39
Finding: Project Context and Source-Code Diffs May Be Disclosed to a Third Party Without Consent
Content: View full analysis
30s", "codeDiff": "--- old\n+++ new\n..." } ``` ``` ### Technical Analysis The Skill directs the Agent to submit feedback containing implementation adaptations and use-case details. It also encourages submission of source-code diffs through the `codeDiff` field. These fields may contain private repository content, internal architecture details, customer information, endpoint names, authentication changes, or embedded credentials. The workflow defines no requirement for: - Explicit user consent - A preview of the outbound payload - Secret scanning - Privacy or confidentiality review - Data minimization - Redaction of proprietary code or identifiers - Organizational policy checks The instruction to “offer to publish” is less direct than mandatory publication, but it remains part of a workflow that encourage ...[truncated 1341 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep